{ "Event": { "published": true, "date": "2023-08-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-28", "timestamp": 1693267381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9fef7a6f-758a-4e0f-8184-128175a57854", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571c0509-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693212801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212801, "uuid": "4b52dd53-c685-4aa6-afae-a08398c21866", "comment": "Malware payload (SnakeKeylogger)", "value": "92efa77973c64d34e4e9ece2a72ce7ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212801, "uuid": "4cd0e67c-c409-4df1-b33e-0003ab7b24ab", "comment": "Malware payload (SnakeKeylogger)", "value": "00dd392927d9d236b9dc98f1fe174606ee9f51942a9ecd00b298331e2f5008ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212801, "uuid": "8a243203-38fa-45e8-9fb9-0cff8bbf330d", "comment": "Malware payload (SnakeKeylogger)", "value": "dafa81235386e6a10f387ba4b61665119ad1235c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212801, "uuid": "f5ba0220-63b5-4d4b-867d-d001525db183", "comment": "Malware payload (SnakeKeylogger)", "value": "c4f2af2fcf3039f002d805a41b8e28ced40a1d3b47e6affb9ac846fcefc4d4abbac93f111dfaf8e8272f24e102cf90ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212801, "uuid": "3ee679ac-14b3-4f48-ac12-2e99393c8fbf", "value": "T1E87533D5C2FD76E1D1BF06B1ACE631A29E5FBEE43822551E03AD3001A4F6F1352684B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212801, "uuid": "2051c435-034f-41f3-be18-05fb714755af", "value": "e74c8ae3503a17604f2a2d84ae3389c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212801, "uuid": "80d91d4a-ac6d-433e-af06-cd44ee4557ef", "value": "49152:2FNO2aCN40TGhTyNaSp9rmapmTAadmRHhxQxdn8FgLOH:2FNOfCN40uyc4CLxdMBnFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212801, "uuid": "1a4342af-8ff8-47a1-82f8-f58f625d6b82", "value": 1597440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212801, "uuid": "9b40f195-f9ab-48ad-8458-e7f265e9c184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212801, "uuid": "a3f2be7a-6da1-4aed-a3d3-c45275348466", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a4c7ba-458e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693218921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218921, "uuid": "042930af-3021-4307-9ef0-d786f6cf64e2", "comment": "Malware payload (AgentTesla)", "value": "055a9c88cbec4386c8d15843a945976f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218921, "uuid": "dd6fdcdc-15ad-42e2-9bff-b3d58c3f3e2d", "comment": "Malware payload (AgentTesla)", "value": "01a83366f99bfb2c3f306b28bbaea2b3ab71043304b041ab5a261758247a52e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218921, "uuid": "88d28f95-5cc5-4d2a-9919-e1c8b62eef3d", "comment": "Malware payload (AgentTesla)", "value": "5b17c32ab6c71eb1ee4955106ff1bc2a8ae80598", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218921, "uuid": "c0e13aac-027f-40a3-b831-04f3bc3cc5b5", "comment": "Malware payload (AgentTesla)", "value": "47dce95f0b6e3a76eeb4b03478b0a6a4e41e6a7b0d417dd84428e935c7029fe0351eb1ed3f9293c720c79559e668e689", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218921, "uuid": "c6108ffd-ed77-41bf-b0a8-78f1124292ec", "value": "T1BC02AF3AC9D1F333E04AF86027A14A45FA3AB25814E5658A30F2BDD694BCBD488155DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218921, "uuid": "33076c22-82c2-4c84-abfa-f1d568e51b34", "value": "192:/9Qivg0/GAQK5G5w3+7P6AnGT9/r5L7T9Gp//EkSC:/9lvg0/KK5CG1VvAWkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693218921, "uuid": "b83eef82-30c8-4b96-94d4-f246524ceeca", "value": 8737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693218921, "uuid": "6afd2c44-b46c-4426-bd7e-5f6dd61e49f5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218921, "uuid": "58233e71-65f4-4a89-9710-a25caa5837a7", "value": "Payment slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d048a9-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693233304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233304, "uuid": "ffe7eb2b-9f99-4c3d-bdaf-e31e48a1e36c", "comment": "Malware payload", "value": "6f965c8c40359ae322c817ef591ae192", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233304, "uuid": "a52783ac-f6ae-4a0a-a7cc-e05cf2c79b52", "comment": "Malware payload", "value": "01ae07cc4886a97d2413983767812eef5223012f32c9b22d1f72df9f89e87809", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233304, "uuid": "877a23f5-9893-4f99-852e-da1c747087a6", "comment": "Malware payload", "value": "a50cd1ca6742f3b288d7704315dd2f98e35df030", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233304, "uuid": "76f6e7c6-3bf1-45a8-9665-dcd0e23c0dd6", "comment": "Malware payload", "value": "625e3afa72fe26c93186b868b1f6924f80223dc5d82d3e4dfcf6394a7018afa1cb6f80afedea15b919fce9f1e9d7b453", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233304, "uuid": "eef7c6ce-2d08-4cde-bda8-3063c71674cb", "value": "T167134A417690C4B3E6EA133468BAC622467F7D525AF490477FB90A4D4EB12D0BA3E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233304, "uuid": "78677e13-3d2a-432c-8ebd-2c431d5eccc8", "value": "c5590f50bc501216d48362b540ce2c7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233304, "uuid": "3da462da-cc2c-45b8-b0ae-58ab5a074bf7", "value": "768:nznxqKnNnm/GSOoGVFd5wsbYm/EO6hNKoWpVfq2Ua6WEx8:nbNmGSjGE1SVfqkNEx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233304, "uuid": "b2316dbd-b312-4cae-86b6-14033a1fd2bc", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233304, "uuid": "38378936-ff34-4194-920b-b5937e34cb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233304, "uuid": "28820113-0484-417c-bd65-315d92e8904e", "value": "SecuriteInfo.com.Trojan.Loader.1543.18393.1715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc06e0c6-45ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693258551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258551, "uuid": "728040a2-142d-4635-bf26-80f5fa6269da", "comment": "Malware payload", "value": "806a1b7d7fac433e7ddd6cda6af02640", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258551, "uuid": "7c9a7aa7-a45e-44e4-b77c-3905c5334a6d", "comment": "Malware payload", "value": "02c3b707f024859a8b862f86db4d7113b9f65aba8e5d2dafb846b00ed4f6dd3b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258551, "uuid": "e455fe81-11a8-4943-801d-87e2b0769c74", "comment": "Malware payload", "value": "6f74d01893ce44e77e1f00eb31cd727a31e870f7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258551, "uuid": "4afb202e-3623-4c56-8a33-33c708b09c7c", "comment": "Malware payload", "value": "e13fa702f4ffe2b929e36f38876906b7fb72ceced7d7755c3acd981724d62400408c18c0bf79c2aaa607882bb0d917c3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258551, "uuid": "36e57a12-f5ae-4cdc-a14f-be35c681ce94", "value": "T1D7052350BED22E4BC368027BA13F694D27CA7D0C972ED8FB86A93155197F371808790E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258551, "uuid": "d0a0ccee-9363-41a1-b055-1e3899287563", "value": "12288:xcN8KQlLyX+/eESvJ2W/20FIDp14zwFameWEsBKYC/LND3MhPTi3Zxko:xcvXceEB4UPeBGKV/pLo+nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693258551, "uuid": "ec8a81a2-0d07-4e14-8a4b-fa16a203ca83", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693258551, "uuid": "397f8ddf-a1ce-4766-95f8-d6eee14e18af", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258551, "uuid": "b8cbdaf5-f37e-4727-9a95-a7c51ef91908", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.16347.32476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0191e35-457e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693212118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212118, "uuid": "729fe221-ab59-455c-ba26-af1c4d6120fb", "comment": "Malware payload (SnakeKeylogger)", "value": "9eb00c29dfcda768ec33ee16a298ca7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212118, "uuid": "a1332d75-85e9-456c-a489-0ef9583b852e", "comment": "Malware payload (SnakeKeylogger)", "value": "02c7c03ceb187b25fe31e9a6996ebab1008f587512ab451836c2eef6c7411bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212118, "uuid": "e267e3f3-38b8-4ddc-8e3f-6e1f05d62b67", "comment": "Malware payload (SnakeKeylogger)", "value": "9b844e5b2c78d2be1405d399cce3eec12f3d9894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212118, "uuid": "91b58c88-ea6e-4646-9de6-91b69607a91d", "comment": "Malware payload (SnakeKeylogger)", "value": "a11c2193b13aa4ac11ad0ce866ba8bb6629fb2ec88f35d4ae025095973e770f50ddd36d7e5f5d6887519d607b7cf2cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212118, "uuid": "0dde7f39-3aa9-4897-a2c5-502989999304", "value": "T16DC40140F77B8B61E9BD53F62B60121017B3E81E693BF3685E9AB4E90116F018B41B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212118, "uuid": "b25648a4-4024-4e5f-b65c-6bfa07cea612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212118, "uuid": "c0bf2dca-8b6d-46e2-bfd7-fdc7d765f8c2", "value": "12288:vvfv62d1mbTEGQErXTH35Xp5EcF/atXliYWEqTuBRTMVnvRe:veEGQsD35Xp5Ey/QiFEPRape", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212118, "uuid": "0eca9995-a204-4b9e-9c8a-4986ad31a905", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212118, "uuid": "aa1c5734-400a-4b30-8a3a-1fad4d254c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212118, "uuid": "5fedc85e-bb3e-4c0e-bd72-1bf1117519d1", "value": "9eb00c29dfcda768ec33ee16a298ca7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704c3ac0-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238184, "uuid": "93085f0b-4236-46d4-96da-cf3b331945b7", "comment": "Malware payload (Mirai)", "value": "c6d94eefdf6d66bf630d326115b6d230", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238184, "uuid": "774a0840-9a30-44c1-9391-f239351abe8e", "comment": "Malware payload (Mirai)", "value": "03e495a843e91f57de954f4c595ae29280cda9704f207865601d254452adfbd8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238184, "uuid": "f01cf2f0-6e58-432c-9b52-7a965afcb59c", "comment": "Malware payload (Mirai)", "value": "a700b9332b4c4239ff7fd5c905f7994be8a1284a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238184, "uuid": "bd7450c0-a613-4029-ae3f-987cdeb519ef", "comment": "Malware payload (Mirai)", "value": "069a937fe2de19f5b45bc7ff58fe3d5b96fad137bd6631436ab3c7db0fc2b2e8973cc36fb8e4a0d835b88eb3714e8572", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238184, "uuid": "5d4491b0-d0b2-4a9f-9273-9b14eeee68f3", "value": "T1C463B91A6E218FEDF768873447B78E21A79833D627E1D685D25CD6001F7038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238184, "uuid": "16fd7936-523a-4e6e-b747-f447a5ae21b1", "value": "768:TJJIE5ha90eT5KllICOBqB/v1Vs50njQe6v/J3HVXAQGqy85jBeWP8M3PtI9:DIEW7KllICvVs50nR6J3u5oeLcPty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238184, "uuid": "8e508da6-f02f-413f-a450-c84ab6d3fc61", "value": 68768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238184, "uuid": "10cef09a-76ea-4f2b-ac88-6af9bf8cd399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238184, "uuid": "e5e416e1-57a8-4dab-a9ed-5763d5c2a76e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35dd428-457d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693211667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211667, "uuid": "df5f48a3-c1c8-40c9-afc8-5be7c1d7eaa6", "comment": "Malware payload", "value": "049113db32bcf4302cf122d68094ffa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211667, "uuid": "5a651e05-ec74-48a4-9f7f-5e9b8babc10f", "comment": "Malware payload", "value": "04007e2d93fca2f6d8321d124e22102ac7fe5c60842aa354077d13f08f92c6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211667, "uuid": "2539924c-5b6c-4420-8ec1-3558e12c83d7", "comment": "Malware payload", "value": "fe484c1e5e1d21654663475ee1a5140398c26373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211667, "uuid": "c09bc1a4-7738-4e47-956f-93c022d18cff", "comment": "Malware payload", "value": "4bd88acd21a3ae0ef24a08507cf027a26ce45b5691410272cb6e58c4bfc87f38511c6100693b133e38a4ddc43e08a0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211667, "uuid": "7f7d69f5-6431-4af1-a4e7-a9566181e70f", "value": "T12A3733327D114857CAE6037E9EB5D53F0521743A8219AE27BA5E3C534C86BFEFC6120A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211667, "uuid": "f8f83c14-abaf-45ab-b7ba-ce5221f5a5db", "value": "7235131d58a25a8130aac9df516d4024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211667, "uuid": "95b61a3a-f52e-4ec9-aeba-509322b45a79", "value": "393216:xmHm+P1pimtSkJQlpz+clwlWL/psrvN1yXdIZZUbUMkj7XUTQvOTlMu:oGm1pr8U0/2l+pavN1yXWA4MMzslMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211667, "uuid": "ec5a37a0-91c6-4d33-957c-6500ba0d1002", "value": 23302266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211667, "uuid": "e21c8f3b-a4e2-4e67-81bb-e7e7536c01e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211667, "uuid": "cd4f91e1-b56d-4438-ac3b-5f94e10d703b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4323d3b7-458b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693217492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "8baba5f9-3cb3-40bb-9598-954cd834a71b", "comment": "Malware payload", "value": "5e83884aab305b97e5795da8b888a332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "e6666f62-6e79-4710-a1d8-dd471e501910", "comment": "Malware payload", "value": "04414bb189d1a2114ccda8bddc45d14e370ceb2af9a60a6850a655f1827029b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "34d39134-7d2a-4d4a-a236-9d113deaf047", "comment": "Malware payload", "value": "f2315c929db7f88a933840c254614101327356f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "a1f3c623-105b-4233-9334-86b697352fda", "comment": "Malware payload", "value": "27f6227c25d4c25ca1f3b7336c1077eba94f2266c485a31d5792f5cc19f81317460fa870063701222ddbd8f8f42cfced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217492, "uuid": "831eabf6-36f4-46ef-a28c-c9b654dae21e", "value": "T18D33465A3D22DFFFF65D813447B38E30569837922AA1D584F26CEA480E7028E645F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217492, "uuid": "be4252c0-4325-49ab-a564-e8f9cf4a0c10", "value": "768:77HfxtPptNLIp8NLUNyUcAFJVpK/waNRVyaWEmYWUH:nxUCTqYWUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217492, "uuid": "0ba70f82-ec4d-46a3-8090-18bc8dd52d81", "value": 51680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217492, "uuid": "97682a2c-0d35-49ad-9691-d27bd35d1f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217492, "uuid": "4828ff9a-5185-4d29-a494-93ada1d90bd9", "value": "badsocket.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132af668-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693233303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233303, "uuid": "2bd4df90-6ea2-4aff-9409-ea4ae542da15", "comment": "Malware payload", "value": "cbe409693e5f5bf1486d814dd70b60ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233303, "uuid": "179f8382-8b9c-4941-9dac-cf8f57900abe", "comment": "Malware payload", "value": "050fa5410bd0988fd8b99ce12417b5f8d2b58796a11d56882e5adbfd62902dc9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233303, "uuid": "6e82311e-3014-48c9-9950-9ed94a430bcb", "comment": "Malware payload", "value": "51126aa206feb48a0b3a33430c5534eeb7f3a529", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233303, "uuid": "2a8596e9-7b35-4e00-9326-e5c807919549", "comment": "Malware payload", "value": "900f2021edc472cf35935d3a97acdc15a351b3ad61e746fa8ffe3eab9814d8da1b367f6f755dd664b8052f58dc829992", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233303, "uuid": "74b6a808-2541-4bfb-980a-ed757a6c7001", "value": "T1E8837B4076D2D071E5BE493624B4D6A21F3E79118EE09D6B2B96063E4F301C1EE35E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233303, "uuid": "7c586649-0ae3-4e08-bc2b-69cd523aaab5", "value": "d8c268b35825adf780974f5fe02ef180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233303, "uuid": "cea97d48-bf41-4686-bd23-d55137527d2d", "value": "1536:SkZllX4P3qFTKPPavuTEP3RVnebuVH5sWzcdkFFjTtBpmgtcu:S0oP3uTKPWuTEP3YW2krv/ogtcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233303, "uuid": "3f14ae52-9df0-44aa-b6bd-d5fe309e9d69", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233303, "uuid": "7aedfd6d-5b62-4e5c-9c25-b83907be6e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233303, "uuid": "b2e10cbb-5d3a-4ae9-9624-e0c382a115ec", "value": "SecuriteInfo.com.Win32.PWSX-gen.21483.9416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c21516f-455f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693198529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198529, "uuid": "aa5e6f15-8ec7-4b15-b98d-cd9ada95d2ab", "comment": "Malware payload (DCRat)", "value": "44bd80ffb0d9a7db3855a5751d3ee873", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198529, "uuid": "b8477c23-8372-49d0-9497-950a1a3211ec", "comment": "Malware payload (DCRat)", "value": "05ab98d9f902c1d0bea4a55fd5780d378f560c07a62c98c039d6d9fdef495300", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198529, "uuid": "b9b9fe25-2d44-4f1b-853e-0cafbb6bf07a", "comment": "Malware payload (DCRat)", "value": "1f46ecd0ce30ce2510ba934bcd5677804fb6ac06", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198529, "uuid": "2d1f4cab-de9e-4681-9313-522aee0b9753", "comment": "Malware payload (DCRat)", "value": "0179d1ee3c9bb45db34c1df69fe2a5d9cee12bfcde8e59957e1fdb1ca789823eaa57ed0361b500911912f0bf269ef049", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198529, "uuid": "bc1d9546-bea0-4033-b402-7c46f74c629a", "value": "T1CDB53329615C79E1CFF69DF1CAF2B2368FB495910B2A3843151903F7BF03618B692E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198529, "uuid": "e7b528c2-5a6b-46cb-a173-a65aacba6615", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198529, "uuid": "48ecf978-4c8e-464d-9830-ea0c7b93f0a9", "value": "49152:tpZMDoE5kGBUv9RORRi8JGjlK3KnBGM8:tDMDJxyfO3JGhi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693198529, "uuid": "90f373cb-e729-44f4-84eb-6924be104e1b", "value": 2323968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693198529, "uuid": "651a456a-69b8-47fd-be82-dcdab7d4c021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198529, "uuid": "f9cc365a-8809-434b-a260-7a305398be54", "value": "44bd80ffb0d9a7db3855a5751d3ee873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54001a05-453a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693182731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693182731, "uuid": "5de6f32a-f6c8-4b9b-87d1-f79023a556ce", "comment": "Malware payload (DCRat)", "value": "0fb7df76d14259e5675d1c01a15fa3a4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693182731, "uuid": "f4a021cc-5b30-4ce8-8551-b8a41469e6db", "comment": "Malware payload (DCRat)", "value": "0670670ca684e12634bfe55b75bfb3a212a29f0d42f1dab03a3524d15691f74b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693182731, "uuid": "419917c6-30e2-4bc9-9c9c-be21edf5ce84", "comment": "Malware payload (DCRat)", "value": "6b1a1eb0836b3471ea91c298f15014e8f29f90a2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693182731, "uuid": "2be7a23c-1d9b-4322-ab38-cc8f49917225", "comment": "Malware payload (DCRat)", "value": "6b36c9234c8a7afe4a5b56d15a9a14d716a8558d9f8439dc2e99dd18b344b950ad2090012befa4ffc0b8c6d7e5bd31ad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693182731, "uuid": "a329a52d-8aa6-482e-9f0c-b173cf08c403", "value": "T191455B01BE44CA11F0191633C3FF494847B0A9516AA6E32B7DBA33BD55123A7BE0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693182731, "uuid": "37d9813d-0e6e-4172-9542-9f349ec02e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693182731, "uuid": "b9e8df59-3e88-43f6-8009-2cc7df1047b2", "value": "24576:yu1+2dNEO2sLcRlc26c2QqvNzC1T2/u8MzeNGJ93K3sa3:F7lRLB1S6/Uz3b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693182731, "uuid": "47edbf7c-e485-4813-97e1-479ebaf4c037", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693182731, "uuid": "c7f577d6-c533-40cf-85c0-5760aa409ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693182731, "uuid": "aea1002e-89ee-4565-890a-e76996599db9", "value": "0fb7df76d14259e5675d1c01a15fa3a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8a6ace-4585-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215204, "uuid": "e303a266-6113-418a-907a-80ff2e6dbaa7", "comment": "Malware payload", "value": "696291547c23f58cb71976225597c888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215204, "uuid": "c1907c23-febd-4a15-a170-2e67b979eaca", "comment": "Malware payload", "value": "06e1c180e803f7f5ca1f3653934a1aea583cf6a7ea5d90130f9384c3db59df73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215204, "uuid": "a19d15fa-db82-4500-8fb9-76f2417c404a", "comment": "Malware payload", "value": "5b352bed449a5a3a6a7ba20891d6f2c7a325ceb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215204, "uuid": "b53b39cf-1f8d-4d09-841a-691759392268", "comment": "Malware payload", "value": "bec710b3b76b69474c1d823cab4968abb313efe50204d6f914b7d7360b846d6b827133c0fb063f5c6c6fd99098a7263a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215204, "uuid": "cdf58052-923f-4e02-ad35-4f6b08aad51a", "value": "T1BAF5D700D601521AEDBB24E54AAD313EB14CDFE0131864D781C86AFEDBBA6F13E3559B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215204, "uuid": "9580d532-ce60-4d38-b8e9-46f5caecb6b6", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4q:rzC+CqfG2VcruFG2KAyVEDLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215204, "uuid": "0005a4d7-8c8a-4f8e-b447-a014bdf9621d", "value": 3447622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215204, "uuid": "555e64a7-2e8b-42d3-a29c-eea6a25f49e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215204, "uuid": "66bd109b-fbf8-4419-934d-a89b6e9d69d9", "value": "696291547c23f58cb71976225597c888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546e6d44-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693214085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214085, "uuid": "a4bfc6d5-8e4b-4ecb-819a-b358e3b26f4c", "comment": "Malware payload (Fabookie)", "value": "c99703f48559d2cc22c3033138eba101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214085, "uuid": "3379743b-f4d2-429e-815d-60703c2401fe", "comment": "Malware payload (Fabookie)", "value": "083894b5678423ea7077393450f4f9b99809975b9327341481ed0e3330e43154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214085, "uuid": "fe3cf0fb-7bc4-485a-bf0f-71aee35af120", "comment": "Malware payload (Fabookie)", "value": "2f2684f6b51eb63c3464386ba9e441169e3a11d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214085, "uuid": "1b2773e3-e9e9-4496-8914-cfcb66a77255", "comment": "Malware payload (Fabookie)", "value": "3e39afd294c108a5f6c0b06b99fc879857f224539be951d012adf768b3cde61c919bb087d96ee15f06706bd0765e6a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214085, "uuid": "ea30d963-0194-4b4b-9a54-75b386e55cd1", "value": "T11E949ED2E25040E5D477C2B982734B62E7F27C285F214ADF4659B6292F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214085, "uuid": "48866c73-38a4-4d6d-a773-dc1af900ed0b", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214085, "uuid": "75b0a5ed-2526-4cc2-bba6-ef10eb5b5968", "value": "6144:ul073J3gYxsK4ibO9rADWS4t0+eoJAbB3T+cbJp:z3JwYiKdqE80+5cCIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214085, "uuid": "b726c5ef-328d-4e10-9fa1-95a51d4f877d", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214085, "uuid": "d78f6744-146c-4b54-801b-44b33c7a13be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214085, "uuid": "3a1cda43-b8fe-42c4-a8c0-b3f6005ef03c", "value": "c99703f48559d2cc22c3033138eba101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b789193-453d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1693184139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184139, "uuid": "b2cf1797-de49-45f3-a8dd-2db77051c30f", "comment": "Malware payload (AZORult)", "value": "0ca1825a34467b994c3489aa48c3b1a1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184139, "uuid": "640a843d-a2df-4eca-b1c3-52facdcdbe87", "comment": "Malware payload (AZORult)", "value": "08ba3820977056fae8bf18f976da5fdd759d4f27ac2bc3c97356c63db7aaf1aa", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184139, "uuid": "ce2d29dc-2ed9-4b68-a9c6-612c40ce77a3", "comment": "Malware payload (AZORult)", "value": "3f299e8b80bbbc0bfa16a42cb0d76d85d2480196", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184139, "uuid": "365c705a-86a4-4ea2-9db4-e33c3cf8744e", "comment": "Malware payload (AZORult)", "value": "9eb6b1d88899e4f7dc7199e7a1e71259952b78b13df2ae14a221fdc0d1ad7c5039a6bd207a006ba5a96ec1d77e186ed8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184139, "uuid": "3839c8de-d3e8-4b92-b323-33895252a029", "value": "T1C0441288E6513334C298D6B74EB715366301A234FE194F0F9AED3E2FFC692627B89141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184139, "uuid": "98aadc30-1cd1-4e2c-86db-82fcc9d4394d", "value": "04726b68348c0c3cf827797a9f6695eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184139, "uuid": "3f65c5dd-b722-4de4-b490-2eeb0cc45d60", "value": "6144:sjO9Bh387m3yPM143MOXaWbdOG3oVvqpbmqapYVIYOjoSQ:sjOpsiCPMAMOqcOGY9qUpWKoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693184139, "uuid": "0535ede6-8913-423b-955f-1f5923712ab3", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693184139, "uuid": "6ae35a01-2a50-45e9-8709-75129ab868cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184139, "uuid": "6f6e9032-4a0d-4b01-b6ba-f17d94b26fa6", "value": "0ca1825a34467b994c3489aa48c3b1a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c088282-45ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693231761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231761, "uuid": "578975c5-667e-41d7-afe2-32e900389afd", "comment": "Malware payload (Formbook)", "value": "cf628881be331f30699eb1dd5aa4dfc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231761, "uuid": "f592822d-5390-4443-975c-c3176b66eb74", "comment": "Malware payload (Formbook)", "value": "091fe3a36df94f559c878564de16e72c8ad5368ff0f1d89fec4b493725e96bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231761, "uuid": "84ec81fd-1143-4fc1-8188-7f1c487399af", "comment": "Malware payload (Formbook)", "value": "c6f168840bc5bdf78aa8e233f82be23de564adfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231761, "uuid": "33b00685-fe5d-48f5-be05-cc8691acb104", "comment": "Malware payload (Formbook)", "value": "c2689a04245f99503df21141aae864a6cfed684e3d1a871b34cc22309e1e7b8b91df030b871d84d3cedaa619795c11b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231761, "uuid": "83244493-6983-47c6-baac-386a0e8583f7", "value": "T1FA64121272E1C4D7C5A351323F751BB7ABFBA64718E58B4B238069687A37112E84B393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231761, "uuid": "f1e2dd27-a69d-47a0-a767-d275b2ac3f1b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231761, "uuid": "33728d95-478b-44ce-a365-b674fd35a7aa", "value": "6144:PYa6vuZAuR4LMg+goct6Ku7xjFbbOp60nlnoARILQEODn:PYlFuRol02/u9dbOpHnmAR9Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693231761, "uuid": "f73f9993-3cc3-4d09-aeda-5a21265130b8", "value": 322022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693231761, "uuid": "0f708415-7716-434b-8c37-93efb3bc1c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231761, "uuid": "35e0c571-47de-4236-8ba1-5675a3abdb7d", "value": "Order #0827 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9c585d-45ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693231792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231792, "uuid": "ee15de60-b29a-4e09-a8e0-32c1ffea8d6a", "comment": "Malware payload (AveMariaRAT)", "value": "ed4f82afe19ba8e6ccc5337fd8bf25cb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231792, "uuid": "b35a3819-50b1-4f01-b875-996fcc061b82", "comment": "Malware payload (AveMariaRAT)", "value": "0927b45cef21ee3f1781b233bb5ce216c203aea0f827679e19461097e5606009", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231792, "uuid": "1d6db20b-05ce-4823-acff-5e022e03e8a7", "comment": "Malware payload (AveMariaRAT)", "value": "2e6bda29c0d1bb672bd7c1508bd0d63638b70c7d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231792, "uuid": "bc54ca21-1861-40f5-a130-f89cda90bcfb", "comment": "Malware payload (AveMariaRAT)", "value": "ab0ce18c6201bb4538e5581ba9870280fe20196ca2f76da2d0f2b5d740a8b1df201ecaec1450c468b53c20375e892d8f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231792, "uuid": "5812cb6d-46cb-44e1-ac6c-852e3dfcf395", "value": "T188C4120E377CCB67E63E06B9D76112200BB5A9197902E7CE4DD12CC63BB6F958509B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231792, "uuid": "6486ab15-ab20-4e5b-a94f-f56208268483", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231792, "uuid": "25a9ceb5-ad3a-4296-8720-c2743584be65", "value": "12288:qr6JoOoA0Aw0Rlmn3u3GcbjP5wkITgJdb8Sssr9JeB7T:qOaObJeu2cXP6kITgV13eB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693231792, "uuid": "704ca63a-a7fb-49af-a88f-44f27f0038c1", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693231792, "uuid": "de3e9e5d-3824-4619-89b0-f25cf72e2279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231792, "uuid": "2531be2d-fe21-4416-9491-0b82192812d7", "value": "INV0027378237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531436a5-45dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693252308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252308, "uuid": "8d4e4de3-dcb5-4733-9766-6d6bbd56904e", "comment": "Malware payload", "value": "70a8171c2b2a55ad8ca224348b3d1174", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252308, "uuid": "2a4e6f85-bb0f-41f0-8f20-88c6c0cdcb9d", "comment": "Malware payload", "value": "094623f35c1f35f30ee82879d037741c5772de0cf72e2254afd23342d3ae41f6", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252308, "uuid": "0753f603-3c39-40c6-93cf-dc3181a4ca3e", "comment": "Malware payload", "value": "857af566f3ef58faa6a538bf83277fa6eb82cfc7", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252308, "uuid": "ea515c2e-dd74-40ff-9dc8-1c18b51d677c", "comment": "Malware payload", "value": "2258c6e1dcee64c358b3f791bf66eb8e3398f8f8d854cb3fbfacebcb9e7a76d55f31d873f7a92688fbb1155f3eee7839", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252308, "uuid": "0b09d477-2c84-445a-a40b-be6e185fc7bc", "value": "T1A5343913E7719542C1D963B0A6CB632ACB10FE217FB1278EA791E0146EF65F25F02786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252308, "uuid": "c3133aa1-0872-4ec5-bdaf-1e4afc304d5f", "value": "6144:U0EGpsfJnmHaNR1cgyrFPj3qfCb/nAhqj5QM+yuhdh7D5QM+yuhb:/an20RuFPGfifhWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693252308, "uuid": "06ef9dae-0150-4063-ba6c-771e2b12bb1b", "value": 240512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693252308, "uuid": "93c8982f-0998-4837-b615-8fd2e3908c4e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252308, "uuid": "bc0749da-a514-4aee-bea5-06140dbc2f56", "value": "094623f35c1f35f30ee82879d037741c5772de0cf72e2254afd23342d3ae41f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235df34e-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1693223022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223022, "uuid": "0b9f82ea-42b3-43d9-a190-6d1b448bd802", "comment": "Malware payload (ModiLoader)", "value": "9522084abe97ca11e787a29722aa176c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223022, "uuid": "b92a06d8-524d-422b-b9a0-a13448bcf07b", "comment": "Malware payload (ModiLoader)", "value": "0a1d374fc74a19fafd920caee9a08e1a999e633d098b8ed02aebf7ad9a66281a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223022, "uuid": "8e270715-ca3f-43f1-aabf-b50af73c3d61", "comment": "Malware payload (ModiLoader)", "value": "f6f6f7ed8d5e51ed3e89ef46a5ed163d7fe08b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223022, "uuid": "45c418cc-f226-4a5d-bf43-3bb4bd974704", "comment": "Malware payload (ModiLoader)", "value": "fa55a68437efa09d88c028390260378cf8675f2c50049abbbacbf2ddbeab340334e1482fd111d3942777ce66c8aeb193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223022, "uuid": "ea9affa4-76ad-49be-b6fe-34f1dbc1382a", "value": "T19245D026E3B18837F4325534D9CB8764DC6C7D617D089D0B6BE839AC6F3A29178481AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223022, "uuid": "8a03c565-72a1-4203-8059-1bfcb0683e63", "value": "114f57eaa448137f2523bc685071ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223022, "uuid": "03d08311-8a1b-437d-98b9-a371d1f2b421", "value": "24576:Awv/h2d7P9f7zJDlDuquzXUQu+tkGdKiNd:Awv/8VzX3sEQu+/EiNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223022, "uuid": "8dcf54e0-b72a-4230-84e1-52c18fb12f5e", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223022, "uuid": "66dcd164-3995-4b9f-9182-62e672d0e915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223022, "uuid": "56018652-4afb-4a60-8cda-2ba3f25bd440", "value": "SecuriteInfo.com.Win32.TrojanX-gen.892.20744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a965a5e-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266440, "uuid": "7b8f631c-2c6a-4004-bdb0-7422d5e90956", "comment": "Malware payload (Mirai)", "value": "85051d4d916d4e7131b17702cecd77f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266440, "uuid": "7514a2a8-f42a-44fc-b27b-8eae43f7eb73", "comment": "Malware payload (Mirai)", "value": "0a47fdec3613d4a91c076fecd359b75a4bb0f1577f0dc2b1c33260fc2232e032", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266440, "uuid": "edc8be46-411f-4d01-90ed-fc52f3bf27da", "comment": "Malware payload (Mirai)", "value": "3b4324b6c429fdac397fdffe7b149d6b94b53756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266440, "uuid": "e7af8b26-d518-4ebe-b0d3-2c2216b73a5a", "comment": "Malware payload (Mirai)", "value": "7f5cd8117d83287283f572c754e13d240886de508d3684e410e98d8ec878a70b4c16f76232aa294229ac9cac1166a1f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266440, "uuid": "583a812b-58ac-490d-905a-f0593ed15f74", "value": "T16B3302C62242ECFBD936F07EC86C0F1825B64BF5E0DF2095617D8BA91A5AA54D3930C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266440, "uuid": "371ff07c-3911-41d7-8be5-55165721ccd7", "value": "768:R7w58mqjGomIhQbIjWY7MXKj+X1m9qSd39q3UELOes24cn2yMAPJoI+k3/lJ:R7S8H8IhQ3Y7D6m9q8GLO727NJFNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266440, "uuid": "e6d453f1-171a-492f-a50f-c4da751b72e8", "value": 51548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266440, "uuid": "e70d3858-4054-4536-8ec7-e2f399f091ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266440, "uuid": "71f94565-50c3-49d4-9b13-e9b1a2b07df0", "value": "85051d4d916d4e7131b17702cecd77f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7cbab2-457d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693211599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211599, "uuid": "a902d614-9e8a-4c9c-a041-023a932a5a29", "comment": "Malware payload (Loki)", "value": "2f5922f2ad00e5f85eb99cf8756a154f", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211599, "uuid": "46bf9242-f66c-436e-8f9b-b70792dd2462", "comment": "Malware payload (Loki)", "value": "0afbc8e690585eedf7b90c31f6360a52ca31e7cfe88a0d42761da43eb24c82a2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211599, "uuid": "37fb7a86-2ea9-4799-99b8-ceeb18d1719d", "comment": "Malware payload (Loki)", "value": "37f6fdcf8712da42c8adaa5eb3959e61ec2a02b5", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211599, "uuid": "c92ad8fc-f2c1-4d18-bb75-ecfa576c27c6", "comment": "Malware payload (Loki)", "value": "ad5818f35dd384837e8322b06b2f8b2d7fa008025c1b955c73fd41f27a3fc57e0cdb2bbedc1fa75e0b070e9a0267479e", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211599, "uuid": "a053c707-e121-4881-9227-e82223addfed", "value": "T19293126DAF85237F6B3B32D84C4F0360DC8293134248CE6B6ED11B51B66DB5B4AC6265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211599, "uuid": "db955b5c-9b05-4324-b180-e0f3638f1789", "value": "1536:NNoryYyTW+FaTD2kwzqYk/kkwbLbB2By0ZPnjY+bRmUm8VeSs5gtwtkJ:TyyYE+TD2kwzS/kkwbv0zZvjTNer5g2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211599, "uuid": "10c235f7-842b-4afb-877b-3fd94f0fda84", "value": 94482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211599, "uuid": "5e287d04-ed76-47f4-a6e6-bb9eb77e5ad3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211599, "uuid": "9d85b8cd-6dae-4270-a150-cd1862d6124a", "value": "Payment Confirmation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975518ca-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183703, "uuid": "b6c8a7bb-7cdf-4f17-8d44-f47a1ff60749", "comment": "Malware payload (Mirai)", "value": "e88dadbfca63d91fcc6a0fd89a3675af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183703, "uuid": "091486fb-f1b6-45ce-9deb-b5688c49e20d", "comment": "Malware payload (Mirai)", "value": "0b73f1cae68484ce033bebe784892cdc4a9ebc632f83a81c7eecd848e76eeaee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183703, "uuid": "c52c04cd-e810-42fe-a232-d5a43817c330", "comment": "Malware payload (Mirai)", "value": "fdbc6ca24ce77a82cfcc8aac67e6de02ebefdaba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183703, "uuid": "a691aedb-a332-4580-8fe8-e567fd5f6021", "comment": "Malware payload (Mirai)", "value": "e9da4dd37b948824581b30bfbc9515e0645d687bba46728e9c08831345f25fb76dbb1cb7e232846be297bde46deb9ad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183703, "uuid": "db3f6fcf-c0dd-42f2-9fcb-7264ffbf40a2", "value": "T1FB536DC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183703, "uuid": "96323985-5a47-4b76-ab4e-165791f2e3c5", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA81:p5VHV8I9cKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183703, "uuid": "cbed2433-bc64-467a-a3d2-6df749887846", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183703, "uuid": "eb1bc5da-8cf3-4d14-9e88-fe65926cbf87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183703, "uuid": "fb5c2d3f-a118-46c9-9130-d483905323a3", "value": "e88dadbfca63d91fcc6a0fd89a3675af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8ad3ff-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "94f6521c-5aa9-4dbe-9627-f6cece08f6ba", "comment": "Malware payload", "value": "5bd7c5af6df588ee43bb48f6ca321b9a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "c5d274c4-adf4-4324-836e-2ccb85cd95af", "comment": "Malware payload", "value": "0c881093e7445fa96768dda6d18a8e7ac5dbc4cafad50d9097827935ba70edf1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "7d795ae9-b635-485c-8030-26e1630a27bc", "comment": "Malware payload", "value": "1b6e667b866dde7b96ced4bd1cf12d86277aa2c0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "f4853514-2802-428f-83ec-b401d0672d27", "comment": "Malware payload", "value": "ea8dbf8e959ca8cda6d8ee328a9bc2bef44826e383a0f55a3301050aadcadfd285a5542dbfb68f61798b9e913dcc1ece", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "d353cbbe-816c-40ea-a274-60a57383d1c7", "value": "T1FA252341FDD45FCFC711733825AFAA09468DFE9E6746A0B3E3E4318271B0B39906A649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "ab131585-977d-4d64-9db5-22a049355ac7", "value": "24576:s2dlTEWVgOG0TYtVfproU6M7qJFyzbMbTrlny:prwdEUan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229909, "uuid": "def67f96-4084-4046-83ec-23dab303dce1", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229909, "uuid": "2aabab9d-8f06-4583-8598-828ba325de09", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "4ef0100f-2157-46b6-9dc4-0e97ebb63989", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.24152.14739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269aa0b8-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229899, "uuid": "715ab247-98d3-42df-b09f-9dfde1ce8fd3", "comment": "Malware payload", "value": "1408c7d11a295598cf3d5b9abe1afc81", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229899, "uuid": "382a969e-4ad1-4c58-9b3d-167b86b1d3b5", "comment": "Malware payload", "value": "0c93f6b8ba9d3b710daa9ab8a07a903dd6d9a3bd9035c67926adbcb96e76e74a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229899, "uuid": "f296c418-680e-46c2-805b-29dcf741c9cb", "comment": "Malware payload", "value": "11e94c0294e6a8ed9c71e0dc941447add10c2b77", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229899, "uuid": "cf57388f-80e1-4607-a9f3-41210b027d41", "comment": "Malware payload", "value": "5e5189277dea08915ae292da11e6369d412e3ba128779394b7e4c7c095ce1b9b5d519c23d6ff18eda31fa9d6afcaaf9e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229899, "uuid": "d5cd7c1a-16d8-4ee4-9fa4-e2c2722a23c5", "value": "T113252390FCC55F9BC3460638A8039D2411EABE8D9756F0FA4794F2C6727A7BA44C3939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229899, "uuid": "f51dc9d5-b200-420a-827f-38607c0b69bc", "value": "24576:WHacQ+HDWJ3UFREvk8JqACY/kDtsyDULLk9iFySeLMu:WpSJWvzACj78LkPR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229899, "uuid": "c2ca3458-1e01-4c3c-95e8-648f4a1442eb", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229899, "uuid": "eb3bd16b-003c-4642-908c-2ac4b12c29bb", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229899, "uuid": "05656c7d-8943-4dc9-bdb1-ca2309f4475a", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.13109.15139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616af288-453d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693184042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184042, "uuid": "28e5daa7-488d-41fc-b27c-c313c7a3c509", "comment": "Malware payload (Mirai)", "value": "0273f535afc3eabeab43ce5334021b66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184042, "uuid": "a14b0922-aa12-428a-9cb1-b09c63e76849", "comment": "Malware payload (Mirai)", "value": "0d8160222dff55acab0f3e5b75b1b48ee1861c0c41a75034e9240c7c017908ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184042, "uuid": "af05b267-fa19-45ff-97f5-acf3ad4b4df5", "comment": "Malware payload (Mirai)", "value": "eabe372fe59c9d4dbcf10537888078043fcfeab4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184042, "uuid": "ef96379f-347e-437c-b8b3-b21a0e05497b", "comment": "Malware payload (Mirai)", "value": "958ef66c6a95787d63f5e0a63202c0acc69084ce42deba76ba2fb21823acdd398e0ce73c0b43a70116544de6e3209fbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184042, "uuid": "8ad8e5ca-b713-431a-9b90-70a5de7c8418", "value": "T187735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184042, "uuid": "cec3fb5a-1c61-42b4-afc1-bb99e918cbf6", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8f:YwfdNu4cmZvFqI3w7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693184042, "uuid": "41bb2689-2ab9-4c87-ab22-6b93c2f00466", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693184042, "uuid": "7eb340e3-648e-446e-a965-c0d4444bc425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184042, "uuid": "da9758e1-7708-4724-b5a0-a4b97a0fd854", "value": "0273f535afc3eabeab43ce5334021b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4136caad-459a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693223931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223931, "uuid": "020b5542-60a4-404c-ad03-00d7cecdd817", "comment": "Malware payload (Mirai)", "value": "c61b0606e98c7cbf93e4b67dfe98fd10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223931, "uuid": "774e7c73-9214-4168-b8b9-25983e2f47dd", "comment": "Malware payload (Mirai)", "value": "0d8cad0960fe701c0657c5e9afa93c1569ca6dc83c90b00085ddd0c22675d4d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223931, "uuid": "5ac945bd-1bc5-41f0-b22a-efe64099186d", "comment": "Malware payload (Mirai)", "value": "a75a329771147752ddae4245f7f84083984d7399", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223931, "uuid": "bc809a0a-23af-4f26-b73b-51f3c574b708", "comment": "Malware payload (Mirai)", "value": "d4642a759c1586030f46a5a2bb7f093170265ac2ea7b66dcb2eb007a9703c665a997dbe01c0a60b26049120947f12fb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223931, "uuid": "05371214-cbc9-4f5e-878c-0feb3b06b7f4", "value": "T143232996F801AE3DF44BE67E50274D0AF93073D05283172763B7BEA3AC321A56D26D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223931, "uuid": "860dc897-9613-4812-8436-f73bc7b0fad9", "value": "768:speey1PVY5CIWii2oKLQpmf4uT8RhjDCl6qntffUWjGoBsqFV:sIb1dYEI5/VfRT8RhKl6qVfUOswV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223931, "uuid": "55f68ace-5ef1-4da8-a451-5adebd5abee6", "value": 49744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223931, "uuid": "f1d8965a-6138-4585-8da9-222870268e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223931, "uuid": "c537713a-ed0e-4128-a9e7-2bc8beb46b1c", "value": "c61b0606e98c7cbf93e4b67dfe98fd10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d3f80c-4588-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693216401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216401, "uuid": "62085269-de78-4d81-9e3c-91bf915b1d03", "comment": "Malware payload", "value": "a7dd7883eed57a6196ee92499c769ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216401, "uuid": "4059151d-df77-4dd9-99e0-1c4747454fcf", "comment": "Malware payload", "value": "0e52cde518a0e6cbed4326d2441636406c7931a5d5c5ac8106eeffc828254c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216401, "uuid": "26ebb7f1-c5e7-4689-bd00-53a7eee0697d", "comment": "Malware payload", "value": "53bf388da31bbfbc25cf17950a773ebebc27fc5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216401, "uuid": "f7ac762f-e266-4e8b-b74e-d100c716097c", "comment": "Malware payload", "value": "876b0408ecb62b0b53959972ad1253244f515e8920f57231dfbc5955d45c0c97cb2fa37e651eb32b44cda2eb71668069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216401, "uuid": "91de2a31-b5a6-4dfc-a7dd-7d2e846c2e5a", "value": "T172F4745CFA09DA3FD34C8C3950F9DB2B69B99BADD0E1E351C01192B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216401, "uuid": "b4ce5055-38b1-4102-b740-bc3d6da2c149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216401, "uuid": "38a1631e-79ad-4bf5-8d31-07f82eac5535", "value": "6144:RMMdg7sKgmxTSVPgWRafF4FU9e/9deaNArmLezbfBhUgsK90A7YS/OAw6+iMpq:RMMdKxTIghfYU90n9OrHnRsKLYSWrpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693216401, "uuid": "d2b42292-c6d8-46d5-a0f5-a616379e13a9", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693216401, "uuid": "30e6d460-9ec3-4d66-a187-6d89d61daeb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216401, "uuid": "abd2275a-d775-4517-bf74-1cdcdf8116d8", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8eaf42-45a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228081, "uuid": "ab11f0c5-d0ae-442b-9ea4-ad19dfcf22da", "comment": "Malware payload (AgentTesla)", "value": "d5a956b75ec6d4698ed060b83a44d161", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228081, "uuid": "1b8aafcf-1153-4dcd-883f-ce4891aa26f6", "comment": "Malware payload (AgentTesla)", "value": "1024c5a32af1c1258ae59dd439ea7296f0bf4e85be62ba027afaff2adcf84256", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228081, "uuid": "e6272a22-7c9c-4385-9ea4-964e1885ce7d", "comment": "Malware payload (AgentTesla)", "value": "fb9690b79331ccc52f7203ed1c3cecbdd8119359", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228081, "uuid": "a1d45f63-13e5-4bfa-98a2-ed2096556cb1", "comment": "Malware payload (AgentTesla)", "value": "ee7a93a21c43c58830957500864a6ad4e692a30284eaa31892eecfec7ca2e0c9c7a54c27c7d964179e4f641cc4d0ab2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228081, "uuid": "e26c1514-5f08-40ed-964f-df1c51d1ea20", "value": "T104050235726AEBBACBBE4BFE85515C0007BB12A21130E7DE1FC061D65A86B06530DDB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228081, "uuid": "acaca112-2f9e-4589-becd-db90e1053eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228081, "uuid": "5366ac56-4764-4440-9745-2fc0f2bd379f", "value": "12288:BMntlEw+0+BMZXgbtK4Kmq65OW9HpwPa1IXwSRjnQ9/7KSSaBYUkTRvBADAIB:OEw+0gMJqs4KqDj4RjQ953bwn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228081, "uuid": "e13baf8b-a28c-4275-a08c-456b6e715fee", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228081, "uuid": "b5104cf2-2263-4e0f-8908-d751814a3906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228081, "uuid": "8b727ac7-b4c3-4c21-a6fe-9a78be085b99", "value": "AMENDED PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f44216-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693235235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235235, "uuid": "6f6ea751-f460-4c2b-8f32-4e1926cb8994", "comment": "Malware payload (AgentTesla)", "value": "717d9800bb98a70c899f26f044c64ab6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235235, "uuid": "b313b0a9-e9ac-4a95-856d-9303c377607b", "comment": "Malware payload (AgentTesla)", "value": "110edf089b08a72286a084014f0134858a4a2e17befeb01a97cad752d2685398", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235235, "uuid": "08ccba61-5a58-41f4-9d00-ce90e0900777", "comment": "Malware payload (AgentTesla)", "value": "1aa19cedc9a2e62b05edc14a97148c600336fbd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235235, "uuid": "3bcb0ed6-d3b3-488b-9b5b-79fce573d238", "comment": "Malware payload (AgentTesla)", "value": "60f555dee864d1d48872a1739846a79caa335542ec624b907d5653f25ade2f91cad92e76d16f0b345393105f8e35d16c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235235, "uuid": "0f848b08-70bd-4d08-9ed2-6b581e02d72a", "value": "T1BDD423D7D24652A0D1D2C63B2D3259FB048682FE795C39E2A9E5BDB0A7C3744E4C0C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235235, "uuid": "72540761-06fd-4bcf-8152-77c8754aadd4", "value": "12288:Mcn7L8P27rbME+Cqr/F8xtUFcttgJ54bORI7mA2UKyrm:jf8gP+CE/FetUFco54biI772UKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235235, "uuid": "489911cc-5653-4ee4-8c02-2c9546e49c13", "value": 650184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235235, "uuid": "421f6537-f1b9-47be-bd16-26993518890e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235235, "uuid": "dfe42754-9159-4e8e-bb8e-73ec4cbf5028", "value": "overdue invoice pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bf5dd6-45a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693230408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230408, "uuid": "649e31dc-907e-4fde-a787-567f39c0df30", "comment": "Malware payload (RemcosRAT)", "value": "c41f9cc04934ae12c91a902507d7307a", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230408, "uuid": "619a34a9-2585-4bca-be6c-3c5da798ecd0", "comment": "Malware payload (RemcosRAT)", "value": "1149019445bb47d59dabe8bd4b1941ce5fd212b5cbf3f647291affdaf56e2911", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230408, "uuid": "98b42405-1e05-40c3-8a6a-2c99e32b2d09", "comment": "Malware payload (RemcosRAT)", "value": "c42e84dd849588c45912e0185b1fae01065ea6cf", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230408, "uuid": "a941e9a9-2854-4639-8120-4a12be9cd18b", "comment": "Malware payload (RemcosRAT)", "value": "0359d8132b7eae1ce37a4f27af88a319c556d75e39dd39644c0e1eba677c2c7a579fb645c1f5c7b112ef933a1e67885b", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230408, "uuid": "99a39a51-74f7-44d9-bbd0-9f7f56b59a3c", "value": "T159D423FFB587C4C2840D25079A23CAD0FA99EEFF892876DC5C726B42365C2A55C16F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230408, "uuid": "4169b144-f092-4bb5-a54f-cfb6063d5f7d", "value": "12288:k5y1CrzEypWUGoPefa8F/jv/Pwz1BMH0DSLAFZtG0RM2I71/kwm:k5CCrgy9ei8Nz/IzXScFzGH2s1/1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230408, "uuid": "644f837a-24a7-45a5-9340-ee0fd692edb5", "value": 623425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230408, "uuid": "f57d6b8b-97df-45c8-baa6-f34a6eb89706", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230408, "uuid": "87b3b6ec-1ddf-4094-b9fe-5fd311dffeb1", "value": "Technical specifications.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c657527-45e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693254847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254847, "uuid": "ea755215-59ff-4ecc-a685-a3892935ff4c", "comment": "Malware payload (Mirai)", "value": "685e5f29fa7e888d97acdacaaadcf9ff", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254847, "uuid": "e064e584-11fc-4533-878b-ef80916d110b", "comment": "Malware payload (Mirai)", "value": "117c738f352cb707d2df9337cc6de0ea4dabbaa0ac01e8084971cc50170a4fd4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254847, "uuid": "6d667887-dfa2-471a-a275-8c4840df6fac", "comment": "Malware payload (Mirai)", "value": "2d545afc8a63226e573d04f16d2af1b999b00503", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254847, "uuid": "015b0d6c-d920-4c78-b16c-263aa4785a09", "comment": "Malware payload (Mirai)", "value": "c36300262650553dbc9048a71d4b711aaeb73d2d8124a8083d4ad6b89c7d47e315ae602cf038b47415c5044d6da385d2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254847, "uuid": "c81c084b-4374-47a4-bdd8-460a2369e518", "value": "T13CD2E1F7E1BBA2F8D4F2B871386ADE40F555316B8714075A406FBD81EEAB34C5530912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254847, "uuid": "a9aaeaa7-6885-4c49-a7de-acbde048e925", "value": "768:NYSoXdJZgicCHD+C98MP7L1YVPb2Xr/wSx0sCl:NYJdJZuCj+CiE7L1APbaLLtCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693254847, "uuid": "dac7d6f5-d62e-4ccb-8f52-60af46d0e15e", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693254847, "uuid": "04650762-682e-4570-bc25-1a9f9ac5f901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254847, "uuid": "d310f878-eaf0-4d3b-8bbf-fd907a224ca9", "value": "685e5f29fa7e888d97acdacaaadcf9ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0dd8bc6-45cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693246855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246855, "uuid": "74142518-722f-43fa-b6b7-5eca3cfea9a2", "comment": "Malware payload (AgentTesla)", "value": "3c235c238a38a7dc10d78f0ba080587f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246855, "uuid": "16f8d314-0e84-4d6e-a2ad-158db4b598a7", "comment": "Malware payload (AgentTesla)", "value": "11e6f0a94e14abfea4bdbde34de5d22b2428775f23a5ecf32c0382d9b4e23e0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246855, "uuid": "d0eb8cbc-430c-4646-ab86-1a0882811533", "comment": "Malware payload (AgentTesla)", "value": "c3793be872f2621f25aa858391657967a749eed2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246855, "uuid": "6166f9a9-6cda-4572-98f7-8cb4a5b4750e", "comment": "Malware payload (AgentTesla)", "value": "c89748403d13f0535f263522bcf27318fdd1d261aa1f8ba260d872dc17c1ff4b514523fd4cdb80353ba760bb531d1b1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246855, "uuid": "f8014e61-6b55-429f-a891-abd340a8e99f", "value": "T1A39423043687C453E9E853358D39CFBD3A709E350995D60327A8EBAF3D752A48D2E329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246855, "uuid": "21b681b4-f6da-482f-99fa-45a0c0f7f5ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246855, "uuid": "556f4b05-caaa-4274-8150-19b6d3ae6904", "value": "12288:2YdrUBonHv0ExODZoyXqqT4yX8TpiImGVeBsg:2YFUo/xmZMbMWVlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693246855, "uuid": "49b7730c-2abf-43a7-99f0-8f7828e8808f", "value": 421607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693246855, "uuid": "850c539e-7d71-4e33-9c87-0c62350a0262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246855, "uuid": "35e4a9d4-b166-42df-926e-928d61f89664", "value": "controvoke2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2143f9ce-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229890, "uuid": "c1f98783-f09f-4ba2-bb19-1d666fa7f348", "comment": "Malware payload", "value": "ae42b9195e12c5c8702b56c0f64d10f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229890, "uuid": "1c95c4fc-2d75-4c1b-b1a7-d53a030257a8", "comment": "Malware payload", "value": "11f1ebba29832b7c760ce530a3173cfc1de55a29fb06a2684cdbb67a264141cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229890, "uuid": "14196211-c5a4-4238-b1cb-6fcf0b5f81cd", "comment": "Malware payload", "value": "a6fad6e64f203f75df825aff09b1934f03aa1ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229890, "uuid": "5d784828-2d22-45ad-9cb2-bb181725a05f", "comment": "Malware payload", "value": "67252d127b534861e9301d7abfc9f5d412f8bede3ca85e7a1deca1ee431b205f88ad0881e3c372ed61138ab5bc6d4910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229890, "uuid": "1e60cd52-9595-4f02-9f4c-36387badc497", "value": "T1EEF4122022AD5F5BD63BD7F981B1500193F965031923E3AE4FC268FE37A77808E59627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229890, "uuid": "acd90e9f-7670-444c-82e9-bc428d3c775f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229890, "uuid": "de3eaaf2-6868-41e2-8bda-18e4090c2086", "value": "12288:crNh+xGb/8mI7nK61T+T+dvmg87+Aj0LTfz9c3O7VLr6S5F7cJ/+IIxiAnt:Oh18mI7FT+TYK/jgb2yVLGSu/pIgAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229890, "uuid": "f771be31-66e7-4296-bdf6-0bca3c865440", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229890, "uuid": "7c84c0b2-91a3-4edc-8beb-16c17a2c7081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229890, "uuid": "8e3db067-42a8-424b-86c9-ee253e6915a3", "value": "SecuriteInfo.com.Trojan.PackedNET.2290.21484.29942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87029b73-457e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693212022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212022, "uuid": "f20c6f32-d0b3-42c2-99b5-93a02b1ca559", "comment": "Malware payload (Loki)", "value": "a46d2dd3464c15661f91e8886370c035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212022, "uuid": "1611aec4-ec00-468c-9b72-812e25f5db0d", "comment": "Malware payload (Loki)", "value": "1492021db4c18a2d5fc38f9e35b45183010f6676d73b3565dea1ab8dc13ee3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212022, "uuid": "2e4691e3-69e0-45c2-9549-2ca1035be4aa", "comment": "Malware payload (Loki)", "value": "96ee93b26eb3487818608ad9b3a8051cf2149a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212022, "uuid": "34fbb4e3-3978-43f6-b7b1-75ea3a86a18b", "comment": "Malware payload (Loki)", "value": "2c3ffba9f41209699633fca0ddcfd2c5f7e9a5c46f40142c73822e53c4e2452d1708111acf43e6ff76be6feee24293c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212022, "uuid": "fbef9e51-d350-404e-84e4-5bee31faa21c", "value": "T14CB40113BE06EF79C13E87F63C25A5410366EE1DA864E7549997B2E26C31703807EB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212022, "uuid": "b54292d0-030a-4e30-ae0b-1a90fe396ade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212022, "uuid": "29e10af3-26d2-4a63-bbcb-7346a70e30f0", "value": "12288:GcWJp09fq2BLmrYz4PphY37ToJpGOTkBstRQ8IuI0qGh:GcF9fkrYEY371qkWtRQ8rI0qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212022, "uuid": "2bcc7ea2-5196-4211-9160-ca1436562c8a", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212022, "uuid": "dce85e8f-1791-4f0d-b3b8-a177bfeb5182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212022, "uuid": "74c0ff43-e0fd-4340-91ff-bfd7ace578df", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1bfe99-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266418, "uuid": "21f58864-cb96-49a4-9532-55222fcc629a", "comment": "Malware payload (Mirai)", "value": "a1569bc49e4b4f7a1609126570628a8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266418, "uuid": "51751b14-93e2-414b-a6cf-48a88758ddd6", "comment": "Malware payload (Mirai)", "value": "152165a098f8a06d6b366468f1273d5484ed141bd5ba6500d1f16077c45949bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266418, "uuid": "86cf629a-9345-4c0c-b22e-aa08e2e4c39e", "comment": "Malware payload (Mirai)", "value": "549cbf64b02da503213875746e041633462e35c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266418, "uuid": "47f5ed9d-3775-4450-bfdd-6d6ee0ef87b3", "comment": "Malware payload (Mirai)", "value": "410cb12acb03da2915765881b5c53c21649e66693e3f49568700b86ca09ce85106334f6f733b669747993c89d7b8aede", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266418, "uuid": "a790addb-1f04-4673-b24b-7b55f85d49db", "value": "T1BB539E7185AC9EA8D14449B4FD248C796B13F00081A33DF3CA59CE9A9447EECFA59BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266418, "uuid": "aa63bfc6-2665-4ff9-8143-d35bc9850c07", "value": "1536:DaT2iGSwpZAMChB5ud/YI9pwfs3tzg//q3Do+CC:Dhn26QYKf+t0MDo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266418, "uuid": "e8c13711-94a2-4a4d-b22f-7980f147802a", "value": 62272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266418, "uuid": "d8f2d8ab-e4a3-44c8-ba13-84137785e632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266418, "uuid": "bde018e7-cdc8-4b12-9a50-6109ef411817", "value": "a1569bc49e4b4f7a1609126570628a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3a3be0-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209003, "uuid": "8efd8806-aee3-45ce-93a5-48f8c18197ff", "comment": "Malware payload (Mirai)", "value": "6bae5698545de0e3766df634902adfae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209003, "uuid": "63d9b7c1-0138-48f0-93d1-ec3c304f40e9", "comment": "Malware payload (Mirai)", "value": "1546692988b2dd7770349fce812946b7749ee5764026b0c2e3f4a0a5394112b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209003, "uuid": "4dbe39d7-bdf6-496b-8fd1-2e49459e372a", "comment": "Malware payload (Mirai)", "value": "21e097f6bd1abcbef803bcd4f1c1d4502157186a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209003, "uuid": "23e4b800-392f-46b8-b35b-e17fd4035132", "comment": "Malware payload (Mirai)", "value": "bb3b26dbd096be78219d5628b46a923fcc091f81c3278a124f16eb9bcbbc4133b43faddc90d96e937e1ea5c6a3900335", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209003, "uuid": "9bc6d4d6-dce8-492a-bdf3-c377e7a0cacf", "value": "T15DE35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209003, "uuid": "7f5cdce7-8da1-4833-ae42-35f4a02f8aa5", "value": "3072:zv77jfmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73Kj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209003, "uuid": "8d7c0218-28bf-47da-b4e5-c56db0eba8ac", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209003, "uuid": "5ab1f32f-075b-4462-82cd-1a989d2da19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209003, "uuid": "cd23e574-c086-4ba6-b7ac-9f6b8223a804", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3470d63f-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266430, "uuid": "9dec19b5-3872-4ea6-ad2b-8218f614cd65", "comment": "Malware payload (Mirai)", "value": "7d36cab997983f1ffb38773cd6014b1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266430, "uuid": "c9af82ff-2f22-4e8e-b9df-d0692b8e9254", "comment": "Malware payload (Mirai)", "value": "1547b8818acfefbfce4cb45d25bf12a4590cc4757882e27215046f40d22f2ee6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266430, "uuid": "22ccf5de-7f7e-4307-87f3-c1f8283a1464", "comment": "Malware payload (Mirai)", "value": "78e06909e4d9963ef1137f985c80215adba234fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266430, "uuid": "90fa2477-349e-415c-8a85-6e168f97c191", "comment": "Malware payload (Mirai)", "value": "7bf6dcf6331a95d9d6cd4deb34baf18ce17948d0dba4a286586c6f9d416f5f55e08ac00d18849d0cce2e38e7eb2595f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266430, "uuid": "593bf7cc-5ebe-439e-9b5e-921560067921", "value": "T130C2E12EEAAB5DA3CF51D6325AD5A79BC04109A702FC9506D3F2868F3D4202D00E0FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266430, "uuid": "495ff3b7-9e35-417e-aabe-12a371cfe924", "value": "768:s4A6w9obVEPSxl5jqUa8vXVsVrl5k8tGXq6:J5eobVEqxl5OUjaVPGX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266430, "uuid": "0010e495-d996-41d7-bd43-046d82e51416", "value": 28096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266430, "uuid": "f4ced0b5-2955-4d14-80e4-a4e41f1aef97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266430, "uuid": "6a63e239-d7ac-4841-a86e-0d6206399573", "value": "7d36cab997983f1ffb38773cd6014b1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81cf016-457c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693211326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211326, "uuid": "5122fea9-c332-47fc-9d5c-9725a3d1bc00", "comment": "Malware payload (AgentTesla)", "value": "a34c88c7bba99a8322b6bd8125ca3ded", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211326, "uuid": "d7c02d71-7e7d-4273-b64f-6b221043caef", "comment": "Malware payload (AgentTesla)", "value": "15ba4f63fe43c578c10edea51d3a521efb953302d78621b92ca65e699b921dad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211326, "uuid": "e52754ff-c918-401e-a08f-5f942b2fc5d9", "comment": "Malware payload (AgentTesla)", "value": "a903be617d97a653082bb29b9446f36eb0722496", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211326, "uuid": "59e3177c-5dce-4b3a-9273-e015cd04e1d2", "comment": "Malware payload (AgentTesla)", "value": "5fc278058e6ea834b6c91502120319105f1bbbfb871fc981f377d9393b0db6e0e514c1e9b0cd0942b0547ebc2d71c55d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211326, "uuid": "de1ed422-d402-4e0c-9b21-9d5e003ce28f", "value": "T18605F167F749FDEDD12B69B16C75940100A2EE4EA879C31ABC4639A558F234320BFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211326, "uuid": "d035c81d-12df-4e7b-a9d0-6110635cfc8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211326, "uuid": "21abc8f6-9dfb-489a-97c0-21373aa66cf7", "value": "12288:f1WJp09R3mkcIOLcxoA2Ee01Vid9a9L7Hqej5hohgdoXvgLt3Zz9qVg:f1F9RYIOdXEhBNH5mqTzYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211326, "uuid": "ba9cc463-f40f-437f-ac52-58ece751250f", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211326, "uuid": "b41fd059-cc99-467c-b24f-6b603354fb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211326, "uuid": "2ffb1643-6c98-4bd5-ac72-24025af5cc58", "value": "aXGr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adf66dc-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235034, "uuid": "67db24ba-d842-47d9-9930-2e0bd9c8c16b", "comment": "Malware payload (Mirai)", "value": "1998028125ff2794351fc21b9f67458b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235034, "uuid": "7f0f4acd-ac46-40e9-b100-f15fa021525b", "comment": "Malware payload (Mirai)", "value": "16595ed8bff22977d58d3112be059021424b858c03526fb7a4a09644d0a330ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235034, "uuid": "31319f9b-d537-4f4f-b5b4-580a45bb60ed", "comment": "Malware payload (Mirai)", "value": "432a78551fd6729b5186b0e9ffa0c51ff5fe2db1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235034, "uuid": "8aadff2f-240f-458d-8e75-d369ffa51955", "comment": "Malware payload (Mirai)", "value": "9ffbc5b526fa08e7b015efa1c348eeb1aff8e4567bf5112a54629921aa9416ccbede3b9dc91033849cd7ff33e9f368c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235034, "uuid": "5b5da6de-5d14-46e3-90b8-f002e8793a38", "value": "T1DDD2E12CD95D7905CAAD3EBD10CE86B5394CB5C0635DA6CE1722845CB627E9BEC070A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235034, "uuid": "f38036f6-34ad-4113-9236-97e4abc8214b", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNoSJbUWUz:kbDs06t4BEub4sU/MbUxYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235034, "uuid": "365337b0-03fd-407a-bbc9-22ba89451f82", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235034, "uuid": "140f85a3-5050-4a6a-9829-ef131aa02e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235034, "uuid": "62b7f7c1-a0e3-428b-a7c5-9c3a358175d5", "value": "1998028125ff2794351fc21b9f67458b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225f7c95-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235046, "uuid": "e597e312-d754-4b8a-9244-8dfb12cf450f", "comment": "Malware payload (Mirai)", "value": "7076679be7978350430800bcfc8e8154", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235046, "uuid": "8c19b112-1ce3-45f3-a8c0-39969bd9d6ee", "comment": "Malware payload (Mirai)", "value": "177c455d2fdf559e0a8522c9c1ded42f317cd92129af13ce058e9eff4f42ba6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235046, "uuid": "ea9cd762-77f5-4211-b24c-5849370959b9", "comment": "Malware payload (Mirai)", "value": "23131bc87d3e4a12e26101a40b1b2ccff84b2745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235046, "uuid": "db93f51f-a154-4aad-849f-c70f259e7468", "comment": "Malware payload (Mirai)", "value": "a60ef28603f63de3c66cdd3000b55bc171dcea34b2d019519a51cf79b1cd6b6a4914a34ea1807a50022d3cdca89c0c30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235046, "uuid": "89fb2176-6522-4bc9-8723-fca038f1bc53", "value": "T18AC32A06B30C0947D2632EF03B3B67E1D3EFEA8121E4F644255FAA899171E325585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235046, "uuid": "bfe0e268-6dd9-4614-a3ff-c16e2136dd27", "value": "1536:Eanp0Z31XI4gOIWhpv+q1xpjvTPNqP1qoCgu4/MjwvAcIIHuH6rXHqGMHkaDz9:Z0IW6q1xV7PoSgZ/MxcjaDz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235046, "uuid": "3ba512cf-297e-48fc-804b-d7e426778700", "value": 125240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235046, "uuid": "cf73f515-6fc1-4f4d-9649-c49c0e295b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235046, "uuid": "ab497bbf-6f6b-4adb-a278-d3d8fb4554cf", "value": "7076679be7978350430800bcfc8e8154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17cac7d-45c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693241809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241809, "uuid": "8da94ea2-ca00-4a6d-91c1-b4a35c1eab1a", "comment": "Malware payload", "value": "261bd917fe7b1c160e3444a3bfac183e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241809, "uuid": "ba6ad564-0038-4951-9fa2-cb78b1213d51", "comment": "Malware payload", "value": "17ce8daf1f333c1f79ef8b6ca612db111ad43de279ed0d48c7f3624e7e87ca24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241809, "uuid": "dc14a24e-5f19-4df9-9dda-f1f3c5c00471", "comment": "Malware payload", "value": "251c0b66d46f315ebda265ca68ea2d80189f689e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241809, "uuid": "eaba283c-f716-432c-8b9a-21e7f769a414", "comment": "Malware payload", "value": "e53d874285d75595b67b101cc87bf6d28ac8df2f4577fc008417ce20c0a7a51577b897b63dc228a6f35eda823f0da302", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241809, "uuid": "8cab470d-654c-4660-a911-923fd6f6346b", "value": "T1B31533F331416626CF6EB272271284E0FF5DEC1854A2B0BF45A47E9CEBA5D0D0A90BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241809, "uuid": "953bd1da-5f19-4d0d-955c-e6960dcdb358", "value": "24576:6P6axeg3P9E0mkG4wRfJldLUQlRBx4GprYjDa:Oxeg3Puz4ifJlhXzBSGpAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693241809, "uuid": "ae69d02e-4db6-4983-ac0f-d86a3c444c49", "value": 899800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693241809, "uuid": "f65762b3-5ab9-4f7e-8f85-804bc0a0d820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241809, "uuid": "b368aa2c-e724-4859-a74f-100e2cc70fb6", "value": "hgear", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105de726-45cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693246613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246613, "uuid": "e54bae50-a24d-4601-bde0-e8f04720e631", "comment": "Malware payload", "value": "7b35d4648ecb0e1d47425490bf979220", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246613, "uuid": "a6d9bf8e-49b2-4f2f-b1c3-681512d4d209", "comment": "Malware payload", "value": "183e528cbb63e60f53e4964bbf4530e66615430ab1ca019d8a5abcc9cb71fc31", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246613, "uuid": "384c5c07-ee4f-4ada-a543-84d569632c7b", "comment": "Malware payload", "value": "0292a75837eceb9613efd43c71cd777ccbf76157", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693246613, "uuid": "b6b015e5-6b23-448e-ae32-2ab27b7cd40a", "comment": "Malware payload", "value": "52b1d096dace47959b85543251742111b42af0ee2440846daa3b5191605288ae84be47ba6d36a8031ed03961244761c5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246613, "uuid": "427cefd8-bf84-4d5c-bd63-947d24b4def3", "value": "T1FA85BFB876047DD62A6F576BCA96ACDD13B627639ACBA4CD806477C304A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246613, "uuid": "4e357669-962c-46e1-ac65-d8e49a743a20", "value": "24576:bjKIy6di8qFczTx3P3k3M0F4RsmKekskLLhm9MEbBbv8Ohkbu5bgLU3jxv4m/SYT:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693246613, "uuid": "25be4b3d-68c1-408c-aa7a-dc8ab4dd570c", "value": 1721268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693246613, "uuid": "1046877b-4608-464d-9469-dec7daa0f90d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693246613, "uuid": "1733f610-aecd-4ed0-9a48-f070a0d64931", "value": "ENQ_23_33946.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab322b5-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693209371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209371, "uuid": "d957c8f7-5fbf-4a98-852f-b49dac5c5eb4", "comment": "Malware payload (Loki)", "value": "ac34a5788979dfb44a1810f9eaae9d18", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209371, "uuid": "c8b1b101-0ba3-4d95-8bc9-ec7d0e9b932d", "comment": "Malware payload (Loki)", "value": "184616f86b3d2477f744388932728a70e89f31ba380b0b2ce13a7c37b3a109bb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209371, "uuid": "dc0ac26e-9e03-4fbd-b2c7-f7b3f488c812", "comment": "Malware payload (Loki)", "value": "ebf277bb36acd818a06f286fc2a9f54cdc4157fb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209371, "uuid": "142c2bfb-6d78-4fb9-ba88-8b35e7c6798a", "comment": "Malware payload (Loki)", "value": "9cc4acd716dd7a6f4b5e47a726794a2b0fa5284252e18665a02189e91181b593a84675f024197a80513cb08e233439da", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209371, "uuid": "f8a13300-740f-4e94-bd32-a79a6cf4c1c3", "value": "T1BC05332DFE015065DF4FB596D670C84A8DFAAF3186D928881B6B07EDC09012FF5C929A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209371, "uuid": "2eccd560-4746-4ff1-8b54-b6a8f0946f8f", "value": "24576:PmObp4tCeZkL4JNOmi7TrtRa+tSqxn1tpfEwNy1dVEi:OObOrkiNPiJFPxnFzNyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209371, "uuid": "500d1eaf-5fb4-42f9-876c-c30b7a9a809b", "value": 857021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209371, "uuid": "5aed66f1-88a7-478c-bd37-00f15079459f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209371, "uuid": "5dec3249-b2c9-471e-a3fb-e2b3fe5afce1", "value": "Purchase Order (PO) PO 00197086.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71aac658-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238186, "uuid": "b1fb970d-1ddc-42a2-80f2-60f1b1dff50f", "comment": "Malware payload (Mirai)", "value": "236ce2feea9bacdf29896fb6261b3c9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238186, "uuid": "e919b72d-b41e-42eb-81bd-40090401ed5b", "comment": "Malware payload (Mirai)", "value": "18e0ec7cd9151741117799019761c4f7e3b1d7584f29a55f8a112cee6c16f358", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238186, "uuid": "fbb50cd7-b742-4fa2-865c-2babac43458d", "comment": "Malware payload (Mirai)", "value": "929b3dd5bfdf09a509e8b41a914b8cc2a45d5fbf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238186, "uuid": "56eb4177-5293-44d5-8d04-f6928aa85b1b", "comment": "Malware payload (Mirai)", "value": "4c088749bd7f5c8c5c22d9a8aa7b5bed3f137b04fe03ea0e8ad22b4f8ce38aacdc4f9174ebf3e4de18bc32895155103a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238186, "uuid": "4c796546-7bf7-4d3c-92c1-f99277c7840a", "value": "T17863C60ABF554FB7DC6FDD370AE9170135CC650A12A83B3A7938D828F64B24B59E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238186, "uuid": "473edd7a-75d0-4db2-93eb-c0f308e5cf72", "value": "768:icSGcU5HJUmj85E9eNXelOvKiYVSwGYY4bE9SphhZhtCXiaoE8ue5rGEw7oYNIO:icSGDZj8QoXPKvAA3hZhtU8u7EwnN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238186, "uuid": "7a365762-8e64-4a86-a756-8762095a70ba", "value": 72480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238186, "uuid": "bcee5430-52d8-4171-8729-f9ce2d97a3a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238186, "uuid": "79d0e011-2b84-4ef1-a969-c9b1104f19eb", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5d8a22-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228163, "uuid": "59c15ad0-41e2-4c98-9909-ad33ddd7a8c4", "comment": "Malware payload (AgentTesla)", "value": "b0d3968256608740b71303412ed140de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228163, "uuid": "5d098b2d-c7d2-4128-829c-49666292dc0f", "comment": "Malware payload (AgentTesla)", "value": "19b47fd248f571654c1d09289f67e9d00e8bd3c8b735ee2b9c90b03ac0bf89dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228163, "uuid": "1f1edcff-ecf7-4d89-b2f8-2aeb1ad3c104", "comment": "Malware payload (AgentTesla)", "value": "37485594d3a11c017c7805973bf2577990e7631e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228163, "uuid": "667dc167-feaf-4ae4-a0c7-0d03263ec540", "comment": "Malware payload (AgentTesla)", "value": "12c9aba4c092a8219b7bf546b880b26ae4685b0b728ab646fbab1f4c3cae4792d9bbca65ee9e780780cb7ceef1697121", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228163, "uuid": "f670edc5-f06d-4f4e-b9c0-811987a69e73", "value": "T1C1A44C21BBE48917D43F2376E4F30A1A03F5F482B627EB4F05D49AA95C937458E01BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228163, "uuid": "62066697-6b82-4f84-b167-d5b8f819f7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228163, "uuid": "f43c734b-bb05-4d35-95e9-cb7eeb28ad99", "value": "12288:H4kie92i812u3oKnpdA35Rm18YAfdzmLScNs:Ee92i8E5KnbA35K8YAfdzmLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228163, "uuid": "3bf3ebe7-6204-4a7b-a6b0-a973affd2fa9", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228163, "uuid": "495f1cba-ad03-41b2-897a-55aa2cc6a596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228163, "uuid": "04825ef6-609a-4061-a91c-a4c2844e5f25", "value": "Quote #88406119527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c66eff3-4591-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693219977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219977, "uuid": "e3fc566e-0100-44f1-9745-9c668d94f79c", "comment": "Malware payload (Formbook)", "value": "d83efd37cf6cb16d7bf44b522e92ab78", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219977, "uuid": "66467316-260e-4259-9a73-12ebca0d5c20", "comment": "Malware payload (Formbook)", "value": "19fa035d916a5ca000105d1724e7f4be757cb56567fa694463617d9f98e09f68", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219977, "uuid": "9a046c63-a54a-48fa-bdbe-825df1fe1b6f", "comment": "Malware payload (Formbook)", "value": "4d146b7b104cf58fb3a9de1aaa9e7301eeecc6a7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219977, "uuid": "afeab358-4d33-4095-867f-a35838fb4716", "comment": "Malware payload (Formbook)", "value": "ee40b548d2f6af059ad661065e862e512cbbd1192ee45401e477d0f634db5b6ef0fa8c449dc92bee44d66d95ce13a896", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219977, "uuid": "f8d339a5-0788-4985-9ab4-56336d884a85", "value": "T14934129448B1AC1CA5BFE66E1621C88D1496FA74DFD8DDBCE69449B06C3A300F8732D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219977, "uuid": "72993b6f-bb7f-4bc3-a01e-13953217ff2e", "value": "6144:2d65FVbFG1czFmqDoGPupuieEJi8270VkFe8m4znusYtqByT:2MrFzzF7Dooupu9gpkE4zusYtyyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693219977, "uuid": "e2f4760f-9efa-4fa0-8d90-155536947b2a", "value": 246202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693219977, "uuid": "1abd1968-8544-4fd2-a8c8-895b99055688", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219977, "uuid": "fc35e40f-b791-4881-9f77-7d5de29ce828", "value": "PO-230821 pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2737f650-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229900, "uuid": "e9176546-1a11-4c73-b0f9-adebff5c1c6d", "comment": "Malware payload", "value": "823d0583025e096bf34200cbdded9e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229900, "uuid": "a9036db3-800b-427b-9c6e-70c3de637f53", "comment": "Malware payload", "value": "1a4425409cf193b3ec1a10d2c80b1d816c0a4f9c74ce4e6cdfd02ed1f8986572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229900, "uuid": "31e1773e-6797-46ca-9ac7-3186e4b0607b", "comment": "Malware payload", "value": "49f9a85d502a104876ffdb7eb6fb3d8f6102db08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229900, "uuid": "b97a0cd4-0269-4aad-85d8-2c0dfd3d958b", "comment": "Malware payload", "value": "0f53774c1ea9fa327e3e939defcc9c190e0667c2bdbb753a96dd6ac995369c26caaa9b6a529476b5abb397429dc2a506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229900, "uuid": "7948e097-c640-438c-be18-859dbce125d6", "value": "T10D045C0074E2C073D977093149F9D5B59A2DBD600B249EFB77D80B3E8F346D2A631AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229900, "uuid": "9da34a53-957e-49a4-bb82-f4c2d36f7734", "value": "0954beaebb211de35605a05432b8cbdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229900, "uuid": "dbef478a-0e2c-4494-a28c-790c47132242", "value": "3072:p3+phb5fHu3KFAqhJMMhEunALkhn673OYFJiPAg0Fuj4kPZDp2:6hbRO3zsMGEvkdAO9Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229900, "uuid": "cd04cbf4-0604-4918-8645-0cde2078227c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229900, "uuid": "16832940-5fc0-47ac-a83d-ad7b9f09738b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229900, "uuid": "9a5e8b4a-9d9d-46a4-ad9f-a36735147691", "value": "SecuriteInfo.com.Win32.PWSX-gen.13859.13249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46604b32-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215350, "uuid": "44810a3a-bc42-475f-9f89-852f6d5a4820", "comment": "Malware payload", "value": "590932c47ddf2a27773043452bd1f531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215350, "uuid": "cf569ba6-5d26-48ed-ad13-86a7b8a113df", "comment": "Malware payload", "value": "1a58d0694b0732b174f623596fd1a83b1fb55bae308e9f1cc72e59d18cef712d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215350, "uuid": "8be6499a-8615-4caa-9996-8d57ec32ab2f", "comment": "Malware payload", "value": "a7d2ddddb6f7d4626c9064bd99df6e171accfd70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215350, "uuid": "b4826ff0-b4c1-4d75-9c24-06770daefc43", "comment": "Malware payload", "value": "2fe5d3286d90bb6ebe755bbb67b54c258597a55f92fe2d58a2c99f17d26f9b54cc4b50f92efbf662f0b93bb9fc6cbd1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215350, "uuid": "20ed5d69-d436-4bad-8386-e23378edea22", "value": "T12336F715E213811FD8733BB1834B45D61EB5A7582932D8DB35D82EAEAB70F523F29603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215350, "uuid": "e36fd2a0-e60b-4920-8682-20e9154ccf87", "value": "98304:dawvHSG01yX1n9fU+fRSshbpAzOZdpa5KplJveXeVJl6OoozCgupLxGHQ:daw/SG01yln9fU+fRSshFAzOZdpa5Kpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215350, "uuid": "c7432863-514a-4a24-bd62-1c09b75606ff", "value": 5054464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215350, "uuid": "060d9e82-312c-4ca1-8ae3-518048f2f98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215350, "uuid": "82c42d63-cbad-477d-af6b-776b6071d238", "value": "590932c47ddf2a27773043452bd1f531.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8b983d-4591-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693220249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220249, "uuid": "3c532e29-7dde-44be-832f-a3dde0df66d0", "comment": "Malware payload (Loki)", "value": "33273736f89181e66f0127d8a9683e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220249, "uuid": "826645d9-8817-40f0-a003-b1212ffe35a8", "comment": "Malware payload (Loki)", "value": "1c108fa43fbb40c35b7b216fb20c7ec3b2d6512b0a242b5db2176591356fdf35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220249, "uuid": "4f271b02-05e8-428f-b876-761629ad4fac", "comment": "Malware payload (Loki)", "value": "0c840bb776af168c1f6066a2eb4f21eef840ffd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220249, "uuid": "c1ad5fca-ab61-4277-9825-7472c211579a", "comment": "Malware payload (Loki)", "value": "11677150521bd7165d526e10b3827d1270b58dd0b5d53ea7e85e9d45ce3b794d57c426e176e7ecc51f688b7cd0476223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220249, "uuid": "cb744e8a-1320-411f-9774-734aa6650f6b", "value": "T16182F618BE5DC033C6AE027F54A7124642B6EB37B4A3E35F8DCCE66579573C08581AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220249, "uuid": "19f05c42-bec7-4bc3-8631-87cf193496e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220249, "uuid": "f797d76c-ce22-4995-827a-4ea48886b7cd", "value": "384:UIxClkRyWUs8ym+sNqZihnuwffBCUR/pk/Qaeskwzn:PGyPswZCHQfzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220249, "uuid": "60a20772-a8d8-439d-94c7-00bad56c5643", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220249, "uuid": "dfedbb5e-765a-4048-a0d1-23137b570330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220249, "uuid": "82e86228-18d3-4b8c-9f8f-0867438300eb", "value": "USD Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1319cd-4585-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693215034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215034, "uuid": "0126fd5a-1d20-4b88-aeaa-85ed9828e669", "comment": "Malware payload (GuLoader)", "value": "b170ee928df44dce64138e7392a52f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215034, "uuid": "212a700c-ff6f-4d34-a10d-37d648c46510", "comment": "Malware payload (GuLoader)", "value": "1c3898115a8187b236f40dbeb117557ab42489a2a1d1255fa0dbf12300096b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215034, "uuid": "0e1b4c1d-bf04-40bb-adf0-7768b4728ef6", "comment": "Malware payload (GuLoader)", "value": "6d47b15d33854e4c689e9654547838bba7bfbb2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215034, "uuid": "3ab6a83c-c8db-4c88-b843-d984f5955478", "comment": "Malware payload (GuLoader)", "value": "9d206bca3dcb96409ed3d7da1e9b5d4cbb3a89b196a1886af518b80b7bdcf8771641e26cf3fafcad1f669468d4573fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215034, "uuid": "fff29a89-5347-41ce-89e8-e3e5e59d02c7", "value": "T1A9A46B9238C9756FDD2F4A74035FEAB62A795CD07392096E4F80320D5D36A4A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215034, "uuid": "918155ec-a17c-457c-ac3a-77422d4fd8f3", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215034, "uuid": "4a2cc207-fe72-4f52-a1af-24fb7b931c5c", "value": "6144:/qjILPZVheNA+ff0FswVpySl9K9wwcWz+TQmceZxFsSsu0Cp6OVE:qenhe2ewfLyS2iwc0EYeZASUCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215034, "uuid": "4a64c192-c974-4a00-bbdc-cd2e0f7d79cb", "value": 450064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215034, "uuid": "98aa5b4e-f422-424a-a6c3-8ad06b399e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215034, "uuid": "6303fb21-ad75-4091-8259-922dcffb6ffb", "value": "N94307_251628_2023-08-28_BC8976924pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5e285f-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "cfef5c8d-6d21-4609-9bad-78b23acd5609", "comment": "Malware payload", "value": "5db0a9f15837cbaa6258de74271fb0e3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "ab8c9429-6adf-410f-86a0-79e7c8a4eb6c", "comment": "Malware payload", "value": "1cb2c66667bfa11e0c95b2442110bbaeb41ee71066fabc894d7c9c4fe34d5cb3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "870b36e4-28a9-4757-8730-e1790aed39ba", "comment": "Malware payload", "value": "23b7f648f6490a62d1c23f24013c37254a755870", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "7a2b103d-f4fe-4309-8942-1bc34c48c44a", "comment": "Malware payload", "value": "a5e06c39e9aa54f5424a5538b23ad22d3e777821f25b0eeac19ac9664f36655cad6584961cb707baed3363ce6f615c83", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229907, "uuid": "b2e1b920-a2d7-4f95-80df-5e0b8bc81719", "value": "T1EE81C8867508C623D6A10D75C98EDCB05531EE03EF089143F2B7FA5F85BA3C98D69598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229907, "uuid": "3bb096c9-bba5-445a-9da7-2025e53f4eb8", "value": "48:rErSFFinhBMb0FCLTI/SmTdrDh6B9WXnPo3:52h2Tmdnh6B8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229907, "uuid": "4a599807-9fdc-4400-a696-759438c89880", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229907, "uuid": "a368195e-1bbe-4d63-9567-804a58150992", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229907, "uuid": "8fb2c386-c389-44fe-81dc-adac4393740b", "value": "SecuriteInfo.com.Exploit.ShellCode.69.21122.13682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff07c1b-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229888, "uuid": "bafb502e-b033-4568-a7a3-4a5a36a25191", "comment": "Malware payload (AgentTesla)", "value": "159a890a5406255e7d63581f614150db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229888, "uuid": "bae95322-e5e1-4d50-933c-1c4fc29185ef", "comment": "Malware payload (AgentTesla)", "value": "1cbbc6347de33202780fa7897a7000328101978b7cdcf35a1135f59e48733bf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229888, "uuid": "67a7f1c0-0fc4-4f9c-8583-c352fb5a0d0f", "comment": "Malware payload (AgentTesla)", "value": "bff0a33a3629035e0ab02eb48d8f2dfe2926cd62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229888, "uuid": "151b5902-226d-4ccf-942c-6795c4c475ac", "comment": "Malware payload (AgentTesla)", "value": "2be58374af1b167c4c065b20da24fbf57e5a54c62194f271427ff0409dbabc52028ba2aad9db320d234c4f5b7d6e20db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229888, "uuid": "18b35af2-06c1-4fa2-9797-c2f1436ff985", "value": "T1A7E4DFC2E576D3E3D6A443B1309252041E797FDA3265D2A04CBA31D676F1B023B97A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229888, "uuid": "95c8026e-0035-4da2-9019-ecba1bcd8d5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229888, "uuid": "4e25d2e5-d0ef-416b-bf48-3106aaa5024f", "value": "12288:yaf4lrrxxrE91dVTZqZkCC4qLAk7DuLeUyQdaw/vYITGjMd90dp:ye4lX81HZq6CWD0eUFdakvXay9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229888, "uuid": "36d3084b-56ae-4752-8dce-fd9ed9877199", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229888, "uuid": "876e7ac2-f17b-456a-a27d-055796acb017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229888, "uuid": "70178ee3-a515-4efe-9544-b1d7591e4e2d", "value": "SecuriteInfo.com.Trojan.PackedNET.1995.15446.24340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60930bd9-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229997, "uuid": "3e1bb280-6a73-4e24-893f-b249f1d2716f", "comment": "Malware payload", "value": "c354f260fb07321f0751307c58170407", "object_relation": "md5", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229997, "uuid": "9b58b9eb-cef8-42d1-a7d8-83456e91afc7", "comment": "Malware payload", "value": "1e523b392331dc0338ab822dde7370dea51abd274af947bd8151baef00c2e54c", "object_relation": "sha256", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229997, "uuid": "a6a410cb-cae1-4c3c-a738-151b360c46c8", "comment": "Malware payload", "value": "6c0e5b46077787a8e7aa8d66ed631436b73ce07c", "object_relation": "sha1", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229997, "uuid": "a496fd05-deca-42ed-a3d7-25ba26694d97", "comment": "Malware payload", "value": "fc442093e4bb079bf3c23c3c78cbedf09f71aadcbeadf4b47ff93a57e0b1bfb37c6bcdca359bf95cac735b50b640901b", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229997, "uuid": "be8af7da-d074-444b-a61c-44027d39153c", "value": "T1A801FEA0290BFC7C264BB3C17BB441E02FD750D1E11A392497446D0F9E31C568ADF8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229997, "uuid": "6680b28d-a064-442a-b4ab-41ce46c991cd", "value": "12:Uqzd+mPZGShR8kkiBlsVTXuZ7/P981E7GXXfDWQCYnmSuySIAikzP:UqzEmPZNR8piBlLI1fXXfD/mIAZzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229997, "uuid": "1a6cfca5-04ed-489e-b424-197adc86a3d5", "value": 695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229997, "uuid": "006c999f-bf70-4d6e-a310-284c1e76ff57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229997, "uuid": "186c6825-efbe-4ef3-9ac4-6ff73873e296", "value": "Client32 (2).ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bd0ac7-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209524, "uuid": "9671c2f9-2f47-49d8-afd4-345301f52050", "comment": "Malware payload (Mirai)", "value": "b20ad5438659ca05531d2daa92e760e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209524, "uuid": "329b9ad1-3d28-4179-990a-cd45631b61a8", "comment": "Malware payload (Mirai)", "value": "1e60852e3772e76ecc7bea327f866a69136149c62323e1430f5fe97e5751bfde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209524, "uuid": "b0da92de-f484-4986-ba42-09609e561c61", "comment": "Malware payload (Mirai)", "value": "6f6ab85513046287cc39a27f2aaa54bba4d9346b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209524, "uuid": "0d2190a2-82e5-4c66-943b-be4c2e4a934c", "comment": "Malware payload (Mirai)", "value": "5ceb023cd8891a6ac11cfd10ea82ba9a7c42e271553cf3ef946ca2e40494b4c47239dda13d483a7f8a4f776c5ef8399a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209524, "uuid": "c9c79119-c525-45c5-ba65-19cbeb0104a2", "value": "T1F093A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209524, "uuid": "92686643-d6cf-4847-84c5-51232f0d1782", "value": "1536:a5DnSB+v5jjQm2l17xk49d6xZLu8vJ4TGo8S:a5TSB+v5jjQmw1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209524, "uuid": "55030b1c-9b1b-4680-bcca-36a1b0004a32", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209524, "uuid": "b721c50f-38c6-4c9a-b2f7-bbe18874398e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209524, "uuid": "2dc7a6d7-d599-4936-9deb-e96495a7c563", "value": "b20ad5438659ca05531d2daa92e760e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2200055d-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693223020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223020, "uuid": "1714c6c7-2462-4047-ac53-a3894623eae8", "comment": "Malware payload (Formbook)", "value": "a21a56e9401a4e4113a1b3e8f54a6ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223020, "uuid": "3775ee5b-0daf-4047-811e-b9151d94dea8", "comment": "Malware payload (Formbook)", "value": "1efa0c8aacdc1d8cedff1876b0e3434407553a1bcf5b8b4e60c35259f5fbacb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223020, "uuid": "b6af2a51-588c-491c-9d31-be7887df8e33", "comment": "Malware payload (Formbook)", "value": "28933f3e52dd251945f1af870c1619a4ee9c6167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223020, "uuid": "ef48db01-67f2-4ea8-b067-37ff593477bb", "comment": "Malware payload (Formbook)", "value": "0ee2868417a18810e3b76bf2ef29a7600623653177d34aeb9a91d6ea4eff2e7a97bb5654410db0df6b0e937497d67665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223020, "uuid": "0ea58ec1-9285-47bb-8588-87846ea609da", "value": "T13EE4E098B1A1B49FC407CD77D9E46C24AA20746B570BE24390971AECEE0D6DBCE142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223020, "uuid": "4f05aac7-5e9c-44b4-b054-86e7da3ea113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223020, "uuid": "9d8e0f4e-6e1e-43c3-abcd-a12ac77437df", "value": "12288:yFM1GVzYQvjOjcegYBSnjBHwAsUq1Ysi4bFkwrbtuniNMgAp3P/lPdn9JQcAdSKO:D1+JOj/gYBSjBHwA1GYsi4pZwm3etdPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223020, "uuid": "e5c7824b-b67d-432f-ab7b-573655df72fd", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223020, "uuid": "160973c5-9853-4a52-a73b-a245614b81c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223020, "uuid": "3531cbaa-8ae2-4db7-bd0a-a6d776362a5c", "value": "SecuriteInfo.com.Win32.PWSX-gen.21235.24563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09909e8-459c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693224950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224950, "uuid": "866c8e9f-2f31-4f82-8940-3dae396513ac", "comment": "Malware payload", "value": "6160b1d211687d652b6aee784e9aec75", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224950, "uuid": "6986655d-524c-4616-9015-851aa51bfe34", "comment": "Malware payload", "value": "1f562669f05e0880a319399f6b750b1f6fdc10a8f9c54dcfcf5cb9f2224d718e", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224950, "uuid": "6ec8d8d0-b8bd-4a15-bf9c-5a0a5a9f3327", "comment": "Malware payload", "value": "c4d6c674248182813fd4ff684562ccc8f06cf722", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224950, "uuid": "89a40746-b6b1-48e4-9b45-01f11e7abd0a", "comment": "Malware payload", "value": "1d4c38ca3344db430c0c5055380a4f05186928805e558998f6ba46a4961f186ba9987fa2586af5f2abeb5862782e77d6", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224950, "uuid": "5aa4a8bf-1301-49d3-91bd-c96700a9d44a", "value": "T1D744AB2024EF658DA1B37B930BDDBDE88F6BB7A5162A206E30441387C752E54CF85772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224950, "uuid": "466a662b-dc80-421a-ada1-5965484aa038", "value": "6144:Yja4v3SwoER8R8Ce+p8y8lIFKjeiwiWiWiXijiFi/iYipiTimijiGi0iCiPiJijO:Yja4v3SwRR8R8t+p8y8lIFKjeiwiWiWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693224950, "uuid": "56953361-44fe-4d87-9b6f-663aec182fe3", "value": 265300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693224950, "uuid": "863775d1-c2e5-445c-b440-4229e926a48e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224950, "uuid": "3d84261a-076f-475c-a646-36a74d06954f", "value": "S_D_233445566767.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbb1e53-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235414, "uuid": "51e525f2-2c1c-4032-bd7a-b667bea546e9", "comment": "Malware payload (Mirai)", "value": "51d202b1682a20dc96ecc2fb21ad7fcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235414, "uuid": "127bfd9e-71fc-42d4-8680-73262495172d", "comment": "Malware payload (Mirai)", "value": "1f84ae5d0854d90c18c5d4938db9d2c570fcfb25d431a75e9c3ffafc2a3868d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235414, "uuid": "a109406a-d215-4f0d-a76b-0c24c11f9fd3", "comment": "Malware payload (Mirai)", "value": "47a282cf3d54b6ef7c5702c552096093fdf7f1db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235414, "uuid": "17f6db95-2b3e-4d37-b91c-f654aaa2564d", "comment": "Malware payload (Mirai)", "value": "b4afe03b514120b18fecf1bdf7ef9b100dff04e2485170a2a7a18c2877a0c1ce90ee49ae93ff0178e87ddd623216777b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235414, "uuid": "1b9eea3c-dfce-4eac-9d88-652c7ec35568", "value": "T10BE2F1A79371A452DD782BF1F96985CE2ABD4B6CC237707315055A282E9B0439F3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235414, "uuid": "926f563a-a660-45b5-9bd0-c0993ec692f2", "value": "768:8oiWiO031vpAPbrVWZK3XVGxm9XuAJ9q3UEL5I1:8orm1vpALgUJuA8LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235414, "uuid": "8c7dc5d6-5aef-43b5-bd90-9d58ede2db9e", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235414, "uuid": "5797d8d6-d86c-44cc-9fc3-cbc35275c071", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235414, "uuid": "8687fd99-cf57-4321-a711-97123d8b2266", "value": "51d202b1682a20dc96ecc2fb21ad7fcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e15f97-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693235247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235247, "uuid": "c3c7f460-6b05-4787-a899-f62d06c35f0e", "comment": "Malware payload (AsyncRAT)", "value": "464325a33140ca7e061aeb57b54ef5cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235247, "uuid": "1561034d-7664-4b96-8e91-75ae03b77cb5", "comment": "Malware payload (AsyncRAT)", "value": "1fca615f269124082ebf98fbf9eaf6ade833689d96df39b4cc2dfdb80a0e5657", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235247, "uuid": "878b8a2c-06d4-4f44-8f05-a5b75f9aae37", "comment": "Malware payload (AsyncRAT)", "value": "defd8dc8a82b5f2890d768f96a0834b971430341", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235247, "uuid": "f5f03387-9be8-4133-98bc-02bbfeb4a882", "comment": "Malware payload (AsyncRAT)", "value": "74d08d7fa42ee6fa1f9b383f404b0bf92755c1710117686d1769939a18a9f03f7b850beb46bddacd276dfc35a9810383", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235247, "uuid": "6b3ffe83-6f23-4cf2-b084-12699146c83a", "value": "T1B0236D4037A8C136E6FD4BB5A8F7A20582B5D2276D03CA5D6CC810EA1B13FC596536FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235247, "uuid": "59218e76-ff22-4467-9a21-f0cc115ead02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235247, "uuid": "f8267aeb-b88d-41f2-bba8-8f9ffa58e6a4", "value": "768:oq+s3pUtDILNCCa+DiNG1jhCpFGipfYbmgehVC/75LxcvEgK/JfZVc6KN:oq+AGtQOmexgb5QYDEnkJfZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235247, "uuid": "50a9aaa5-a758-4502-a846-ee039cfba9b7", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235247, "uuid": "af1fd292-1fdf-4b39-ad73-4976c2629867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235247, "uuid": "d26d48e7-1797-48ac-82ca-4daee3c3514c", "value": "bPnv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b36eba8-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228270, "uuid": "4611da39-bf04-44d3-b914-a0a256e74751", "comment": "Malware payload (AgentTesla)", "value": "b085173b5b38d6706bc4b39d03fc90b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228270, "uuid": "26c17415-5996-48a6-b2ba-e248a12a2dab", "comment": "Malware payload (AgentTesla)", "value": "208319e004a6786ea50aacc67797171f4f4356f232bbf2e99c91cdbbe48c7624", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228270, "uuid": "9b2f498e-14cd-41b0-9c90-e2ec9253c3a6", "comment": "Malware payload (AgentTesla)", "value": "b7a368c8b7eb5f9b6aaebe5d6449f591e45b1d8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228270, "uuid": "212af396-2cce-47ce-9e19-6fd80bfbb186", "comment": "Malware payload (AgentTesla)", "value": "54e3a5a87eecb3f4709c0fab58f744e448667208f91c5bea50572b60e4e365cb950bcc2ed81a4d753f3bd8a9f98266bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228270, "uuid": "721a2474-45e3-4ae0-b5ad-6b572649be72", "value": "T150E4F14172BD5F46F87A53FA0351624003F3A9AA217AE6C89DC274CF6964F828F11F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228270, "uuid": "edcada62-f3d5-404c-a7c4-6ab7ce3517c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228270, "uuid": "256b636c-18e9-4841-b11f-c60dac364961", "value": "12288:qMk2d1mbTc9tZAt6VgSRSiKeNONNWaC24WhrRNt7FXmuknggmXEu:d4ychASiKFNMaC27F3FXmVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228270, "uuid": "3a70abac-f59d-4e28-bf1f-cefac648ebbc", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228270, "uuid": "c3cd3b2b-b397-4c23-91e5-4d6cd130c02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228270, "uuid": "e7d84d7f-ccfb-4fc7-a5b9-fde314eb186b", "value": "PROFORMA INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dd087d-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266409, "uuid": "63488036-2c9b-4887-99af-5bdee8f339d8", "comment": "Malware payload (Mirai)", "value": "0870440e0fe3d7b03a85d37046f553b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266409, "uuid": "98c1cd6d-efff-4a4d-bae3-647311d48af0", "comment": "Malware payload (Mirai)", "value": "21b359ae52e2d28afb6708db613b54865e792a63708fdfef42eb483bad68fee7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266409, "uuid": "e9dfbef2-a200-47dc-971b-98179fd8869f", "comment": "Malware payload (Mirai)", "value": "b4ca901b633cb48868823f0520f3557cf89dc356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266409, "uuid": "80b4095c-5ae7-452b-b8df-c553d59db62d", "comment": "Malware payload (Mirai)", "value": "01f7cf364d44080b6bc323573e71b0cc0c14c0cac17073898187595cbc04c8c9c43a8a4c8f5bebbeda7c9efb810346ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266409, "uuid": "516983ec-47b4-4cc3-847a-cc9f4975e2ef", "value": "T13F533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266409, "uuid": "e645d79d-b52b-4111-8dff-cff3ab4e6545", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyMgGhd2G4NMiplImpcvwJZY10UoZvBqJ:0aHuAzgjjfUKU0NONyMgG+7XtJa10fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266409, "uuid": "bd7ce2e3-851a-4e98-9fe4-a8f3ba27e0c0", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266409, "uuid": "79ba2fb6-2e7b-4eef-b24a-b4e83bb9e487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266409, "uuid": "ee6fe8b1-a4cb-4be0-9a6d-efeddb3d3097", "value": "0870440e0fe3d7b03a85d37046f553b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09970e67-458c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693217825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217825, "uuid": "43ecf54f-3948-4148-b9fc-60c4ae4fbb71", "comment": "Malware payload (Formbook)", "value": "321ac4a7c104daae261c6ce5ed12db5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217825, "uuid": "593436b7-95a5-4d4f-88cb-853a9107de33", "comment": "Malware payload (Formbook)", "value": "21ccf1fad3e1a08f580d5f0d5aa2d13fb1a633aa1c68100d435628a437efb89b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217825, "uuid": "c2fe3cfa-2969-4a76-85a6-24a69d722447", "comment": "Malware payload (Formbook)", "value": "2cf6f37db30b5bdd5b3ae338a4e209c9ccd0f984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217825, "uuid": "fd80f47c-f4cd-4cff-952b-4d560a66f4d0", "comment": "Malware payload (Formbook)", "value": "6cefce7f330d5a5c19979f1beae8d8c0384fbbef8a58fd25f944592824c8fade522883c39a66eaa536165cbd32f032ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217825, "uuid": "f086b97b-fb21-449e-b03c-200f4ad0a352", "value": "T1A94413897290C4BBE4110BB70A3F5A96DEF7B1094414EF0753F85EA9FAA12809E5D3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217825, "uuid": "a8b7fa71-ab47-4f8c-9dbd-065a2fede2f2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217825, "uuid": "723a876d-fc04-4fbf-9dc0-c8ba64eaa511", "value": "6144:PYa64mTIQqcpm2VNUmdzdr4AiO0iijUg0SkuMPnGKY6X:PYOmTtrVjd2liijUg0tuMeJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217825, "uuid": "e9218b91-1a1d-4aa2-bd68-8cbf67146f7c", "value": 259831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217825, "uuid": "41a2bee2-c9a9-47e5-9d53-6ee2ad17003b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217825, "uuid": "29cd9822-7704-4c7e-b61f-bed052a9db4f", "value": "Payment Confirmation REF No 016747 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4d5371-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "490c0b4a-a78d-4350-aedb-94675d050c32", "comment": "Malware payload (Mirai)", "value": "1836b274caf4f246cda43fc5bd2a4896", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "882c6f4e-180e-49f7-8e37-90dd1cffec67", "comment": "Malware payload (Mirai)", "value": "22fb1a3a007af97aca997f954d3946fe8011178dde9a91ea01b97e8e7b59ebe3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "0a2e77c9-5e65-4e94-923a-bc5c2336cfa6", "comment": "Malware payload (Mirai)", "value": "b81c1eb0d43c2f0fa7e55c2892c9501c476eeeca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "3b457d1f-31cf-4f3b-af20-5bbfcfba88b0", "comment": "Malware payload (Mirai)", "value": "9a8fa10903c720ac542f4a1e0695fbb3493ffac4a30a9d96d23f6f0c6b0d7b622d4d5f73847c47e462d71e20ffff3f21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234207, "uuid": "ce12dc74-20e3-41ae-9ad6-464ef58fcbd4", "value": "T1A9C2D17092E92CB1C7500572E7B856C9BE530F7DEAFE2880224047BB39419596EEE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234207, "uuid": "a1425471-688f-4a81-9931-8bdf99be8be4", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE2uSjihymdGUop5hM:ERsoTAZ3alkXLvFh8nNE2uSOs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234207, "uuid": "851b5853-4f11-46d8-b642-9bb0cc171ec7", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234207, "uuid": "6c7e0b21-6a34-4b3f-87c7-7eeae7e46a81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234207, "uuid": "a8c4fc38-7b04-48d0-8043-f8cba83c5226", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d6887f-45a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693227798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227798, "uuid": "d253ee7e-ec17-4cfe-b075-7dc94b6c78ee", "comment": "Malware payload (AgentTesla)", "value": "d484bf57443507607acba7a9cefcdf1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227798, "uuid": "d1268459-a44e-4cc8-95a6-1da17d1bdc99", "comment": "Malware payload (AgentTesla)", "value": "23f5c96403f3fe0307622f5878f240f5be37b987c5560c958523b595b5946810", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227798, "uuid": "98eba8ac-fed8-4fa6-8a1a-2a60ea336280", "comment": "Malware payload (AgentTesla)", "value": "bd7d4d4e74a5a89ec1ddddf2e8543b66d089b550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227798, "uuid": "1efbcd0f-17b1-42ef-b206-b3ea1b0e2c89", "comment": "Malware payload (AgentTesla)", "value": "11ab9c7384e6d74bb24630da4e23df62224989bf298796cd7f128e542e61e1f0f3169e1abf73f2bed31112a4435e3470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227798, "uuid": "f4e16d28-4648-4446-a277-f775e7fd3f26", "value": "T171045B5877CCDFA6DE8FAB75E0822150D3F58076222BDB4E1DC851B4B903349D90AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227798, "uuid": "f9c0c8ba-fdff-42e2-92ec-3db0f07c228f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227798, "uuid": "1a45d048-75b6-47e5-a3b2-f719af793061", "value": "3072:vv6ZNovmR0imK+v4xPHzZbjGIc2JOd9T9AFH4Be5EJ0PoFUjmU:X4qiuvWHzY9TBe5O0PGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693227798, "uuid": "390a782a-80fe-4ab1-83c1-5ee5cd91b18e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693227798, "uuid": "0baff925-8de1-4f07-9ee4-44fa5b203fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227798, "uuid": "acc3096d-ff31-416c-baf2-74fd7f9409a3", "value": "PRE-ALERT IOF23-249006416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0aadfd-45ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693258554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258554, "uuid": "4416db04-1d19-4819-b6f9-991723b4eaaa", "comment": "Malware payload", "value": "9ea04f0ccd00c401a26a3c2ed1bd57c3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258554, "uuid": "2302ec89-0f59-4a31-8817-8d8cd0c8becc", "comment": "Malware payload", "value": "252eb7c36de3f3df89515ce044c1b56387b8eae110201d06aeb09037d67ba9b3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258554, "uuid": "2037fa4a-d810-4d97-8db6-9db30f7e8c70", "comment": "Malware payload", "value": "2604ee8d33caa2f307506b9606e4f6c4a422a667", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258554, "uuid": "2c9633e3-0d0f-443b-9cb9-48da5a8e324b", "comment": "Malware payload", "value": "98070316d91a70eef63583f71e1019503faa90ec56c7f8949892e66c7e7a799feb10eb86b4c31f60f5f61605eb715cc4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258554, "uuid": "453b348d-4be6-4735-b743-2716e434d6b6", "value": "T1D5B53353EBDFCF26C728C0742177192A15B8BC1D5700CA7EC62EB28A2073A7927E7159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258554, "uuid": "041ba1b1-3d96-4f5a-8e1c-753a9e154478", "value": "49152:/ciMDxELbp7qwETMco2Vm44unFAR/TjnXsknV+6qkXwCd:/2xsqwoMcZVm44uFAR/TjXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693258554, "uuid": "3d79063c-3e81-4115-a200-b75b37c69cf4", "value": 2290176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693258554, "uuid": "113a513b-26d5-4863-a8f2-ae2bf3f6ded1", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258554, "uuid": "3d1b6f97-eddb-4351-8252-a1514058eea0", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.30330.12889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167a6fd3-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212693, "uuid": "0c966b22-69fb-4c75-b9c5-bdefa0e6c98c", "comment": "Malware payload (AgentTesla)", "value": "1f0fdb69e5821d12bde66b5d9d12d0f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212693, "uuid": "2bc8083e-8244-43a7-b15a-1b3cd1cc066c", "comment": "Malware payload (AgentTesla)", "value": "26fdef36132e8b25558afa59b468bc3d3b33738c87a5768f61e115bc7b84380b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212693, "uuid": "ffd5e700-6c88-42a2-8847-e1b9c8052132", "comment": "Malware payload (AgentTesla)", "value": "bc2fcd2a9e4ab68925c5574946e6d13f236d1c26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212693, "uuid": "9749bf12-793b-43a7-befc-bd9bfbc5278e", "comment": "Malware payload (AgentTesla)", "value": "89dec9e90f810e07ca69a168b82f709180a2d1b0d6ec0fa22bdd2f1537b2b9166dbbc42ee32b377a659661d8efd5800d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212693, "uuid": "27ede354-d918-489e-8e9e-c18d2c6fe420", "value": "T165F42375F4CB05309D9AB4FADE86DB33A7047C554834AA88E34AC684D6E14FF46AC05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212693, "uuid": "06a50504-284e-44d3-8163-2e22c48ee4d0", "value": "12288:S+oPlTEMWLa6KDRa7JqlBNW1FDwNU5NZ/ntJgaiZk/PqmRs+ZpQcQ1KHi+D/SV:SlTEMWLkDE7cBM1NlZ/nteai2qcpQbKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212693, "uuid": "8db31aec-de74-4266-9554-f23f517ae89c", "value": 758557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212693, "uuid": "bb7c6cf5-43f9-4b52-9790-f1a973f4cebb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212693, "uuid": "dc07ba65-9b2b-4029-a2ae-fde87f31601a", "value": "PO#1803842.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9727c2c-45e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693254627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254627, "uuid": "8b0e3dbe-090f-4a62-9791-3d43137ef665", "comment": "Malware payload", "value": "6e2789be77e46b5cc947f838a93aaf6a", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254627, "uuid": "b423eb7b-2783-4441-8933-fd5d60dd2dfb", "comment": "Malware payload", "value": "270abef189ed1a67a1a8b5657e557e882673c14b34738f2005abcce9e7edb7f9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254627, "uuid": "c72fbbd7-4c13-44a7-875a-afccd7468c69", "comment": "Malware payload", "value": "c7db0c42e94dcc2a8a6fcd3fbbad382866d2ae8c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254627, "uuid": "617404fa-b675-4887-934a-4ed97e915c60", "comment": "Malware payload", "value": "27eb59ed3d07aba75bccbc0b3a9f98c580a27d7bc0d7286a8bb498cc684702facb32136a352f008dea8e4d5fe9a2f603", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254627, "uuid": "80cef206-a46a-4ae3-9efd-08b716e67853", "value": "T1DDD1B520B3E84637DEBF4F356CB2531247B1F764AC63CB6E68C8128B5D266444A23776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254627, "uuid": "c5112f90-f8c4-402f-90ee-d296b2a5a602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254627, "uuid": "3295ead7-be11-418c-9bb3-2c3149785016", "value": "96:9sE4OAMgR1xh++3pU9LHZaL/lxKlMheT1wMWKAJnzXwzNt:9sE4Omlh+uO9kL/ilMM1w1KAJzXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693254627, "uuid": "2421dbc4-e5e2-4e1a-af12-115b0cfd755e", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693254627, "uuid": "9160c182-0df9-4763-8601-93e18ece4509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254627, "uuid": "663ffaae-bc4c-4012-b105-1a190f584f60", "value": "dump.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b21225-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228958, "uuid": "cd661437-a030-4735-a6f1-11e54c955956", "comment": "Malware payload (AgentTesla)", "value": "47bbdf390562d6487a230d9b64d5961a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228958, "uuid": "497d42a3-8a2d-4d9c-9cfd-5ac70f4a7d53", "comment": "Malware payload (AgentTesla)", "value": "2715be5c3cb56ae33dbdf532ca7845d22eba20858ce636dc09ad76af936480c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228958, "uuid": "2bfd8c54-b97c-4911-9856-d38b4962f4de", "comment": "Malware payload (AgentTesla)", "value": "95863694dac5d26518ee0a303ffbd2df01f3f91b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228958, "uuid": "c11d001d-5455-45c2-b495-4b77080fd830", "comment": "Malware payload (AgentTesla)", "value": "f03ebcc853ecd1c21b9b7d3f03363a534706fdec8c235ed1889e8e884c4fc455e57f3081054b325e783ce5ee8da7dff0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228958, "uuid": "370690cb-d42a-4e23-88d9-e6cc5a9c10da", "value": "T18124A43FBA7B9AF1C1180B3AC1DB110043A5D792BAE3C63A7D4E13D259037A99D4E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228958, "uuid": "dd78681d-08fd-4563-b71a-893bab4cd5ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228958, "uuid": "4f84e82c-cd03-4475-8fed-95afb01668be", "value": "6144:r71PGMAjPLGkQ+eizVkywvt5V40BPkuX:r71PGMGLGkQTizVkywF5u0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228958, "uuid": "009303bb-70b5-40e7-894d-7ebcbd57ae2d", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228958, "uuid": "f1aebaac-1319-4ebd-b3d3-e39c54d9d510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228958, "uuid": "c92d669f-e3ba-496b-95e9-d6b470c210d8", "value": "B 59555 PO 652715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448132e3-4588-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693216206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216206, "uuid": "75b04d5d-bcf6-40be-9fe7-df60cef69a80", "comment": "Malware payload (Mirai)", "value": "e24b37d9ad3b53694e18de654fd0a5d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216206, "uuid": "8bcf93da-6a10-43c3-80bb-31f62e0fd0d4", "comment": "Malware payload (Mirai)", "value": "282d206ea9703b8a80853577bfac81e1de5ff3d17f337e67b317fc860516b972", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216206, "uuid": "045169dc-8bdd-461b-88d3-dc036a97d91a", "comment": "Malware payload (Mirai)", "value": "3a477b5f34652b563a85b94ad49207e9b55fea09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216206, "uuid": "fe62b9f7-c57c-4996-9d3b-353b7de30a99", "comment": "Malware payload (Mirai)", "value": "3ae8fcd975214aa35353103a0e5536390b91c62afcda9f89e3b0a9f50cb8333bf75a5bad6feb29f60b0fb9f74d7e572e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216206, "uuid": "79c8aa9d-c7d4-43a6-8aab-6692919c4f3c", "value": "T1B3C2D1732AEF39B1C2A460B6FC7C86D7620F0BB965F1552072405BA1CEE100356BA8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216206, "uuid": "c38a383d-efc5-4824-90ae-7c6447533075", "value": "384:kXNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9chGw7ahymdGUopc:AjKX9vt6GqA3Q0jzV7EUyUq9sOs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693216206, "uuid": "9334d570-f1d7-4036-84d1-232b338418ec", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693216206, "uuid": "d25744f2-fedf-4dc9-8333-2041925454e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216206, "uuid": "0cd5ce63-3833-404d-92ac-852881b13dd2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0f23e2-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234204, "uuid": "8988b2f7-637d-4d6c-8f16-ee3e7a60f36e", "comment": "Malware payload (Mirai)", "value": "fc53feef6eb06c4f8ffed7f04ad41938", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234204, "uuid": "08d2b04f-9c42-41eb-b900-b715a47e5dcb", "comment": "Malware payload (Mirai)", "value": "28b205aaafa2e6ec012e0cb450ac957bcd0b9a0c538d04c127cb28c8426fdc5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234204, "uuid": "751678ed-c910-4c5a-9af6-806c90f4aa11", "comment": "Malware payload (Mirai)", "value": "135317ded93c67f28fe50300ba4c68456bf2decf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234204, "uuid": "cf0ba42b-36ff-4cc3-96e7-9c556738b2b5", "comment": "Malware payload (Mirai)", "value": "1a06dc7bddf291b1ac45e50b5eac146e7c115c5919cd05f662bb39991606e4735134f8cdde3c4ccdd8c683b880df4158", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234204, "uuid": "ffb40f54-6d54-41ae-8367-8c41112e28de", "value": "T12BC2E1E27D77796BEE29003978A9CE338275B062D75F6713A240920C200716CBB769DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234204, "uuid": "c8933da4-4081-415f-afc0-76e6d1f33a24", "value": "384:M21DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8Q2fOePyGlNf:vMwoDZLFbBy6HQHRYfeAxdd8V/j+0N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234204, "uuid": "7b2d6398-0fbb-493c-8401-10b8bb951711", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234204, "uuid": "03590d19-b78c-4e86-923e-35f6034f9ce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234204, "uuid": "05bf97d8-4470-4e23-b929-dc781e37477c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54a4fd5-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209496, "uuid": "30e1d054-883e-48a0-805f-90e6fce959fc", "comment": "Malware payload (Mirai)", "value": "2c8bb5e7bed393e0f83d4c0f0be49c08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209496, "uuid": "838ce665-b1d5-4129-870b-fc53c122665c", "comment": "Malware payload (Mirai)", "value": "2945b055aab3651ba724b6e3e905e9b38458ad3d2d043a267a01b88a9fcfdc63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209496, "uuid": "b161094b-bac2-44a5-86d0-3f4e1988f647", "comment": "Malware payload (Mirai)", "value": "877d8346c9fece9a698bb1aa111281e0e5a04f09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209496, "uuid": "1d134028-4986-498a-87e2-c9c2baadabec", "comment": "Malware payload (Mirai)", "value": "d65ed1446ef60c661c8d9070ed8fa4128ff57852927ac7de49317ec71eaf1b746a59180dd77f147d45816b79dbe4e2af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209496, "uuid": "da0dcd1c-a19a-43d1-90a7-e0ea67034120", "value": "T1E3732ADAB800DEBCF40ADAB68557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209496, "uuid": "cf5098d3-50af-4c8d-904f-0abf9af2e342", "value": "1536:awW0PKt9cwxjQ/JIXIdZzN37D8Utia84GLf84Eo5WOK+7c4R6yN:awsg3dZzNvFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209496, "uuid": "111893e9-b3e2-4ad6-aea2-8c66f234914b", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209496, "uuid": "6f288072-0e26-4ea3-acc2-3b97994aa61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209496, "uuid": "af462617-8b8e-4b11-aa97-a46b66c40acf", "value": "2c8bb5e7bed393e0f83d4c0f0be49c08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b0bb76-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693208799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693208799, "uuid": "00f76dec-4e87-4713-8a62-9bad1d801524", "comment": "Malware payload (Loki)", "value": "437a914384bc871685e3dae3fe6b1ddf", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693208799, "uuid": "94b6eeb1-9258-432d-9375-71602fd94374", "comment": "Malware payload (Loki)", "value": "2962cbddac0eec4c2e1ab8623735d157d37ad174a3270591719cc12e099f9183", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693208799, "uuid": "716bf48e-3932-4a13-8ece-2746d8a5fed7", "comment": "Malware payload (Loki)", "value": "39c8de92171a2f06e8cb14d8c3237a5359d8b581", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693208799, "uuid": "c6d9a872-e1d6-41c8-8f52-149f2b6c07e9", "comment": "Malware payload (Loki)", "value": "3753826c8166661336c607905cc9969069908084af5a1251f4c22ab31632528d59819ae39285ef6f458c2afb586be3e9", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693208799, "uuid": "d00b9dfa-a390-4f89-a516-b9b1b71eaf3b", "value": "T1F92302E39FD24F445DCBC5F784EFA324C12BA2DF721021872A4A085BE4082A4F2FD664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693208799, "uuid": "80be0603-f26e-4154-ad90-7b0dfd81d22c", "value": "768:vM3bY4JGkP8o+LD+gp+Ug0J4n8W5wJqNjuW1ZH0NXm52KbZ/u5quSY4b5oQ:cCiKLKgp+Ug0inT5NN90NXm5BZGYPb5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693208799, "uuid": "3ecd7535-ddf9-4413-8acb-1f170466a5d6", "value": 46409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693208799, "uuid": "0aaba525-01d0-49db-b6bf-d063ff505564", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693208799, "uuid": "ae41d6e0-cda8-4dcc-a1a0-8b976ea0be92", "value": "WM_115051380.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa063425-457d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1693211652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211652, "uuid": "d64809f0-7b23-415b-9a1f-c009cd1d85a3", "comment": "Malware payload (SystemBC)", "value": "cb028130fb2e1efb4730859a8a202a5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211652, "uuid": "b76e1bc2-da8f-4d94-8775-98a03bc2b959", "comment": "Malware payload (SystemBC)", "value": "298226aa47864663912ea3fa72ceff0e39e6a660b1b73bede89f08528d524b89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211652, "uuid": "1a675ae5-71e9-4809-b213-44f9d6eec748", "comment": "Malware payload (SystemBC)", "value": "a824e9498d917ac8640546b003f9384bfa631ec4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211652, "uuid": "3aff3317-97b5-4a87-a1cc-aaceef6f821f", "comment": "Malware payload (SystemBC)", "value": "76b2a1d9db6fa0a7ebea106a43b06e2e5cd1949200c0705126a6555e0803acb4eb49a6204df3467408be35c2bf9a0fea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211652, "uuid": "1486b405-2656-4e63-998b-c22faa9007d2", "value": "T11D5623BD6190335CC01FC0786533FD49F2B2563E12E9D4AA76DBBAC077BA421E942B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211652, "uuid": "0d2938be-ce59-46b8-8295-57a1bde8a56e", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211652, "uuid": "7ead5cc8-d604-4f2c-b3ac-956d585c4fed", "value": "98304:emB1kJ62BWOtIR7AzNS3mVmh/sxWruL0UUXoiEjCQYSRyEK0Upg328Vu2L8Ioor:ekKI2BFBS3m0h/P/S2QYwyE13l4w5oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211652, "uuid": "a1160c26-97f3-4139-b7e0-0f0d8e046d2c", "value": 5931642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211652, "uuid": "95d5f88f-be8c-4909-81c0-7ccfd474c73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211652, "uuid": "25c5e6d1-8635-45b2-9e29-db7f54a1cc95", "value": "cb028130fb2e1efb4730859a8a202a5b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef059803-458f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693219498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219498, "uuid": "3016ec0a-7117-44e8-865f-fcbcc4218341", "comment": "Malware payload (AgentTesla)", "value": "2e6c2200da5c95facd39817a420f0173", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219498, "uuid": "8665eb4d-e4b6-40e1-8e66-73fa2314b45a", "comment": "Malware payload (AgentTesla)", "value": "29befc4234aa3b17692d39211de95636b060e61ce1a4cdc28e9d6413c1bd992f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219498, "uuid": "8f9ee176-b78a-4061-a9a3-378e3f4ab196", "comment": "Malware payload (AgentTesla)", "value": "6a4a2698b223a4e95b00a96bd40ede1b4858d4ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219498, "uuid": "b6a82383-a7cc-425d-a606-d9f4117dc498", "comment": "Malware payload (AgentTesla)", "value": "a2cdeec0e6817e87ba961667061983f28a7e679912f00f2ba55448ea00215e996bdcbaaa10edcb747a4c65babd56a0f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219498, "uuid": "ad92a5ac-e62a-45c6-93b8-83f49735d247", "value": "T1092523148EBD28744B98E035B06F0EEE2EB4B351D805B3FF479544DB2507B26CA3B56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219498, "uuid": "2a6ee5e6-d813-41e4-8c49-e499e102431c", "value": "24576:EO92DpnvMWS7LBGsHOTjSyh5kr1g0Svqsw:KpvMWFhnBkr6Ssw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693219498, "uuid": "03865f96-ec7a-46f8-a965-e104d8e666c8", "value": 964431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693219498, "uuid": "be178910-273c-4c46-935e-a49df445debf", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219498, "uuid": "fd1850f9-d99a-4abe-a581-c03d140ab3ac", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f86bd21-45e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693256946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693256946, "uuid": "25e177d1-5e7e-4ccb-982d-ad8af62b3077", "comment": "Malware payload", "value": "2a25843a94aae8ab8a470927ba1bc262", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693256946, "uuid": "f58cf127-e481-4cb0-9fc4-655995b0d4b7", "comment": "Malware payload", "value": "29ff84f6e9fb316c311f0e1d7283488c8f57f55817f5d7a5507411307576d9e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693256946, "uuid": "9b5b90ad-c5a0-410b-916d-14c53e812866", "comment": "Malware payload", "value": "97a49a976987903f6a9c879f954bbe33ccfa4792", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693256946, "uuid": "93a1c820-584d-43d4-aabb-c67083b39237", "comment": "Malware payload", "value": "dd3e0ada3fb666ed2ba3546264a100136329cdd5bd4efbf138cb60f77c4ea5ca8a281d41b7281b247498869b2fec654b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693256946, "uuid": "cabf1fb3-09d4-477a-9b79-5f7086539880", "value": "T162054A19615EC06AE01D52F66C3D7B6B51AC083817B0B0C373D5AE6AADB43D760B9EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693256946, "uuid": "0f7349c1-bdca-48fa-9126-e532b444f621", "value": "e924e9ab175db33ee1e8bd95dc2725a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693256946, "uuid": "e8269b2d-626d-4fab-9f92-07702df19ea4", "value": "24576:xPZqOXwNAgZubBuy8Wj7creoZIZlhGmn4:vlgNAgkbBTxoiamn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693256946, "uuid": "bad98ec0-a994-4b15-bfd5-b2d22015e1ac", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693256946, "uuid": "f7b7b34c-0792-49b2-b520-6926c61af29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693256946, "uuid": "201bcaac-e7f5-45af-9f56-246484d826c5", "value": "supremacyvirata.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32056d6f-4538-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693181815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181815, "uuid": "addd4125-b0dc-465d-9508-c6745fc5fbba", "comment": "Malware payload (RedLineStealer)", "value": "16a494de7f5e76ed8980bb54ec1e656c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181815, "uuid": "5647a711-d853-4273-a2e2-18fd705f4688", "comment": "Malware payload (RedLineStealer)", "value": "2a95218aa13cf312724cc534ecbc1cf025b0e43f0ab36c8ee421ec1c66e89387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181815, "uuid": "f8890660-1b5e-4ff1-b6af-7d90f35cf75f", "comment": "Malware payload (RedLineStealer)", "value": "23b9c27a366770a1ec39c511ba5d38fd94970343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181815, "uuid": "8ed4464e-11cc-4e1a-9abc-c1856a46e9e6", "comment": "Malware payload (RedLineStealer)", "value": "331acb706c222de224f87dc26fc20bf97071bb8bc415250a046deb690f4aa8d3c2841dc8897b650198006cd9025703c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181815, "uuid": "60d61c4d-cb2b-4460-a726-68c4978099f4", "value": "T199152203F5C85025E4BD2B7068FB1383163ABCA28D7457271B95AC5F1C735E0A87677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181815, "uuid": "da06e683-028f-4b52-a2c2-be5a4f1ec6d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181815, "uuid": "8eb34237-a3ba-4c8b-b71c-929596733e35", "value": "24576:MyxsfWKmpi2t7m1FjZQ+1T0E4yvoAclJZFxTlDK9:7JK5tbjGw0EfvTUJZFve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693181815, "uuid": "ed3a96da-9349-46d9-813e-4e70874a99e5", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693181815, "uuid": "14d8285d-e0d8-42a0-a27a-6f51fda01cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181815, "uuid": "9e7e6688-4f05-4c13-8ac4-72081a186944", "value": "16a494de7f5e76ed8980bb54ec1e656c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa7b700-45e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693254852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254852, "uuid": "65b7464c-3c68-4e8a-bb92-6ac3472d5e62", "comment": "Malware payload (Mirai)", "value": "15bca9c9d18a9f8894457ac0194843db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254852, "uuid": "c935b46e-8c01-446a-9334-8f3178ef4f84", "comment": "Malware payload (Mirai)", "value": "2bc1457ca92a95beab336e7e0867c02b42773d75da88dbb74bb7663977c46454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254852, "uuid": "6d463bff-2477-4af6-8ae4-2a2bb0a73e1f", "comment": "Malware payload (Mirai)", "value": "ef7f9ec34cfb4decfa51af5878c886b21eb8385b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254852, "uuid": "14775384-0015-4fce-8f66-7dae8262c2d9", "comment": "Malware payload (Mirai)", "value": "27b7f83458210b62f071127225ad94c9cd4071b129c16c9e8cec85a66fd17b9738d735cfa76c1b132714e4c40ef76404", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254852, "uuid": "4f514afb-6c2a-4e59-8ec8-d3c578b43245", "value": "T1C2B2D0E08B919716C2B0B475937C8F935A3B15A0C6F739272B1092ACD69549B33FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254852, "uuid": "4259c2af-e252-4805-bc56-232a9fc4d383", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BuZ8y5zIhymdGUop5hu70:4GHKQFH0rs3zWoDDRsjt7LB9U+BFJs3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693254852, "uuid": "594eb105-ccaf-43e0-bb95-65bc177f2654", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693254852, "uuid": "9b1de0bf-3271-41d0-a28f-8f476731e386", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254852, "uuid": "bfbdfe06-b442-48fd-8a96-d42babcc70e0", "value": "15bca9c9d18a9f8894457ac0194843db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7aee78-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266413, "uuid": "19e90b5a-f12a-440d-887b-45f2189d921c", "comment": "Malware payload (Mirai)", "value": "cfb9e40da56664fbf90a3a542e151343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266413, "uuid": "1ea3d9d3-0f6c-4f43-ac0c-0bfc09c1ae45", "comment": "Malware payload (Mirai)", "value": "2bcb8ac67586c5155f694f307400ae25d38e424fd572b4d9ebe4c3feceb85c4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266413, "uuid": "7585da22-0456-4b11-a17d-0d8990464241", "comment": "Malware payload (Mirai)", "value": "9a5611baf53bcb390867591211e46f4bd397e263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266413, "uuid": "c2a1128c-d665-4620-a720-650c890b0f24", "comment": "Malware payload (Mirai)", "value": "230d0daadd0ea35ea272d2d588c20a7ebc837e2af9a766c1920d5fcecee9580e9a58fe7b998014f880aa880f0bbdc079", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266413, "uuid": "ae8a01e0-1de2-4447-94fd-d2e6ca2d9109", "value": "T1BDC2E0E0D6FC9DD1E99FEEB194508ED433822FD62996899370C00B718611B3B6E44E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266413, "uuid": "40205b48-6a49-40ab-ae78-75a7d17bfdc9", "value": "768:siImY5mSL291ApBHe6ylhFR4rG4uVcqgw09L:sidY5mz9CB+VlhJ4u+qgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266413, "uuid": "3f00ed58-0377-4682-a9dd-1cc9d710f77c", "value": 26492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266413, "uuid": "f3b641f8-3b01-47cb-a918-1540ae4f1b1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266413, "uuid": "02c56e94-a3b0-470a-9643-62ca9d057644", "value": "cfb9e40da56664fbf90a3a542e151343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2403b2e-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183721, "uuid": "ae20ed11-c53d-46f0-ad07-73f2bccc9b92", "comment": "Malware payload (Mirai)", "value": "54f699d631c62198c1487196e0ff0988", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183721, "uuid": "31b37825-89df-4d61-a3c5-994e57f7757b", "comment": "Malware payload (Mirai)", "value": "2c12891e96bf5ba6396033158e2afad7f988084c906817f0757ba0a45b1b856b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183721, "uuid": "a0fc7ce2-40af-4c2b-80c8-101ddd534f70", "comment": "Malware payload (Mirai)", "value": "9f24f240111a36b40ca148b14da496c9b78ebb05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183721, "uuid": "410171d5-63f9-497c-a034-20cf84bfb1b1", "comment": "Malware payload (Mirai)", "value": "b18de65abbf50df7fb9aa9a1088d6bd9d3b0b7f31d6e3752faadd1de16c730fec9c317ee2bdb77efb970f66b5d699274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183721, "uuid": "9e8d518b-2ea5-4045-8b24-149c3a00620b", "value": "T1FFC2E184F045CE41DFEA2CF03D44D6D6BBE06F1EAE618E8162A053D16F5C2634346EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183721, "uuid": "cefda58b-b39e-4dfe-8621-2e6dd058ef75", "value": "768:tVdafO76jpmNJJKehmA7trpfIX9KeA7PA94uVcqgw097:Vam+AnKehPRa9aI94u+qgw097", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183721, "uuid": "d8f8c7f6-98f9-4bf4-a5d8-63db8355e63f", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183721, "uuid": "86c24d25-8f2a-40ed-a11d-af626fde7c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183721, "uuid": "8ea12efa-c971-4cbc-9f2d-7891134037da", "value": "54f699d631c62198c1487196e0ff0988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cb1558-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220843, "uuid": "1c01c6fe-5a33-4d21-a584-a6cd4e732868", "comment": "Malware payload (Mirai)", "value": "804e7a458c3bb2a0055d6a89c04ef2b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220843, "uuid": "2b09ce62-6090-4cf0-b32c-df4842bb2ce2", "comment": "Malware payload (Mirai)", "value": "2c4b8e9b72056e1b260ecb381287d93dc760f30086b7b41fbc2ea9e13056864d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220843, "uuid": "0edb2412-c046-4a03-b76a-34ee7123761f", "comment": "Malware payload (Mirai)", "value": "ee30579920484fe93679371e77e81a295e45b5e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220843, "uuid": "bb29cba5-d16a-42b7-a75e-8586fd174345", "comment": "Malware payload (Mirai)", "value": "1361b13a3a5da315d34fca205cf176e04ca22c58ec4920c80135eba7ef63326890347d741634ef64d5f93d586c222812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220843, "uuid": "ab71a2bb-3fa0-4943-9445-07cd476a870b", "value": "T1BBE2F1D55AB7A878CEB14D7AFC630B0D2529C5FC86FB1122A7E4372413B09E64AB1403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220843, "uuid": "45d953e7-f542-4f44-9529-93d544abca47", "value": "768:q8Lm6COq1fewdHy62pud4yNOYSOyB8Lrfl9q3UELdQ:zLJCmjpkcMKU0LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220843, "uuid": "e19d1c7f-6101-40e3-9fe4-72715e586ab3", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220843, "uuid": "04b2b145-fdd8-4f3f-a355-c542f27e6a98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220843, "uuid": "5189105f-e782-4573-b2ba-875e8bdfc612", "value": "804e7a458c3bb2a0055d6a89c04ef2b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b954e2ee-4542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GurcuStealer)", "timestamp": 1693186337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186337, "uuid": "2261fbd9-d6e6-499a-8116-183b5a8b1906", "comment": "Malware payload (GurcuStealer)", "value": "baea8727cf8923018d8235c66ae8d6a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186337, "uuid": "9a331c11-8f85-4bc9-a984-61c2305800c7", "comment": "Malware payload (GurcuStealer)", "value": "2d37d22eceb8632c2d94f155e17db628125d658a336e79725d757d13b657dc5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186337, "uuid": "f1e0f1f5-f3a6-41fd-977a-07b884ff1146", "comment": "Malware payload (GurcuStealer)", "value": "42750ff80df0ea75d1dc27484bb6775cf8065003", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186337, "uuid": "f9e4c805-995b-4429-bce4-0974d3a45eb9", "comment": "Malware payload (GurcuStealer)", "value": "8d1f4b692bb5099053c69dcd6b25fbad3183451b04f507d2d0a466cbf95c3f3e4fa7bd55d19f972d8193f7080fa6c18e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186337, "uuid": "7797fca5-fc69-4eca-b4ef-54b7510e5767", "value": "T1FD84E10CBB95FA60F15E0A7994E163694374D2435642FB0E3EDDD8A12FE23C1460A9BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186337, "uuid": "5b5631cd-aac0-4a00-b920-9e2a2e21e77b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186337, "uuid": "a3d70c4d-ff99-4bd9-b730-d8c58b224204", "value": "6144:mMZ+4tD/t/a2zDGVPJXvnzZjDJHb571Kjn1929XDccHOL9bqY4S6X30/Y+59Y:T+GRatpvnzZjDv7oj19yTNYVwEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693186337, "uuid": "f5156104-568a-463d-9119-5829db013be5", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693186337, "uuid": "8ffdef10-5068-4cfc-b3b1-11a050e56f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186337, "uuid": "51504e06-5aff-4f21-8977-2d09bef99795", "value": "baea8727cf8923018d8235c66ae8d6a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65873766-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693212825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212825, "uuid": "3b4229f3-15ea-4004-b6cc-17c25d346f0c", "comment": "Malware payload (AveMariaRAT)", "value": "0b7f3aa9a170ea0d690f0efd917d1086", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212825, "uuid": "a5811224-b40f-490c-862c-1a4286840c51", "comment": "Malware payload (AveMariaRAT)", "value": "2f289bca4edaf188899e72d30200d15dbe6de31cc376e1badfe4e36196d56428", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212825, "uuid": "3915535c-8a74-42e6-9b5e-c2e2140a5a40", "comment": "Malware payload (AveMariaRAT)", "value": "5fc7281f9ab49a096b1c4101243cf283f4f7da79", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212825, "uuid": "c6e26f3d-2dcd-46c6-abd0-2fd9904e4665", "comment": "Malware payload (AveMariaRAT)", "value": "857843fb05f0f5f3db2767ddf73d3804ffd8ee45a169d2188e99fdcf161ccacd5d848d0a0ea41aadfc741719b733e0ea", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212825, "uuid": "dc38716d-f8d1-4070-9552-c88210b9dcc5", "value": "T1CC64F1102608DF13C9AF1631DDB286FA6BDB6D11EC8487DB5784BE1D7A75182DA0B383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212825, "uuid": "196bc612-f7bf-4da1-b0ce-db6537c7cc07", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212825, "uuid": "4d802715-aedc-45f2-8dec-660527ab1fcd", "value": "6144:oYa66TBr1+kuU01BDLajokfd0d/gSw6KyEvJj3EdOBxKTLCO7pNU3:oYYdr1t84jokfy/Dw6hEBM8KTLCz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212825, "uuid": "bd97326c-b8d5-45ef-961f-2e20564cf9cc", "value": 319609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212825, "uuid": "38b0469a-1133-4ae6-93ea-08b639b3b8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212825, "uuid": "f17a90a8-40f7-4795-a9c5-9c30acf23f0f", "value": "Hsbc_Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39563a2d-459f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693226065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226065, "uuid": "83022052-00f3-42db-884f-590b05dd5847", "comment": "Malware payload (AgentTesla)", "value": "26e579323d4f79b3f636972d04e46aa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226065, "uuid": "3ae4f6b6-a12b-49c3-aa10-22c0041df196", "comment": "Malware payload (AgentTesla)", "value": "2f4aef64725ecc08aa44a53242d13075af911d0a4fe6dfa0d1ae2283ff8c17b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226065, "uuid": "96e07bac-bca4-4545-9255-af0dfd44418e", "comment": "Malware payload (AgentTesla)", "value": "7c3f31a039c411d6ea058a82f09176f868b173bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226065, "uuid": "6d83d90d-2687-4c6d-ab6e-8916bcc8c3d4", "comment": "Malware payload (AgentTesla)", "value": "5d92cc8eb181689f10d5ef068d65bb7e316864e9d165974e0985ad33d7504b91424bfb8e3f8cad0e9e47c7a15d835886", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226065, "uuid": "eb4ce3f2-a7a9-4191-872a-ef38fd439545", "value": "T16BD4230072758FD4E4F4CFF181F4A4AB87B951BA2179F26A3EE841C618A7312C651BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226065, "uuid": "69928bdb-8a61-427f-ba2d-7a7b4bb66c3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226065, "uuid": "02619286-9e9c-4c32-879b-bea726ee2c7f", "value": "12288:ijId04ufLNsxGsrLN9l6CWBHFw3B6HIxdiJOUN3SI53flMW5iF/dEIfVn2yY2j:1d+fLWQALNT6fBlRHI3iJZN3S4lMW5Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226065, "uuid": "4c581aba-8d7c-409d-b61b-9eaddbf53f56", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226065, "uuid": "0adce528-6b9c-4e37-8e90-4c064b529979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226065, "uuid": "576bbf66-457a-4738-9abb-d082e0b973e3", "value": "SecuriteInfo.com.Win32.PWSX-gen.14942.19824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02398139-45b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693235422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235422, "uuid": "3d9b06e4-d0f9-4fd3-b4ee-dd30eb868545", "comment": "Malware payload (DCRat)", "value": "05af977e4b7e12033402c694fa6b023c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235422, "uuid": "e5a395ba-50d9-40ad-a33c-0c35a5f55fa5", "comment": "Malware payload (DCRat)", "value": "2f90dc24022d9477ed8f6367f59f2749609813261df4dd90e9b6f3fdda6f3663", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235422, "uuid": "5116e172-8f42-45e0-8811-b6e38eefe25c", "comment": "Malware payload (DCRat)", "value": "b5f00bfb0fc8de6a56381a6bda9b74919c264f64", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235422, "uuid": "02625d1a-18e6-4eb7-aa36-bb48c643f9b2", "comment": "Malware payload (DCRat)", "value": "214464973f9d8b793a5996f1ce4d2a6e16b8546ca693ecbef1a8a56a5a10ad51266dea49b7c98e8d53b9ca2b05dc5dae", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235422, "uuid": "6ea275b1-1e05-4847-bdbb-fb8a0a535fab", "value": "T174D58D0155DD8190DF7AB131725D3ADAE832F4E84E2C5AA76FB08AC503E77E22BE5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235422, "uuid": "62551393-8db3-4e49-9dae-7aca3a4ad628", "value": "8bf429a101d362ffd5fb314731152ff7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235422, "uuid": "a163fa4a-d335-4884-b5ab-2a2639ecc4fd", "value": "49152:UpclgYf/FEzSbPfkYaiCH504P1gKFr1iXT1UdO1fnwohx:fnmzSbPsXP1n1ij1UY5nhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235422, "uuid": "7a06f723-2c02-425f-8450-6c7b70f9466e", "value": 2958864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235422, "uuid": "ede5113f-6198-4ec9-aaa8-cddc2abd79fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235422, "uuid": "d97ee9e0-556c-494a-bf0e-49f714f0e8c5", "value": "05af977e4b7e12033402c694fa6b023c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70202d1f-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212843, "uuid": "63959387-3a81-4658-b878-8f510dc3870e", "comment": "Malware payload (AgentTesla)", "value": "7af97fd132634f475fa300749be47a57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212843, "uuid": "7a700e9b-b95c-4faa-a55e-306e7e153bcf", "comment": "Malware payload (AgentTesla)", "value": "303f771c2bffee2b28ee472e466922186e06da0f74f17f3ba17828ad26542290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212843, "uuid": "142ce4bf-dfe9-4ce4-9eac-e1cdeff90059", "comment": "Malware payload (AgentTesla)", "value": "e48e03b1b36863b78e93925f9b7a4d0d282c28a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212843, "uuid": "b5d13ce2-186c-4431-8cb0-37660c169569", "comment": "Malware payload (AgentTesla)", "value": "3190c8277261992ccbb05f785bf0cdb40e91e9893f74988f1c61e1b8dab95f93b62bf417c2e784c1c70f46dd02d95e74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212843, "uuid": "694f1007-a36e-407d-bc9b-cc4ed9b7e600", "value": "T16FE423C4E9228EBD3BAA24C46DA197BC4AD33F4A536365015F51CE735C2ABC6FB41807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212843, "uuid": "d5621820-f797-405c-b38a-9a154b385756", "value": "12288:trEn1MZkUnUO057mVSMwpCMGEc5NG2zpA2WvcdXMLfTVfV7uxf:mnWZkzOEaYw+clmAKLfTqxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212843, "uuid": "d00943c1-6aba-4d1f-8340-ed72f3581351", "value": 659795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212843, "uuid": "6a6cd645-47fe-48eb-aa8e-cea352519e3c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212843, "uuid": "5a84a8bf-7772-486f-9efe-4e3ec158f305", "value": "Packing List.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9026dae-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209502, "uuid": "d36b3651-187f-4080-9f49-1511deec4a56", "comment": "Malware payload (Mirai)", "value": "10d38d48e8f3dae090c61cb9acc80964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209502, "uuid": "75bef081-3308-437c-b67d-a210d9c49506", "comment": "Malware payload (Mirai)", "value": "3075708b8bec1c6d6bfbe48f47cacfb5aa9a591c6b927a95496f790c7b62a477", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209502, "uuid": "f55bd129-95c4-407c-9d07-3959113eae6b", "comment": "Malware payload (Mirai)", "value": "a3aaf6841d8fd140a0612128a890a140f6e147af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209502, "uuid": "8c8d3930-f49a-45fd-9928-8bd8e8bb3ea5", "comment": "Malware payload (Mirai)", "value": "4007b010ae3c8c25cd9fcc2af3b6ad53906e8e7c2931b0f6395ae55be85f6079a7d4e9c7b90eb44b40f50b7155c5c176", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209502, "uuid": "ee133097-4fbe-4f28-ab43-aeda12d4cf39", "value": "T1FF539E73C4641DA4C1544AB0B9288FB61763E60087637FF5426ACBA99057EFCF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209502, "uuid": "e410d663-bec3-49fb-a266-6d6b52ed798b", "value": "1536:oagv1AOp/umClcqseIyYGsYh4aSijKmR7GrxhCKkdV8:ox11KmqsnI4FiGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209502, "uuid": "e19d6004-6ff7-41fa-a950-726e59335036", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209502, "uuid": "5ab32027-d9c7-4cfc-9914-60d9a9ea26cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209502, "uuid": "6deff3d5-d9c9-47bf-9bd4-a27402bb0481", "value": "10d38d48e8f3dae090c61cb9acc80964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6756da8a-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232156, "uuid": "447a861f-fcbf-4de9-86f9-0fbcd4b53597", "comment": "Malware payload (Mirai)", "value": "d8c71748e00a06541b8f7ca27fedc174", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232156, "uuid": "da306482-2e15-47d2-9b99-dbbeae2140b2", "comment": "Malware payload (Mirai)", "value": "313f5bb2131e2ba91612cc59dda6ea921331b20b240c625f578999415b4392fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232156, "uuid": "62684d25-b4fe-4a0c-ab58-be2510a061f9", "comment": "Malware payload (Mirai)", "value": "00f8aaa51f6fded805de6ca797a897d60d83eed9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232156, "uuid": "b5d130e2-a947-4435-b31a-4b9bea648436", "comment": "Malware payload (Mirai)", "value": "8c533749948b4abf6d7eb04a10d351de782979a679f49e4d883cf6642fc78bf7580b29d213e46ed44bb69233dad23d34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232156, "uuid": "f27b51b7-31fe-46d7-8701-8bcde59d61e5", "value": "T17FD33917B4D080FEC8DAC1B44F9BE136DA73B42D2138B26A27D5AA271E4DE305F6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232156, "uuid": "b35af023-5071-4500-a61a-6c86ae5162b7", "value": "3072:3UX5YWaDw/w1Ou+cbN/Aei5ZaogzY0oYz2I/bnjL6vv:kpYWaDw44qrfEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232156, "uuid": "9afefb75-51d6-498e-8274-944193223ee3", "value": 132536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232156, "uuid": "06af51de-13ae-4314-a283-be136648d45b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232156, "uuid": "d750bff6-02df-4c06-9097-6549c11ba3be", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2040ca9e-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693266396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266396, "uuid": "321531c5-d1e9-449a-a6e9-efcfcacdb9cb", "comment": "Malware payload", "value": "96fcfba18a4d549b4664f7a2ccda91a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266396, "uuid": "09bb6624-171c-4611-a172-bfb6f313a479", "comment": "Malware payload", "value": "31840eea27692f880db569e38b91b93bde8ea4f2d7894bb10db7fd5e1a8a5a36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266396, "uuid": "d9af6ac1-64b5-4942-8aae-bdc61ec2c357", "comment": "Malware payload", "value": "14200f1b8b5c6395e048b5d3e1eb0a44be0399ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266396, "uuid": "758db84c-e32b-4d65-95cb-a6d3a848b7ce", "comment": "Malware payload", "value": "081f1ec5e2ee0bb36bcc530696004e64f01cdfcf83ef3e6ccbe4aa642a3a137d02902766ca0e43b84f00f12f940fb4f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266396, "uuid": "73d94ce9-2167-4ffc-be2f-8c6e6e7c72c8", "value": "T1B0D2C05CFE147941CDFD9EBEE4EF0B628A11B1E012B127997B594C09B6DBA0E708C48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266396, "uuid": "039b61dd-d449-4003-bb88-72c110966ddd", "value": "768:aZmszYBjNHibe7eh21oUpnCJPmGIXlEs8armfWyy:+mmYBjNwe7Q21oUpCJuGQ7rMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266396, "uuid": "6b626092-4684-4d0c-8c0c-38028431fc2b", "value": 30704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266396, "uuid": "e7c08c8d-cc45-4fb9-b7e5-7226c13be516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266396, "uuid": "32ada7b8-ac33-47ac-be07-072b898ad3ad", "value": "96fcfba18a4d549b4664f7a2ccda91a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8010ab92-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209004, "uuid": "c45780f1-dbc0-4219-9762-2e57bb6a71de", "comment": "Malware payload (Mirai)", "value": "0fc8af8a8cf885ae7d95e64e91de6f0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209004, "uuid": "22d876f2-dd2e-491d-b136-58232f1c947f", "comment": "Malware payload (Mirai)", "value": "31935481ce3c69f7c275222efa5d8ea97a32337c851229020452804a6adba769", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209004, "uuid": "d7dda64d-6a4a-417a-a6ee-b10ada616649", "comment": "Malware payload (Mirai)", "value": "e3fd888ced8c7efa8b660a62003460c38e0a9955", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209004, "uuid": "3e773fd9-f8ee-484c-9ce6-85ece30c9f75", "comment": "Malware payload (Mirai)", "value": "276dc08803892500243adbf3417a2074502708260ad6ea7d154e92704913bffc7db72b366734dd7994d502e0428b6361", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209004, "uuid": "f83d82d3-cd5c-4745-9040-11466cbdc787", "value": "T132536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209004, "uuid": "db1c6271-8cba-440c-85c5-cf573d47acc8", "value": "1536:Z7qARubgzY/bEJy/RcpQ80LDHhklv4JQC9DSW:NP+eY/bEJJsXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209004, "uuid": "a99ba83e-e1a6-4891-8d2b-884f96fd5ed2", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209004, "uuid": "fe429c68-07bd-4e52-b498-668bd291d3aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209004, "uuid": "a994deca-10ee-4caa-b05b-dbae4a46b3a9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edbbef0-4591-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693220008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220008, "uuid": "17ea55da-0493-4928-90c6-8cd10ed577c7", "comment": "Malware payload (Formbook)", "value": "7e246adc06d352f9750ba53c0b7fb1a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220008, "uuid": "d65cdcde-8566-4205-8334-ccbb6a7b4c1f", "comment": "Malware payload (Formbook)", "value": "331b0c93b00a65e96d830a0bd21582a7ab4aebceed4913bbb09130b85a8198e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220008, "uuid": "53551784-b63a-47d0-96da-04ef4673524c", "comment": "Malware payload (Formbook)", "value": "ed48eaf0a21212fd7ec4abc2039b78f0e0272552", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220008, "uuid": "1d2c1aee-dd7c-4c2b-908a-2525d4b98eeb", "comment": "Malware payload (Formbook)", "value": "0555b43433ddf678b3cdcfd3bbeb8d565cbc3fbf1f87735657a02442000f3903a9d4a356bc9d36c65ab390c16a125afb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220008, "uuid": "d98aaaff-73f6-4e86-854d-0769e8900a46", "value": "T15A34229448B1AC1CA5BFE66E1621C88C1496FA34DFD8D9BCE69449B06C3E300F9732D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220008, "uuid": "4edafa5f-6c4b-44d1-a6f7-ee5af8b5049e", "value": "6144:ud65FVbFG1czFmqDoGPupuieEJi8270VkFe8m4znusYtqByx:uMrFzzF7Dooupu9gpkE4zusYtyyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220008, "uuid": "96b5c40c-4a53-4568-97e8-f7049cff5ca2", "value": 246230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220008, "uuid": "9dd1b63b-0ac4-463a-b83f-e2d67c198b23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220008, "uuid": "f2388e61-1018-4b9f-9058-8fed1dab267d", "value": "Product Specifications xlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d006011-4537-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693181511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181511, "uuid": "934a5119-1ae3-4c44-8da0-7928d0371fc2", "comment": "Malware payload (RedLineStealer)", "value": "a5993766d5716e2993464445fc56b686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181511, "uuid": "f5516779-536f-4e5f-aabc-32267f2712a1", "comment": "Malware payload (RedLineStealer)", "value": "337e1723d8e1f99d33f16c9f2bedbc23ad4b3f3bead10e1b32a97f5c5f092c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181511, "uuid": "9192cac4-fe29-41b5-8921-6578b53ac80c", "comment": "Malware payload (RedLineStealer)", "value": "820220e69dc5dae39232c4b4d653b365b57d15ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693181511, "uuid": "06ff09f8-98e4-4b75-8bd2-80a2e9916320", "comment": "Malware payload (RedLineStealer)", "value": "0e7ee0956087fd9e4602731382c2a81cda4456f9cc519f7f0949ec82a2d6efe74b953c7a472136cf18b702cf5a100c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181511, "uuid": "237f342b-b88a-4ce4-abe5-784f0ebdbd7c", "value": "T18E652312DBF6D476ECB70370A8F9530706383D6B6D68A12327429C872973698B536B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181511, "uuid": "cd44d44d-ca53-484e-b693-270ad63c9d83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181511, "uuid": "c0bd54db-472a-489d-a8b5-44bec2b8dceb", "value": "24576:0yuNCvXRZHfnQjGsTK9ipN5Lga5w3PEbpIyztzhEGCFJoQj7jJiKwi1:DxXR1fQjlK9ipN975s4zhpVQjX8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693181511, "uuid": "d30074ed-770d-4b36-995c-0584dec5daaf", "value": 1468416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693181511, "uuid": "7c8fdb21-6009-4628-af7e-4e15a4906e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693181511, "uuid": "53feae98-bf1a-4c8a-bc28-89694bd276e1", "value": "337e1723d8e1f99d33f16c9f2bedbc23ad4b3f3bead10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8caad8c-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226682, "uuid": "12959ea0-d8b8-4ef8-a2d1-56639f769bb0", "comment": "Malware payload (Mirai)", "value": "0fd52ad00a9cd8e46b3d34e905811b65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226682, "uuid": "39b9a68a-2452-457f-9eee-239d53d23bea", "comment": "Malware payload (Mirai)", "value": "34737281d6467b7029c2e581b76dcb7c305aea7ab1f551a2b8baa17042535a51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226682, "uuid": "691f759b-4d71-4d8b-a8e5-d210fe422a74", "comment": "Malware payload (Mirai)", "value": "6493f8f6fc2abebad46d9bbda81952ea7c9496cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226682, "uuid": "cc176bc5-e44f-476f-ba61-c9f5c453ad44", "comment": "Malware payload (Mirai)", "value": "7a80c4d6749e08d3c18c0423b2ec53c3c18ef577ff8d84bbca879543bd25d223e76ef0ff0cf22148d8507eca0c3672db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226682, "uuid": "84a3bb90-fbdc-4bdc-8b9a-605b5a441def", "value": "T190D2D08876D663EA8CCDCA7EB35E103A709D74E9A6B29363B305C5430776180F691D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226682, "uuid": "6bb4f05f-0b5e-4181-81f0-1b14da05523e", "value": "768:NlxKd29WcxEns+V6IHE4RlY990cM5yK/Z:gd29tn+9HEw0adhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226682, "uuid": "fb7559a8-c8ff-4c6b-bce7-06ff61368af6", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226682, "uuid": "5af33ddd-edd8-4799-8bc3-46fa51152e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226682, "uuid": "d9a8c0d4-fd7f-47bb-a2d5-cbeb00cc4f27", "value": "0fd52ad00a9cd8e46b3d34e905811b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4040cdf0-4563-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693200307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200307, "uuid": "420a069d-4f48-437a-ab30-4039497d1f0f", "comment": "Malware payload (RecordBreaker)", "value": "4a68c09a2e48193430b9b0c7a88c7b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200307, "uuid": "4a2876b2-fbf0-4766-b86e-1ff8f133c842", "comment": "Malware payload (RecordBreaker)", "value": "34a74095cc9ddabe70e50a3dfaf54ba404db34e18e12270ff6afe8281b46b744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200307, "uuid": "f9636ccf-4992-4380-a4a5-eb7b54cebfba", "comment": "Malware payload (RecordBreaker)", "value": "2828c937ced4de279d8c8ccf163891dcc81ad057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200307, "uuid": "e3c11011-9f7b-4db6-b441-ebbc6647989d", "comment": "Malware payload (RecordBreaker)", "value": "8d90c3c0dc3ec798f691c88c7f7f70ad1a5b6756929cca9561410c8d06f879c16db1cc20bd577d7fcf2f4f7f8fa70dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200307, "uuid": "5c95596e-b35a-4fbe-9db0-eecbc704d032", "value": "T1A78329D295B0D40BE5C0D873719EE9326279FC3E0A24B9536385C312896DA935DFB3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200307, "uuid": "659a2bb8-9083-4b47-a475-1e0c9c12d2b5", "value": "9a4ec0dad65bdd0dc1e6a802e6362fd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200307, "uuid": "ed5cdc9c-7611-4cdb-af87-79346c56bd9b", "value": "1536:4MDtfn4xngxeMcBWaiUTyBS4/HXdS34WgPhZIK4wfAet27B8FnQ2XxublGrDwT:bBfnbROWai0yBS4/Z55x4iAV7m5rXxup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693200307, "uuid": "d58301fd-432f-4dd9-8e99-1b9f6b7e7726", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693200307, "uuid": "dd864f2d-c239-4ebc-9b4b-c0edfe7ba748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200307, "uuid": "eed09a30-c554-4379-bfcc-1db72a8847a7", "value": "4a68c09a2e48193430b9b0c7a88c7b0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1697da85-45dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693252206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252206, "uuid": "12081830-268e-4db3-af4e-470171a11bf3", "comment": "Malware payload (Mirai)", "value": "1041d10878c87c25cc0899fc43167203", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252206, "uuid": "bdeca98f-b9f2-4f15-bdc2-4662a7e6a3f9", "comment": "Malware payload (Mirai)", "value": "355b47f2a6bf1b128605461925d0e707406eadc9dd1d2efdd0bebfdecea9a220", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252206, "uuid": "c6f2d12c-1a2a-465f-8e4d-d8eb9fbb2161", "comment": "Malware payload (Mirai)", "value": "6a12e631197d36f59cbd05d2986569bd077d5672", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252206, "uuid": "9294e017-08a6-4d2b-8e14-18b47f9a910c", "comment": "Malware payload (Mirai)", "value": "65eb2a352b53f175303159838dd501da12e39d9ed55665598760d7b703753cdc342f3a48f9c30dab9953baa6a853945f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252206, "uuid": "9ed94160-bbce-4324-aa1c-2875d59bb43f", "value": "T14FC2D07067AA2CB1C6500272F7B866C9BA520F7DFAFE3CD011419AB63C4294529E99C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252206, "uuid": "4504d5ad-97fb-40b9-84a5-d6f1f896d4af", "value": "768:AWsoTAZ3alkXLvFh8nNEq2L2QJos3UozH:AWs2uKlqZh8nNx2L2mzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693252206, "uuid": "f9c809cc-3f52-4e02-9d40-7f02116b498d", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693252206, "uuid": "18134255-4bf5-4df4-bbf4-0bbe394d8e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252206, "uuid": "b4572219-5582-4321-8f0e-bf55348c60ac", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f463094-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229887, "uuid": "37b0c007-54dc-4bec-819e-2b7bb70ae761", "comment": "Malware payload", "value": "f384bf527a37e7bb8c18b280401f127d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229887, "uuid": "d9399fa5-dea9-467d-8df7-2456c6482432", "comment": "Malware payload", "value": "3583371422db105f2d825d42fb0aef58214c60ae3950f654b4af5cecff8c23a5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229887, "uuid": "eb633e0e-79eb-4b00-9892-be069d7069d4", "comment": "Malware payload", "value": "b9393de306f2b6eedd8560aa42377af654e9b445", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229887, "uuid": "8a4ebe4a-8c15-40c2-bbe7-1116e3768501", "comment": "Malware payload", "value": "9f10776e6c3479b7dc2b92c2c78c807a2e8e5625fdc59cf17c6482dd4a8c24b542efc254881371fc6d99d12e0a1d83eb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229887, "uuid": "e800d195-2b9e-4bdb-bb19-ee96e3a0294b", "value": "T1121523402EF01E4BC7A5537D722FDB1D27D6BE8C9759D4BBA3AD302A19BB7B18086401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229887, "uuid": "c3398f61-794f-4bb1-b80a-3b410d87ec0a", "value": "24576:jeBGKV/pLo+nlqoIU/7hvSoIhe/v5GF6C:juNt7pke0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229887, "uuid": "267c46dc-20a8-4c9f-a220-a523369ee90a", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229887, "uuid": "033d1a6e-61b0-4ec0-9ce4-ce6cbf5d46b4", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229887, "uuid": "2b64550e-cdb6-4f3a-a207-546b8f2ea644", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.1113.20501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37f96d8-457e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693212124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212124, "uuid": "2ffe23e8-589d-4a9e-a6b9-9c38061185b6", "comment": "Malware payload (SnakeKeylogger)", "value": "fd88fcfad0a4e765e806cb1a78535859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212124, "uuid": "8329b8b5-2be7-404d-a26b-fdb056ddc4d1", "comment": "Malware payload (SnakeKeylogger)", "value": "35a55c6bd2bf598a39c37fed70a97774510187ce41589c497ca97e8f9b171d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212124, "uuid": "d6302b62-8034-40d0-aea8-3bb9727f864e", "comment": "Malware payload (SnakeKeylogger)", "value": "d1951954645ab2dac450c84d7910de5758603d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212124, "uuid": "00287e79-b1d4-47a5-b708-3bab604483c8", "comment": "Malware payload (SnakeKeylogger)", "value": "8b1728d1c903fda7e4101d2b2f23b891179a2d9ad07e272a2551b65dfa095ce4c115931a06761ccf18e9e61d231c3d27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212124, "uuid": "427d4d7d-3681-4b9a-91a8-4e8ac5b6fdce", "value": "T1FDE40223FE129FADD03A87FA3C1AC51046B2DE4E6C50D758A89A36E65D70713442DF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212124, "uuid": "ba8b5f1a-7f2b-4cb2-963a-6987331d56c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212124, "uuid": "fd955124-8b7c-48ca-a4ce-3315bc54d826", "value": "12288:UtWJp094vHZcvQUB/r4OEjIqHaADLLKyowWin:UtF9qGvxGORlAD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212124, "uuid": "ff32b078-0ca6-402a-b45c-ee664d30394b", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212124, "uuid": "89a1cbb5-fa62-46ca-8880-4040be5c4bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212124, "uuid": "bd7bbd87-8aa8-4fa4-8a05-3546f49ef721", "value": "Deposit Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009b2910-4599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693223393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223393, "uuid": "09587b30-6cf3-4802-a6e6-cca339aff77b", "comment": "Malware payload (AgentTesla)", "value": "a504511bf0c62d3c0e59210abf0d115e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223393, "uuid": "a7e61b59-fc3f-491d-9e9c-5bd456b59b6f", "comment": "Malware payload (AgentTesla)", "value": "360df319ebe78e6500d595467465b85b239e4af9ba6776ec1d68f58432f3f4ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223393, "uuid": "b79ff84f-3b51-4e45-91de-0a0881640261", "comment": "Malware payload (AgentTesla)", "value": "7bb0875457130ff5c8497b22a82cd6942912deed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223393, "uuid": "8f7bf9ea-0bfb-4073-b533-dfd74c329298", "comment": "Malware payload (AgentTesla)", "value": "ead13c135e6b1924a65171bdd7b96e3c6e953cb0ed8c5987a595f278cd87131303ffdf5ae36b5813ed67415a32e70155", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223393, "uuid": "5da816d7-fdbf-4454-b996-2d4335eb6040", "value": "T1E9D42360C57166008CB0E6066C13A73DD7679B378F767D37DEEA382840D069A48F96AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223393, "uuid": "45af2e13-86da-487a-9f2c-389e35106a1f", "value": "12288:f+qJJXkqc5qd+CTPd8u4E7tCLM4JripZF+BeTtlfU3hqxg1L7mVAQ:fbObjCLdkiqxwx+BXqxgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223393, "uuid": "90b75f74-fc5a-44fa-9858-2ad6638fc2f1", "value": 651588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223393, "uuid": "6b3bf0cb-3a8f-41c9-88ea-78224f92d6c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223393, "uuid": "543d9744-5f1a-4f00-a2f7-98a2c34a9d3b", "value": "CANCELLED PAYMENT SWIFTCOPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55984fd-45c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693242165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242165, "uuid": "d7268689-2627-48e5-a1e7-e6ca0acbad3f", "comment": "Malware payload (Formbook)", "value": "dc1530c419c1deb08f341a5921b361e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242165, "uuid": "8905cf18-b5cc-498e-864c-1d4a6e310d9f", "comment": "Malware payload (Formbook)", "value": "3657bbc56c6f5a8bc8326ee2eb13f384bd89697fa29175436a28601b47f945ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242165, "uuid": "85773eec-f7c0-4d3f-a79c-3e50cb4834b2", "comment": "Malware payload (Formbook)", "value": "fcb91bdcbf638e27b9b7b47c0e8e766b8ec398ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242165, "uuid": "4230614c-0ae8-4756-bfee-df1299a5e945", "comment": "Malware payload (Formbook)", "value": "0458bc7bde7ab87b699e656d897a4a8bd47dea899185a4dc1bea1ce3c1aefb7ae4b5ef51d5abff0017012f802fc6cce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242165, "uuid": "2df2e1c9-0e28-4281-a63e-0934dad1d8cf", "value": "T16BC4121426E99E6BFC7897FA05759E53033563B8A13CF7DF29FA90C8463A341C210A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242165, "uuid": "1b89c972-58e6-4e58-b536-c19771aa354e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242165, "uuid": "a5aa2a93-cfff-4eb6-b5c4-f4e1eb3730ae", "value": "12288:vl2d04ufPnTWNpbRzAgbj0YH5xYazlEyW4H5TP2WrcFmkXzXe:od+fPnep1Agbj0Uoom45qEcNXzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693242165, "uuid": "2ac368d3-45ea-44c9-836b-df7cafde324b", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693242165, "uuid": "15a5df0e-7cde-463c-a57d-0bf471a4df16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242165, "uuid": "627c2a10-d808-49e9-a2fa-357972e61b37", "value": "PO23043-WT0540500856808075.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc4a566-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693230150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230150, "uuid": "88338ab9-4bc9-45cd-8152-ee266240176e", "comment": "Malware payload (AgentTesla)", "value": "486844914217ddb16316fc2a98f4df28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230150, "uuid": "7f6d0341-e5c0-4bc6-8a69-c8923568c636", "comment": "Malware payload (AgentTesla)", "value": "384adb13cb02e0677fa9c4c257d1a73dd278f2b851b9bf68e023111e4f312fc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230150, "uuid": "fb48d7ed-7fc3-4baa-9207-0874110b9f0e", "comment": "Malware payload (AgentTesla)", "value": "84d007ade8d4c30a875fe56c0312bf2caa27174f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230150, "uuid": "34df00c1-af0a-4e74-99f5-572fe810ad5f", "comment": "Malware payload (AgentTesla)", "value": "7bc82bde3608f29bed7350fafb15a03ca068a0ad9c340130000fcaf9340a7b25c2db52f8f1a1979dd782cd2f2c09f828", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230150, "uuid": "28db85dd-72e5-49bf-b0d4-a26b95439b17", "value": "T123330263E6CC7FDDB5A9D9BC380A470295BE9B007E7E25C0B51DA438B650E17A0711BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230150, "uuid": "d0249e4e-1758-4de3-9160-2769838b173d", "value": "1536:Z+MMWpbHAVQeIlEnsa01GBMHsY2Em2IRiO:3MW1HAGeIlEnsX1G8sLEWRiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230150, "uuid": "fc5bb9ab-4d68-48b8-86e5-c73f848cfbad", "value": 52196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230150, "uuid": "8306e931-2ff9-482f-b16b-4c35799c7871", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230150, "uuid": "7e6d25e1-44e3-4170-bd78-e5452b88eb19", "value": "New order - NLDB-082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed43493d-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235387, "uuid": "175fe05c-8013-48fd-9754-22867de32216", "comment": "Malware payload (Mirai)", "value": "1ffef51eaa94bc40e0d297b726acf409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235387, "uuid": "5dfca005-6886-492a-90bf-d2d7a856328d", "comment": "Malware payload (Mirai)", "value": "395079f795f5a521249f7b23185b6b8284a77fd3371dfb30f348b425238ae13c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235387, "uuid": "2059b044-1d67-4137-8b78-92290b3c300f", "comment": "Malware payload (Mirai)", "value": "bd3a5f07f492c4c64589bc5ffcd2d4ad7158bc18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235387, "uuid": "7134e950-0f33-4144-8bd7-24a3180fb4fe", "comment": "Malware payload (Mirai)", "value": "046ef4bb678717434fd2410ed97a7a00a50b33c4a423bdb50d59358a111b73036d9a85e15c2cb3202166dfc5f6afe4f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235387, "uuid": "24f92b1a-c6bd-46cd-8666-5a34cbba045c", "value": "T1DDB2D0A48BA1A706C2B07839A37CCF926A3719E4C6F62927161092BC958545633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235387, "uuid": "e4676dce-d8c8-4162-bb7f-2ff439037465", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BXIU4hymdGUop5hu7O:4C9KQFH0rs3zWoDDRsjt7LB9U+BXI3sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235387, "uuid": "d3746375-d679-4080-a3cd-979f814c591c", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235387, "uuid": "569bc5d8-e55a-45d2-8b77-30fc6c513f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235387, "uuid": "01d72021-b085-4e9e-a567-8d367b3faacf", "value": "1ffef51eaa94bc40e0d297b726acf409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63422447-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693214110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214110, "uuid": "63549557-3f7c-40da-ae32-9fe88d3c2551", "comment": "Malware payload", "value": "b06cdfce6010312d8ccd00dbac4a1ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214110, "uuid": "c20d3ee4-55e0-4d82-b3fc-6c61a331e10b", "comment": "Malware payload", "value": "39593181fe1ef796f0ccb7a3d69e2c8e7244ba459ecaebd24a7ce3ff53ebccf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214110, "uuid": "9581afa4-ffb8-48a8-9be5-7dc47d648959", "comment": "Malware payload", "value": "47674a9478bbd20586cb97a800f43d75596345c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214110, "uuid": "d1f134d5-228a-4b7f-a97f-d3b439f972a4", "comment": "Malware payload", "value": "3220aa4e06efaa3d7857173e02a1ca984b72993f34195ba903775bb3ed5c44d39172ed41fb3cc684662f092467fb9e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214110, "uuid": "0b76c3f5-e3a1-4100-94bf-9ee8206b95c1", "value": "T13CC5230176C08673E0771D330939AB20A7BDBC302B6649EFD3945959EE275C08B3AB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214110, "uuid": "5831e6f5-fb78-4a5b-abb1-27709637f9d9", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214110, "uuid": "096b7696-0532-44e2-a11a-6310fd241b7f", "value": "49152:HdgOQNrahvbnr1gydwSjdN3JKYTCjRtsccsjt3/jxRd4azp:HIshvbnhdBjdBJKYwycc6rxLHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214110, "uuid": "d8cf4a97-49a2-4f62-abdb-cabbae111b47", "value": 2555013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214110, "uuid": "f8a4ba05-2023-410d-9258-4ba598e23f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214110, "uuid": "b5c281fe-fa8c-411a-9160-bd2a212845dd", "value": "b06cdfce6010312d8ccd00dbac4a1ca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5d65f6-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228572, "uuid": "5490de58-b621-4602-916d-a4026feb97bc", "comment": "Malware payload (AgentTesla)", "value": "38a6216a223d35a6a2d2b1b04d8cbb22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228572, "uuid": "a8bd20a4-1936-4e1f-963b-f8ac93d2f53a", "comment": "Malware payload (AgentTesla)", "value": "39ee7c2c7adc0a85af20d526c5df56658e068f415f1fe8c5b441fa5ed7800cbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228572, "uuid": "e6456bff-cecb-4c5f-a023-90f903e05d6c", "comment": "Malware payload (AgentTesla)", "value": "04b3e579c926c4a5594dacbf675df27860f0bedc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228572, "uuid": "8ddf7715-f7cd-42e6-9bec-1d0d3191e162", "comment": "Malware payload (AgentTesla)", "value": "7b02a5444505a405d2c0d379f5d604f0febdff662aea4253a1ede00e217630b585b4b49720280fce7d6fc716be77fbd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228572, "uuid": "b33ee6cb-ae52-4d5b-825a-f05656f05872", "value": "T146930283D28EAAC00D77F1A8FEA54C9AEDB15ED0E1852A197D474CFBE15A4C11F03A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228572, "uuid": "df1fb92b-eeb7-418b-ae32-78bb1a126a3c", "value": "1536:aCLb/JHG/mTrXiM7lrVzi7ZVzdknWmG2Ej2DfYrMJdVEd6g/FBYf+B7hh/lxLyTx:aIG/mTrSONitVaWmAjxMJEb0f+B77/Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228572, "uuid": "05efc0b1-3ca8-45f0-ab4c-2a3892a48415", "value": 96601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228572, "uuid": "84d0bb46-678c-43e6-94b5-57f8f05ea161", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228572, "uuid": "f096422a-d6e7-4dea-a615-a212f205222f", "value": "24020238 RVOOIN-16-0077.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf58bcd-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "6476a160-f299-44f6-92ed-d86233c1baa7", "comment": "Malware payload (Mirai)", "value": "a77010ef51e4f0eb1a302aeb475a59f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "33486b71-af3c-4725-a13f-bd073b0b8fc1", "comment": "Malware payload (Mirai)", "value": "3aa6b90113af72824e64b958fee05f815fa0e07873410ea4b1b5f2a59ee61b9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "f1608bca-35ca-46b0-994c-6f8e54148af4", "comment": "Malware payload (Mirai)", "value": "50152fe3328569ed9d9784bca08c4c3d35276132", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "780fbc1c-bfda-4e0b-a93a-3dfe4e7dc357", "comment": "Malware payload (Mirai)", "value": "cac34ab616f17b4d48083d6dcf06f7108b0a2c7fb72f26826b4ddcea3c9a7b010200d39a49c979c5c18d34fdd3c387ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234203, "uuid": "e4e58df1-8fe3-42bd-8b4c-307fb2eea0f9", "value": "T1DA3302A367AE2DE291B08777FC32BC19669C17F9996730DA2CF0651577C48014EF2386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234203, "uuid": "95867b3b-6b48-44f1-b3a8-e3b54dd2ba0f", "value": "1536:j9O/ZMAXIxNUk0iLcPqF1aBexo4opKZbh:j9O/ZNKyWLGqFUFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234203, "uuid": "fbfdfb8e-4dba-449d-9811-36a28e399a6a", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234203, "uuid": "5b49ce0a-ea4f-451d-bb6a-ef55b437768f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234203, "uuid": "8f627b85-1cec-43d0-bc4d-34077172a352", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deaf74c9-45ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693258555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258555, "uuid": "365a2192-3527-4c2c-b876-8c2a398edb49", "comment": "Malware payload (Formbook)", "value": "7247c2f218df48a7bd824f33f86b1760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258555, "uuid": "b840785b-c617-4d65-82a8-ef710b26c704", "comment": "Malware payload (Formbook)", "value": "3c37386f3be133776e9754f751b88396a17d0030105646d373e82e8e0a79fe3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258555, "uuid": "b9d4e931-0049-4e3b-aaf9-33a91efe7039", "comment": "Malware payload (Formbook)", "value": "675a63f975c572ce3c761688a8224e80bce90cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258555, "uuid": "5a6c61ec-57a3-4bb2-9fb0-a8ba6bed5b43", "comment": "Malware payload (Formbook)", "value": "2033c5d6bec6e95926c5dc3faa78e4ddcf69b75e209187948cf46970f479f8f769b36d2ba3dfa4e49a672b3066cc76bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258555, "uuid": "ac54b1c1-598f-4c41-b666-cfd12e3bb717", "value": "T12BC4234176FB8F75E8E98BF952F0DA1B873A53B46639F64F45BD82D85022300C012F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258555, "uuid": "98dfe1f1-64a2-4fb3-94f3-eeeccf275ce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258555, "uuid": "8e01a9bb-53ce-4733-ab55-e1b264adf2b0", "value": "12288:8ud04ufv0zINbr57FQ6gUNYitOrlrFpIrlO+A:Rd+f3BQ6gUGVlrgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693258555, "uuid": "e529c74f-38b0-4ef5-abdc-280b076f8842", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693258555, "uuid": "d75b8588-d4a1-470e-ac14-10883e7c9abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258555, "uuid": "a3506da4-a5ca-4fc9-a954-d0e31fabeba7", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.710.3447.5929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1326fdd1-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220847, "uuid": "f2b50a07-9000-461e-b4cc-2c03405d36f0", "comment": "Malware payload (Mirai)", "value": "1bf44a5d88962f1faed618b625ff6596", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220847, "uuid": "105f0af4-92e5-45cd-bc63-7aca17b6de72", "comment": "Malware payload (Mirai)", "value": "3c6827796ba2a477be36c20d8aacbc492aaaa284e174d61f4e077b717f5c8336", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220847, "uuid": "c458142e-e876-4030-bb7a-42e0e0659207", "comment": "Malware payload (Mirai)", "value": "783103b317ea6df2b13e0018f9e1d7b58e40f63f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220847, "uuid": "29e3c6dc-9541-479a-9d81-7b7186368ee1", "comment": "Malware payload (Mirai)", "value": "b8ff6a4107f1f1ffb1dd20d9a137038b41937f0987c0cc1222f3767a2963440a736e208f3a24dfc23742334918ee39b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220847, "uuid": "47422569-a6d7-4ab5-a94b-7f091117a9e1", "value": "T1F3533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220847, "uuid": "7666086b-aed7-4f3e-84aa-642e036516bd", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozqyt:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220847, "uuid": "75353a5c-a620-4170-82a8-20c88b900731", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220847, "uuid": "ece583cb-b5cf-4175-88a9-02d0abc3a02b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220847, "uuid": "cef234f3-f826-4180-81a8-64e0208307ba", "value": "1bf44a5d88962f1faed618b625ff6596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81049e82-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209006, "uuid": "745b3d86-829e-4ead-9d1b-0fc7a46e27d3", "comment": "Malware payload (Mirai)", "value": "09d6444113c38cb4513a68700c209f2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209006, "uuid": "1e593da7-1bda-45df-8fee-eee2aebe11ca", "comment": "Malware payload (Mirai)", "value": "3cb9083e7b3709581c151afb9dccadcb430cf4d31e9d8915ba71f0b040f1e4ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209006, "uuid": "98961330-25a2-4cff-af59-9e9064e705d7", "comment": "Malware payload (Mirai)", "value": "9ffa9a9b4256fd55128b7e5e21c1e7967b89e759", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209006, "uuid": "48eac884-3e2a-4b15-81db-380b152b8786", "comment": "Malware payload (Mirai)", "value": "1316a2ee8019dfbd4eabec98b2e807ef9d98312052107b1bfdee14b56d5b84bdf3c558e343125259fe6f59a8c2178a06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209006, "uuid": "73fc1a1e-02bd-48f5-b168-680634f49a5c", "value": "T1C7633A92BC819A02CAD412B6FE5F519E331623D9D2EA7207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209006, "uuid": "b5f78203-a7cd-41d5-8826-caf391e2da59", "value": "1536:/WloK05nJ7xkC0ztNrB28kAEWwq04EVW84lx1RVvH:/WNY7635qQEfXzVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209006, "uuid": "2473f481-5abc-4ab6-b325-5fe6e93aadd7", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209006, "uuid": "3d2f0fc3-7e41-45c5-92d7-d91c2d61ef5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209006, "uuid": "91687e88-9886-413e-acb2-820533a42082", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0490f0cc-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229842, "uuid": "dfcf60e8-7c64-46ce-9e32-df2625b1e275", "comment": "Malware payload", "value": "488faf140b6aa79cc1a76461f452b14b", "object_relation": "md5", "Tag": [ { "name": "185-163-45-36", "colour": "#1E3965", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229842, "uuid": "0733ebc5-8877-4676-8274-aed9110ba70e", "comment": "Malware payload", "value": "3dc4f4c753d4be5645547efbfea509852414def402f6b96de910c80e5beca2da", "object_relation": "sha256", "Tag": [ { "name": "185-163-45-36", "colour": "#1E3965", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229842, "uuid": "12f4b268-706f-4a54-9ef4-dde6b75d4947", "comment": "Malware payload", "value": "8ab70d10bd3e0a6cf7694b698fcebfac6ee3b96c", "object_relation": "sha1", "Tag": [ { "name": "185-163-45-36", "colour": "#1E3965", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229842, "uuid": "6780f1a8-8f5f-4bba-8c9f-28b555c72a58", "comment": "Malware payload", "value": "ae1ff050730c77450823dcf7cf4c2c8a54955aa098eca8a5b2e628495d21087411eb225f044eb7f39d4e579286cbded0", "object_relation": "sha3-384", "Tag": [ { "name": "185-163-45-36", "colour": "#1E3965", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229842, "uuid": "9fddeff5-3fa8-4105-a90b-63f628b18481", "value": "T1B2F02802164BFCAE256BF2D67A7801D12BD34000F4487A326E48595F5E76C6A45DE8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229842, "uuid": "e9a3271a-6ea1-45be-9800-7666ef59b321", "value": "12:tcxS2hz7YU+Sj8ZGSGpvlnxOZ7+DP981E7GXoKIDWsC3CYnmSuH2n5:6I2hzEPI8ZapvlnxOoG1fXtIDvC1b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229842, "uuid": "e230ad3d-7033-4ce6-81cc-5e908854e812", "value": 620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229842, "uuid": "d0be237b-dae6-4238-b37d-7559bec8d9da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229842, "uuid": "3fc7ef44-5ec6-4aaf-98f1-4e3e232e757a", "value": "Client32 (4).ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4a1e19-4597-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693222873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222873, "uuid": "daefe854-e946-4257-8394-4ed6845aa0ec", "comment": "Malware payload (AgentTesla)", "value": "a14fdfead388774db050a3187e1cf0ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222873, "uuid": "7c858788-717b-406c-9444-8ffb725bb8f5", "comment": "Malware payload (AgentTesla)", "value": "3e44043c8532b70b247b753cc59ae1ae6eaf53c81927e71cf1d5468d808b9139", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222873, "uuid": "3402469f-a1bb-4e39-8a79-38884fa051e8", "comment": "Malware payload (AgentTesla)", "value": "3f2131e716b8111614b41dc0fb1d30423b272840", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222873, "uuid": "ff59093a-5d99-4a51-a002-f013b0614dbf", "comment": "Malware payload (AgentTesla)", "value": "0ddce25e828ddb2ad069bcd1d2540f751d378365a0c3382a3dcf96abcfafeee0fe58abc1829dac1a817462d4409e07a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222873, "uuid": "e5f6d396-dbd0-4a02-9045-5881e556dfdf", "value": "T12FA42314928B7217C0EAF6B2210DEC205024F5E41C6D34BEBD5C5887ABF2EAF8B57575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222873, "uuid": "c17bb232-3709-4239-af90-2d79050c3d20", "value": "6144:pYR8EZIWqb43QtOdzpVt2vQfXghZkh0Gz59tDYxce/CVUFOYgwrF9PY7hveqrwlU:a8AtgtOBtNfakh159tUce/Ts69PYpiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693222873, "uuid": "23d953e2-bdbb-4af0-ac9e-1c20b0fa1b2a", "value": 472761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693222873, "uuid": "9515b39d-2469-48fd-b433-ec62e4521031", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222873, "uuid": "7a6b44d7-db0e-479d-a496-8f7bbd8f8f7c", "value": "August updated SOA.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b872eb-45dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693252205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252205, "uuid": "ffd82f5a-2ae8-45f8-b767-e34667785a68", "comment": "Malware payload (Mirai)", "value": "27672267fcd1acd3379b981cd8ca0e98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252205, "uuid": "8c761b1c-7797-4b62-9086-4ab7a4f25fb5", "comment": "Malware payload (Mirai)", "value": "3ed703cc409092bacdf34cc1d8a12bb422f552106e8152ce9020f4efa7cc02fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252205, "uuid": "58c8b47c-bd4d-455e-a6b4-51bb4cfd9aad", "comment": "Malware payload (Mirai)", "value": "85cda9f556863fd9cd19015d2c4c66dde6eea980", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252205, "uuid": "a3c1b87a-8c43-4e70-8f12-7cf88eeb533b", "comment": "Malware payload (Mirai)", "value": "28f56d7d44994cd1872ab1c8d6feaa1e40e9d8498245057287c12c37a616ccd961e0bb1d55b18dfc2d735470bafa2902", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252205, "uuid": "92ce5f2c-5957-48b8-b8ac-e5f9e368761b", "value": "T10DC2E1E53E7B799BDE35003D7898CE329674E026C7ABA6539640920C20071BDB7328ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252205, "uuid": "32d2a579-072d-45a0-bf3a-d459a062175c", "value": "384:MG1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QwIS4w8EeRm:HMwoDZLFbBy6HQHRYfeAxdd8DH4L0ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693252205, "uuid": "b6348d64-1757-45a0-894e-c138adf8e315", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693252205, "uuid": "eab3531e-9841-4884-83e2-02e23e4a8bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252205, "uuid": "885d77fc-a06d-490f-97d5-ac8fb0b3be0f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1801cc3f-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693233311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233311, "uuid": "413973e5-0c16-49ad-8d8b-21aca32185df", "comment": "Malware payload", "value": "18fc2d46c5c937853e599e80e7c6afb1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233311, "uuid": "7712baa6-b995-454d-b11e-bb5bf418a7a5", "comment": "Malware payload", "value": "3f8496d9d21f1492cd3b019852accb97e3fa65b785a627d5f0f1e00484ec9c1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233311, "uuid": "aadec902-e736-4f84-8e5d-c45896ae44f4", "comment": "Malware payload", "value": "1b03a9871171dfe44e0ce16f1e1d36ccd12aeb39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233311, "uuid": "d516a806-c540-4ba0-8e4e-f6d6c771c406", "comment": "Malware payload", "value": "8dc119b4816c029347ea96b32fc60272cc84d156b20887d6d304d5649d9932c5a8f64400ea3f84493b10bc7b65bbef8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233311, "uuid": "734591cd-0a9e-47dc-9dd7-98fec1c21691", "value": "T190836A4076E28071E5BE493624B4D5A21F3E7911CEE19C6B2F960A3E4F301D1EE35E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233311, "uuid": "9f468c31-612a-4e08-a732-58278df3ef5c", "value": "d8c268b35825adf780974f5fe02ef180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233311, "uuid": "7d5b35a7-9bb1-48c4-ab29-715b553e8f3b", "value": "1536:ixZ7AlhTiqyH5ILmha8uMSPPacpibuVH5sWzcdkRFjTtBgXdgtcu:ij8uqyZILmXuMSPPaW2kfv/8dgtcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233311, "uuid": "02fccd7f-5a45-4eb9-b3c9-0fc503294b0d", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233311, "uuid": "6fcaefea-16a5-473c-8712-f563eed9844f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233311, "uuid": "34202b9f-2c0b-455f-b913-8d238670f0cb", "value": "SecuriteInfo.com.Win32.PWSX-gen.24662.11445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d06a1d9-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "c53c0acd-b51c-41e3-8869-3f109c910412", "comment": "Malware payload (Mirai)", "value": "f5a9272e7d9b98743cc0c76e60219c90", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "81162704-66e7-47bf-b030-5696a8b5226f", "comment": "Malware payload (Mirai)", "value": "40916e9835b33421b841298a93293e256628b4149517465870bf02f2f994ed65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "068815f7-ff45-42b1-a85e-9b7ead33a670", "comment": "Malware payload (Mirai)", "value": "5dc20d0110796a3bfb3cb83dd906abeda64ac596", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "22dc7161-dae9-47b5-90ee-07048246ed81", "comment": "Malware payload (Mirai)", "value": "5b4fe8b0a9c4cd32725e807fd6beb288b74141e1f87f2df36d527339129dbc2e7d3cc525d0244ba0413b4a4717c0fd1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234205, "uuid": "c5f8dd1a-38fa-499d-bead-4a25f04aa540", "value": "T149330262676D29E152B08777FC33FC5AA69C1BF8487730962CF05A1977C18024BF2786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234205, "uuid": "54ece44b-e4e4-463c-9b20-66684dc4ea56", "value": "1536:99O/ZMAXIxNUk04LcPqF1aBexo4opKZbW:99O/ZNKyELGqFUFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234205, "uuid": "88688375-2e00-4cf5-829a-d1cafa59cf50", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234205, "uuid": "6781e2cd-ab5a-4a02-80f0-696d17a29b48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234205, "uuid": "b1ae83eb-5388-4ee4-a044-70dd4547bd37", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0761cefa-4599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693223405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223405, "uuid": "a844348f-803d-460d-a34d-82c0a5a451a5", "comment": "Malware payload (Mirai)", "value": "44707bc597ef2def58d7d2eaadfc7993", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223405, "uuid": "90f3c3fd-c861-4bd9-9dc2-1ac062331e0f", "comment": "Malware payload (Mirai)", "value": "413afcf590768a73b24803fb72e2bd15f1c9301fd1cd5d1ecba09a2d1bee76e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223405, "uuid": "4b6482da-25b8-4179-93f7-8e63c030c9bf", "comment": "Malware payload (Mirai)", "value": "2b62485691f882df34fab9e1199ddb663552bbc2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223405, "uuid": "d7ba4e97-2926-4707-ae4c-af467ddac2c8", "comment": "Malware payload (Mirai)", "value": "78a71726a0f868b6e5892b961aa7c4431265df4510ac417768219822049142c0bd52e6b2119a9078b1dd06e505ca6178", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223405, "uuid": "aa6a5a40-271d-4c06-ae32-1531fc7fc7ef", "value": "T11A330262676E69E252B05737BC32AC16979C17F89877309A38F09A1977C18024EF27C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223405, "uuid": "1ff10e83-f518-4141-834d-3485e2349d68", "value": "1536:s9O/ZMAXIxNUk0PLcPqF1aBexo4opKZbo:s9O/ZNKyrLGqFUFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223405, "uuid": "38e3ff98-02ba-4e61-ac0a-421c57e14066", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223405, "uuid": "abef15bc-5b4f-419a-8887-08daf2b8f329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223405, "uuid": "b1e4151b-81f9-4757-8622-fa4977e079e2", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1af36a-45fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693266926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266926, "uuid": "84366b4f-fd85-4fc1-913b-064553dc6e5f", "comment": "Malware payload (Amadey)", "value": "0409b09bfb7c94fd22ff7d09f1e67c67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266926, "uuid": "7258fe2b-31fe-48ee-8a10-b2f35d39f5b5", "comment": "Malware payload (Amadey)", "value": "418e70dd57c4f7e10aecb70fa71f02ebbce59ab94174b5e73f48d66fb51a64a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266926, "uuid": "29f18023-19b5-45bc-b38d-d617834c0697", "comment": "Malware payload (Amadey)", "value": "0130f5640a4602728f83b7069bf8943a5e8ec16d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266926, "uuid": "87125d80-efec-40fe-9ff1-51624bc1b012", "comment": "Malware payload (Amadey)", "value": "1116b0a9308cfc5095422207ea86b71bbd2936cfccd6f0dfeb8cd8d1eb9462bc5511cee171e3134be062ba57f7053d13", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266926, "uuid": "8f7d91b1-c292-4615-a5f2-3cac6244945d", "value": "T13C052392BFD9D033DDB057B098FA27971D39BCA18E75835B2209980B5CB1AC5743272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266926, "uuid": "a43e4c4c-0e18-422f-a126-a7f958b277b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266926, "uuid": "8b063939-ee0c-44a5-8f7a-3602db675c9c", "value": "24576:Gy+4JKORBDIreMzwc/v+ebeXyEEgAvEN:V+4YjBzwqbeXREJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266926, "uuid": "e93f9ebf-b528-4f9b-a65c-c5f78ef5c54b", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266926, "uuid": "e4a89f0e-24b8-4282-bb66-5c78d1f8aa43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266926, "uuid": "28d10ed2-31b9-4d7e-b0c3-acd5adcf713e", "value": "0409b09bfb7c94fd22ff7d09f1e67c67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f76e59b-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238182, "uuid": "195f7dd3-7481-4661-bdcf-e0bdb2f628ee", "comment": "Malware payload (Mirai)", "value": "e9022616e00ee977531014686312d639", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238182, "uuid": "955b2317-9f11-4a91-9dff-fa54e4622de5", "comment": "Malware payload (Mirai)", "value": "41eb832d87dd8fa195283e6a9cf7c3ab3d29954fee2675373186045ab31b510c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238182, "uuid": "55f48947-71ea-4938-8940-14bbfe917472", "comment": "Malware payload (Mirai)", "value": "717e21e4bb2385912f76180572968f83bcf32725", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238182, "uuid": "5ce4b326-48a8-4839-8411-386ea1fb5c26", "comment": "Malware payload (Mirai)", "value": "4906fab66172b1dbc398db345560f37fb03be48aa97a406b4d563a11307810069a99119148f3f14a8269e59f46c8b1c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238182, "uuid": "858b2f6f-0903-47c1-b4ff-0b11ecb6da46", "value": "T102632955B9818B12D5C412BAFE1E018E3313177CE2DFB3269D24AB20778797B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238182, "uuid": "13c5ddb1-58ac-4cfa-98f4-3afca40c1234", "value": "1536:gwntZlDE0uBCePDnjUkabOLQbMVIiQALICbrb35bYym:/sC+nAkaPALICbrb351m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238182, "uuid": "2bcf0e5f-3131-4916-aa38-bef53f8196dc", "value": 67084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238182, "uuid": "d6c4f4ac-0de2-446d-b768-38f9504babb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238182, "uuid": "f9f78af0-b8f1-45e9-b35d-fa59187ccc9d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ee1aef-45e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693255804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255804, "uuid": "23f67cd4-ffec-4708-a62a-2abf9f2e807d", "comment": "Malware payload (Mirai)", "value": "15f6ae85dfe2746a6e574a176136202f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255804, "uuid": "3711d786-7310-44d2-bcbd-01c6cda5bcf7", "comment": "Malware payload (Mirai)", "value": "43239e4103e3aa663c28190b9701efcff0cd89532b13e92291d4ccadc0c77421", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255804, "uuid": "2a75b876-9cee-4d3e-af92-e0878e13a141", "comment": "Malware payload (Mirai)", "value": "a5773815d53943ed4e5bad469874f832c66e44e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255804, "uuid": "c00950f9-bfab-4d1d-a646-9588f72ee753", "comment": "Malware payload (Mirai)", "value": "84154f3364dd325ed565badde5f6c9ee7bf34ed25de314f0fe0f98546893a67cbc15b9f2d42f7f9dcb010fb92acde66f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255804, "uuid": "aac0d9bb-e4d0-471b-9481-1676eb7a2c3b", "value": "T1D5230271850B8EB125303C76EB95979376E12EB1C6673013C6280A386F79B231E4BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255804, "uuid": "7be3e5a3-6d23-44c6-b47c-2e9f03fd3ad7", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3Gb9q3UELbUXfi6nVMQHI4vcGpvS:DECFd+A6YHAxG6LRQZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693255804, "uuid": "e8caa07e-091f-4d65-b30e-4e910fde583c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693255804, "uuid": "378d007f-3f28-41ef-bbf8-a23823f4a3dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255804, "uuid": "72f9ba94-abb6-4bf1-aa86-9c065dd01fad", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae65aa2-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "81f5a8cb-98bf-4c00-9b61-d1925715b01e", "comment": "Malware payload", "value": "107819d3b33fec0b2f0736dbcabbf820", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "16dfdce9-3498-4954-9579-832ad7fff735", "comment": "Malware payload", "value": "45fa3909ecd8bab73e2ad9261f2168c3740becb9c588d4afb42588a5e03fcdbd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "8de17826-7714-4b75-a63b-9b6af4d00fc0", "comment": "Malware payload", "value": "7437dba09ed2c4a34b637fbc0244960207f58d95", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229907, "uuid": "eaaf9d81-6f22-4eb1-a44e-a66f19a4de72", "comment": "Malware payload", "value": "92e95f7f8ecdaa00af056ae77269f2b95c8a7e12be8157294148d28cd9fa00216c88d082df913ea8f55078c6b1a5c57d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229907, "uuid": "e1cb1b89-ae3b-4b7b-9071-b9dd969fad11", "value": "T101152340FEC80FDFC7202778215FEA190A8DFDAE6746B433E3D83186A274B95C059566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229907, "uuid": "66eef1a3-6788-49ca-a4a9-ef6ca8a8238a", "value": "24576:8b/qaVfYEiOiAX2dlTEWVgOG0TYtVfproU6M7qJFy:qCTEMAMrwdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229907, "uuid": "05334e23-6106-4046-878a-7100d44995cd", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229907, "uuid": "ef5c5fc1-fccb-4d60-a4be-ed7a93e389d1", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229907, "uuid": "4264cca7-8ec5-4826-8eee-05838f757b3b", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.2829.10850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab75bdbd-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229263, "uuid": "0b73bae4-a1d1-4b87-a5ba-a36fcf7175a7", "comment": "Malware payload (AgentTesla)", "value": "3797f60ef9fa73228b3c105a99ccfe8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229263, "uuid": "4bef1573-9461-4f96-8269-73111d27f5fa", "comment": "Malware payload (AgentTesla)", "value": "463c5534c07f97b15b3f18392fc551ca49e77189df414c15bba397389737d952", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229263, "uuid": "39dae1a4-2c8c-42c6-a434-2b7480e29f42", "comment": "Malware payload (AgentTesla)", "value": "f759e18e411e9212ce9f79a9b96491cc13b8067b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229263, "uuid": "74cf4d2f-219f-4d66-91fd-b4998dc83fe1", "comment": "Malware payload (AgentTesla)", "value": "2f0891be77b3a134ddd9095b843636dc8dab1b93154dfcac4b04efcb05ea84aa96169c95aa04f60b087488009a3dbca9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229263, "uuid": "d4d1b7e6-66b2-463e-a9f3-0d68940a183e", "value": "T1A9C4231C62416F62FA34240661B6F6C06044756FC9D13880CCD7EB5D576AA8ABF2CDFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229263, "uuid": "9ae7cbe7-b667-4789-9880-9c8dbd3f71c5", "value": "12288:TORYZheo85wTUfDZ/Lw3S4Vu3PFrgpNj77/7sqhw79IPdwonoh4iD:TORYZUo8sdu36B/4qc3Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229263, "uuid": "a39474e7-ec17-4517-858c-881483c6378f", "value": 585812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229263, "uuid": "4d703776-655f-4a28-ac2b-b548d23d8a78", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229263, "uuid": "3833e490-46d9-4efe-a923-a4a9a6f07991", "value": "INV_S1016628.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc17049-459f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226365, "uuid": "1e608e10-5e58-465d-a47d-ab12c4928be6", "comment": "Malware payload (Mirai)", "value": "63ecf597a6264ea447ef70c6a99fc206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226365, "uuid": "3bf057da-0ba7-4f84-ba12-cb59e0f6dea6", "comment": "Malware payload (Mirai)", "value": "4707edff70d7cd92dabbf9ae6320dad0e5e3e43d4f3f15b7afdc88c9b8ac7d97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226365, "uuid": "538261c0-902a-4249-b4e0-6917179b3355", "comment": "Malware payload (Mirai)", "value": "57542c6cc485ab6bd9856baabedd3112d2fe2a9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226365, "uuid": "46a1e92f-877e-446d-b44e-6e4332248615", "comment": "Malware payload (Mirai)", "value": "3996420baa01a4d3b1616b80de887e6e4e6824af842506bb5c7fdb985bc27c4836e3ba9e964c030e0f67bb0066313f10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226365, "uuid": "02b1a7c4-9c7c-422f-9742-2f1c0dbf285b", "value": "T1BCC2E140F041DE45DBFA29F13D50CADABBE46F1FAA628E8166A453C15B4C3B38305DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226365, "uuid": "40ea765e-0be5-4fb6-9da4-701129a48586", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7Pcg4uVcqgw09D:mam+AnKehPRa9az4u+qgw09D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226365, "uuid": "642159a1-bcd3-4e90-9311-b2992f6231b3", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226365, "uuid": "2bcb70a4-5a3d-45ff-a1fa-e51d8e5f0107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226365, "uuid": "b7ba4f8f-01b4-42ba-8e2c-107b6cd84f2c", "value": "63ecf597a6264ea447ef70c6a99fc206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8d09c6-45a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693230604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230604, "uuid": "2fa3626d-0117-415f-aaad-f9c6a664f30e", "comment": "Malware payload (Mirai)", "value": "d01412d92de11be9cd837106ba3bd8ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230604, "uuid": "249d4055-3141-40f3-9bcc-c208ca731321", "comment": "Malware payload (Mirai)", "value": "47539077b445aed52bf6c8b3fe8d0c2f692b1c74c27c39bcad38fa0c9ba18aa7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230604, "uuid": "197592d1-4b9c-4a14-bc86-38f7060162e6", "comment": "Malware payload (Mirai)", "value": "8b481be9b83be6b33875f78705aa9c2897505121", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230604, "uuid": "105293e9-16ea-4679-8392-469852148492", "comment": "Malware payload (Mirai)", "value": "e09d40986f4413a7581587ca512ae734498821657fd13c9bbc0a73cc4abe51191cd8c59d2e108f26ed1f982b5fe4ce32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230604, "uuid": "c80b010e-0baa-497c-bd40-e14b76c59329", "value": "T165E32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230604, "uuid": "784928a9-5491-49d6-bf95-88477a0a076a", "value": "3072:eJLce5p0pHdWSEaaHbz4NrA/Jt5IQ1FskXMk/M/983kY:eJLcHJEaaHbz4NU/JrHskXMcM/9IkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230604, "uuid": "f71b034f-f1cc-4398-b769-a7588ec12ed6", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230604, "uuid": "9dea8ed9-e658-48cb-be07-11e90227a3ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230604, "uuid": "5935fea9-7392-4c7a-b939-ac04b35624f5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48e8624-457f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212609, "uuid": "fa9f0c43-0e07-4819-a39d-6a5cb21e855c", "comment": "Malware payload (AgentTesla)", "value": "948d5e856b59df4d33a2c3cd5bc62466", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212609, "uuid": "242e2eb2-aa71-4227-b2fe-df658818dc13", "comment": "Malware payload (AgentTesla)", "value": "48173b1ba1c44cbd6cce2a43a6ed54c7300164c13a7ddf8b217c9ac08205d517", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212609, "uuid": "016bda17-eb31-4633-bec5-aafa1451354d", "comment": "Malware payload (AgentTesla)", "value": "3d1bbb6abc4f043730657b3f6e42e4ee23934ce4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212609, "uuid": "25e3760c-1555-47ec-99d5-5f33e5aa00ed", "comment": "Malware payload (AgentTesla)", "value": "6f8d7c37f7fa25aabc61d93a34fb008954ccb80676d922a43962ed4eaf3fd08aa22b4d1225fc81d2dd47b0b7f1db69da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212609, "uuid": "7eb811e2-9e18-4113-af52-c1955255ab25", "value": "T11C64F6272B84571FDB5D02F8D5524B0AD7B4D3CD62B7F7868BC2A6B46D43380B929283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212609, "uuid": "6d16e5ac-15d2-4a7b-a68b-59d568df9cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212609, "uuid": "d0306ee6-9477-486a-aa79-d7de5f218c9c", "value": "6144:gWgg+rY7saSd+sk4sP2ApQd/v1EVHY+hWF/oTj2Q+wu0QYYyvxy/m:wY70Iskjp6FEdvadKQYzxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212609, "uuid": "cd251879-3227-4f1f-9d1e-54d4fd0d5a6a", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212609, "uuid": "7e2e45dc-fb45-44fd-a2ad-b459394fdcfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212609, "uuid": "c1374510-8146-4b9f-9bf8-7161477f73a9", "value": "Halkbank_Ekstre_20230426_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efefdd6-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232142, "uuid": "22272890-3f23-4370-b25b-20c5999fd8a5", "comment": "Malware payload (Mirai)", "value": "4e13ca724373680825c944db2acc1964", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232142, "uuid": "12d77b58-eebf-4be9-b9e0-f8f0f4534fba", "comment": "Malware payload (Mirai)", "value": "488ea7b76ace1d259f254a317fcf874cdaf806625d85735e354ed83c08346a63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232142, "uuid": "8a808e5d-d48d-4227-9c42-eaa9476b117d", "comment": "Malware payload (Mirai)", "value": "a3d819a1681dc490ef6deb6ec05bec05e919f177", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232142, "uuid": "95c8e628-7c02-4856-83d6-e0827b135e07", "comment": "Malware payload (Mirai)", "value": "2b9265b219b190b9be45f60afe45ab59adc469817575be563004857c8de391da19aa187482987da2fc4c3c3084a0ab17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232142, "uuid": "0d9cc7b8-209d-4508-97d5-a5773c63a03b", "value": "T149C31945FC505B13C6D622B7FB5E428D7B2A1768D2EE32039D256F65378B86B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232142, "uuid": "ba51f8d3-1330-4af6-9521-19a55506ab33", "value": "1536:fJuEU8I2l+IKi1hAJeq9Y4V+WycTT3Z45M/HV1b9t0LulYMwywaFHHFibgTvOW3T:fJu2lZ91hd41H/3Z45gb969X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232142, "uuid": "738c383a-99f2-4346-8419-ccec8dc04f99", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232142, "uuid": "e8a2d9b6-9ed4-4862-830e-266783f67d5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232142, "uuid": "e82b1c91-d8fe-495f-9347-946c5eb70a9e", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8e1efc-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226687, "uuid": "d64bcbdc-60fc-412a-bc02-ea46dee15b24", "comment": "Malware payload (Mirai)", "value": "c1fc88b25638b36c7c9fde4a36d5c5dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226687, "uuid": "b1716bde-84be-40ee-9dff-2bf015f5183b", "comment": "Malware payload (Mirai)", "value": "49208d6282c40834f8868fea861a5a29a1094a3287aa3ded3d74f61dc6d26086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226687, "uuid": "2028ea4b-1a34-4a9f-bbc2-2985e9d2eece", "comment": "Malware payload (Mirai)", "value": "0d26888497f23d9e81060c2189c3ed5225d14ddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226687, "uuid": "a444f0f6-d08c-477f-b6a6-10f2f2ba3986", "comment": "Malware payload (Mirai)", "value": "77d61399a82f0859f605343b54be0ca9a366c7daa9e15899c2970d790d89e83811f511e5cc4173d7e9a6926fdca93f5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226687, "uuid": "e7b6d6bc-5a1d-488a-9036-900981f7e29e", "value": "T176D2D01CD95E7D05D6AD3EBE10CE4AB5394CB4C1635EBACE16168448B617E8BEC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226687, "uuid": "eeaff01c-82d7-41e0-9de6-678296dc58e5", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNXqJbUWU4:kbDs06t4BEub4sU/MbUXqY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226687, "uuid": "86cdb8d3-93bb-4189-a7a8-f986be9b9ef9", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226687, "uuid": "35959966-4fcb-4575-a5c1-9e0a14642974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226687, "uuid": "68c960c1-4cbf-4b95-8401-ff51286221a0", "value": "c1fc88b25638b36c7c9fde4a36d5c5dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1ef1b1-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232140, "uuid": "aaf1f30a-ff6f-4c36-b038-fde28bbed003", "comment": "Malware payload (Mirai)", "value": "6cd941f885f224996b8c04f620b23797", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232140, "uuid": "8da35d36-d248-4eed-9f84-abbf555eb9c0", "comment": "Malware payload (Mirai)", "value": "4978c514b4316e6c2c18dbaee147effb1d03d7cc001dc5785d0ecaa9e099fb22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232140, "uuid": "9796d294-ffaf-430b-aadf-4b9eb4a67aea", "comment": "Malware payload (Mirai)", "value": "f9ab618e3a56aa582e423374c478d2acb397b16b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232140, "uuid": "917fa473-40a0-4e3b-ae03-bc1d7dde3377", "comment": "Malware payload (Mirai)", "value": "0ec257bd73c6419347404c147b6d767c411c0b9a31fb8aa663cb61034cc3af17f2bfd67dd2f7e0c873d840b3e02e050e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232140, "uuid": "c3bd3d7d-6b33-4acf-ba89-87b492faed8d", "value": "T1A6F3D81A9F610FBBDCAFDD3706E9070239CCA41722A53B753674D528F54A90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232140, "uuid": "6c1dd5e2-ea4e-46a8-b2ac-def76a8c2ee1", "value": "3072:QlaBi7fe0OMz7w9AIr/BOhnY8uVYKdJWN:Q4gfmMQ6IrZOhYhVHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232140, "uuid": "a1496552-6846-40e4-9919-2dc6faecd831", "value": 166328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232140, "uuid": "a579fc94-c442-4502-9c7d-8d7a28515a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232140, "uuid": "56e7d51c-65b0-454d-a27d-6a5041299fea", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9c67c5-45b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693237323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237323, "uuid": "4a36b78a-bcfd-41df-bf0c-8ca13f4ae5db", "comment": "Malware payload", "value": "fe3062edc48243ccee7341257745de6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237323, "uuid": "dd2627af-4f8c-4961-89e1-5cf80731f825", "comment": "Malware payload", "value": "4ab916ae56d0b8d1974b9c70bbd18e0d8f78e8118f3cca206c8bbd7f3ca03ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237323, "uuid": "810843c5-9bc8-42ed-abf9-d42bf90c3359", "comment": "Malware payload", "value": "c3fe5b0484dc3bbd26d702648a7b198b7656d317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237323, "uuid": "42048f72-bf5e-4715-9544-2764d3a1ee8a", "comment": "Malware payload", "value": "e7227080089f4e4425597a729c9b5d5462f73efe6c1c6d1c215431565bb0a06f1e37bbb01fe56f3f3a4503e956572e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237323, "uuid": "793e0885-49c0-4d87-83ca-cd57807eab37", "value": "T1A7267D07FCD608EAC5FFF1308AA657127A7274A5437277D31F905A7A1A2ABD86D2D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237323, "uuid": "b3c9594c-d26b-4437-918b-35d79d5f60f6", "value": "98304:Ka++XUfiExAE+VPSfXonAn8+I1nbDkGyhWY:Ka++XUiExA+fXon08+skGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693237323, "uuid": "71afbca0-905e-4940-9a33-eed033c4aaba", "value": 4630150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693237323, "uuid": "10f0b5b6-5325-4112-813b-52d828acace3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237323, "uuid": "fdc09afc-7962-490e-9190-f7651a6f4dce", "value": "main", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e723c5-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693233312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233312, "uuid": "a9f22411-d10b-457d-9541-91bfe6dda740", "comment": "Malware payload", "value": "be361f6359d960ec5564594a62085e11", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233312, "uuid": "fdd9de45-be20-4c43-9dd4-d53ed69f3367", "comment": "Malware payload", "value": "4add41d16684def6f4e439f0ce73ca41e4cdc44b0db409ec7495ca282b5e251b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233312, "uuid": "d2a9e07e-9738-4ebf-abb4-873e66df1a41", "comment": "Malware payload", "value": "f2567fc900b8e840fc35d8426b6af8ee0f039224", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233312, "uuid": "edcd0cb4-86fa-4dea-af50-c6536840f908", "comment": "Malware payload", "value": "5f559b5f357d55788f33002ea25de88eee9c3452f4ed48c3927987ac9a11a04956090dfc9e0a2421340a368ba49db169", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233312, "uuid": "0f9e34c0-7de3-4a7a-ae5b-c4b9f1e19bea", "value": "T1A463D96DE34F0929DF52A67B875A4E4949FCB73DB38500B0396C873437AD82E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233312, "uuid": "34d4532c-7a83-40e4-ad9e-8fc4eaa44d57", "value": "1536:6wAlRBn2SOzq5e4vSQSv+L458xvcX0isRp37QoE8Ku59b1VXMC07o9tWK88lkmTr:6wAl+Swwe4vSQSvKCOEX0isrEoE8Ku5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233312, "uuid": "6934bfdf-e957-4df6-bb8e-7debfcd7dc76", "value": 68508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233312, "uuid": "51f38616-8ccd-4620-bcb4-7c9a20dbd080", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233312, "uuid": "3a54fe34-4e26-45f0-a76b-226f2aaef1d5", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.1816.19734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5e7a69-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238177, "uuid": "e787ca8f-0e8e-4e50-90e0-1adcad2200d1", "comment": "Malware payload (Mirai)", "value": "7dbf01d139a5284806c1e3976550a5a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238177, "uuid": "8deb63f3-6c87-4272-a30c-758915e583c2", "comment": "Malware payload (Mirai)", "value": "4b3f114f66d1161b41d79a2ae01efeecfeccd06a1e2c528e8e8c2a4574530f72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238177, "uuid": "5706c22c-b568-4ffa-b028-effe2fb5c0d8", "comment": "Malware payload (Mirai)", "value": "6dd83aba6459adcb4444abc80d4cbcf82223d41f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238177, "uuid": "3a931162-54f0-4c32-b05c-a50f6f99c9d5", "comment": "Malware payload (Mirai)", "value": "eacc23fac1c9568f0b0a6e85464bea252ce88482883a87e3497b6ab9967f69780833256a12dfdb598a8f9df20f7dc732", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238177, "uuid": "7cf43b48-e057-49ac-a39b-6389dbca3873", "value": "T1C8333981BD819A13C6D4127BFB5E028C372667ACE2DF73079D266F11378692F0E6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238177, "uuid": "a1abad49-37a7-4bec-9780-a6cf9edc8b2b", "value": "768:b2945blCuFmfznCrW3CWhNdrxXv8/N+l1iSOMnoI5tumLxkJCDSM1Ha5/I:C4b9FuzCUCWhNzEM1nn12mlkJCGM45/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238177, "uuid": "18cb3d18-4235-4616-b1aa-4c4ff65c825c", "value": 53268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238177, "uuid": "9d805808-c057-42b6-932f-60994f1c0788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238177, "uuid": "69829b03-ab09-4f38-acc6-6c86b97d05a9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc81ee2-459d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693225187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225187, "uuid": "6f2ad120-8115-4e52-9c74-6aa7a80e38e5", "comment": "Malware payload (AgentTesla)", "value": "fdd4f63aa3b4fa0c61ed0a8a6ec57776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225187, "uuid": "90020099-383e-423e-8c9d-814a8db968ce", "comment": "Malware payload (AgentTesla)", "value": "4c14c0cbf0d8fd1378ba85185a40e9786f7366789e066639923914d91ccf4810", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225187, "uuid": "d6cd101b-f718-4fe0-8f3b-0c2a995c4513", "comment": "Malware payload (AgentTesla)", "value": "b623e53f5f1f138817f6d359bee8552b4ce0c8f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225187, "uuid": "2ea77f29-8c5e-420a-8f92-03ba7addbe0a", "comment": "Malware payload (AgentTesla)", "value": "91e1579aaafb152602d28505060613c2a1cd354007aeec155ec6e33e2a5f9c07853bf5f1c516d1ee7309b855e4203040", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225187, "uuid": "9daf30f2-9951-46eb-bafc-452a8a5a34a8", "value": "T108B4237D2924744BB4C43BF46147A6D3B6B066FEF3B55713822B42A7E8AD993428F034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225187, "uuid": "47231576-ae50-452c-b486-86c8ce8d39b3", "value": "12288:j+x8pVj6DlZfo5xYG1ymCHT0UaMZfCG3fjsw:jhjMZfoyHOMVdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693225187, "uuid": "0d37bbf3-9697-404a-bcca-52d487511085", "value": 517576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693225187, "uuid": "79f0435a-d86a-4b37-acc6-78308d094196", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225187, "uuid": "f2601810-d6e5-4c56-9335-e71b46b85a5e", "value": "SALE ORDER_22-08-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c3c26f-457d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693211648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211648, "uuid": "761c629e-80ec-4c2a-b9c7-48a1d3038d24", "comment": "Malware payload", "value": "0dab92af6b93a96d0ddae2f36e81b695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211648, "uuid": "0fc3fd84-28fc-4d4f-bb95-53b1c2b7e921", "comment": "Malware payload", "value": "4ca1282b24f51561885d0bee3db9ed07af9695c88f4628b615f5bec2da940db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211648, "uuid": "704dea3f-1141-4efc-91c3-8e1c91df2f29", "comment": "Malware payload", "value": "390beef7190aed67ea3484a301481fe604ec8310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211648, "uuid": "915c0ac1-03f9-4fe7-8494-acf6eb5acdf7", "comment": "Malware payload", "value": "2756b888f2178bebe0d72ac04415be277460e1c9ab2006da2bef5086ada72d1ee229c27bd81922069f2ac703dd417f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211648, "uuid": "85733887-2412-4813-9f87-e6004ed367df", "value": "T1FB97333BE228752EC5BE067055B78350AD7BBA12A40B4C1F53F4498DDBBA9300E7FA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211648, "uuid": "9cd7083d-496e-4295-badd-943d68bb7cf6", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211648, "uuid": "f5456c28-c322-41f6-82f0-650fae651279", "value": "786432:mmPQppoD710NKpVNZwplAs2/uBgGJmqA8P1nCyoUdxiFzLE:xPQppypTTvCs/jGJmqtPZC7UdxMzLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211648, "uuid": "df7fb035-c7e8-4d6a-87c8-4e177e06490f", "value": 40468818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211648, "uuid": "19c94c3b-7063-4bf6-8c61-6fae3c76d94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211648, "uuid": "9090570c-c5a7-41f1-bb6a-c59bb9958ce3", "value": "0dab92af6b93a96d0ddae2f36e81b695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf4af67-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "0c7efd2a-6156-456c-8ff3-7f466fe498f7", "comment": "Malware payload (Mirai)", "value": "5b6df017bb51540f591289685064640b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "456bbbf8-44de-42d1-9bc5-56e154806383", "comment": "Malware payload (Mirai)", "value": "4cfe6226fb317364dcb6c68f116fefacbff0ff2eb54f980422055627e6ab884a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "d84852cd-3345-444c-b19d-10f61ea726a6", "comment": "Malware payload (Mirai)", "value": "02bbeda00a382951cc2f6122fab31f60299af444", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234203, "uuid": "d21a8f2e-8368-4b73-a38d-da46950ad45e", "comment": "Malware payload (Mirai)", "value": "94f10a33f2fd46aa4ac848b087e2b6d0934ff197165518db4cc03cf9a653d18c3b67135a282c53bfdcd78e11024b889f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234203, "uuid": "ce7d9d5f-46ae-43bc-9249-3e432e7b4404", "value": "T18DC2E1F63E777DABDE3501393499DE3382B5E012D79EA653A240824820171BCBB329DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234203, "uuid": "75e76956-c03d-4169-8211-b6a189fd894c", "value": "768:HMwoDZLFbBy6HQHRYfeAxdd8+px5wex0NQ:HolcYfe6KVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234203, "uuid": "c332666b-1ec4-4f76-839d-99aa67d765ed", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234203, "uuid": "f1efbba2-d1d9-481d-bf06-38a8be902c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234203, "uuid": "071e8b94-a65c-46c5-b756-ad924c4efcd7", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7e8caa-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693214150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214150, "uuid": "928f79df-e156-4c65-9e44-444ef19a2ec6", "comment": "Malware payload", "value": "a7142d61c7088b8d8f09ecc52f743cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214150, "uuid": "9aa5930e-3e24-422d-9cb1-401749abd0e0", "comment": "Malware payload", "value": "4d030ee3c9982e4a88e105dc0334022604defc69a55eec329089e8366d0c3b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214150, "uuid": "f69da3d7-7e2b-406d-951d-e00a1103356f", "comment": "Malware payload", "value": "18a72c499922763ed2eff29f533af0181206428e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214150, "uuid": "b18f03d8-ce5f-497c-b885-34457c21d577", "comment": "Malware payload", "value": "ef163534146f1ec1fe4215d7bfed1748dff74afbf2b6234c8bd67604dbfd68ed18e51ca5a1b69ee1a63aa29887a88d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214150, "uuid": "99f63620-bcc7-4330-a9c0-540ffdfe90a5", "value": "T1D4B5DF0BBA4F8DE1D3467776C59F040C0BAADB853627D73F798E235625037BA9A09207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214150, "uuid": "3cd668a1-fbc3-4509-8665-99c50104a326", "value": "49152:ZZvrmWKGDNB7G87UOZ0rFiNkSoVm+/2B72Ut:ZZRNlUOyr1Su/RUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214150, "uuid": "5b5dfa10-2012-4eec-b52f-f7770a5c6324", "value": 2381355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214150, "uuid": "321de0f7-256d-47cd-ab25-5ba92ba676d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214150, "uuid": "27619353-9506-4feb-83af-ed5839014300", "value": "a7142d61c7088b8d8f09ecc52f743cb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c3c77b-457e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693211908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211908, "uuid": "189b5fcc-8d93-4aef-97f4-185a6a0984cb", "comment": "Malware payload (Loki)", "value": "6641270ecc5f202b04fc01cbcd12c38a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211908, "uuid": "9bcdbbe0-ad8f-48e5-9b32-fce3d4f490da", "comment": "Malware payload (Loki)", "value": "4d24764525d1b740135f5d2cdff2fab3c065224a306992ebc6124bf7f007ed6a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211908, "uuid": "bb05bcc8-0143-4e3e-a665-9242a7244757", "comment": "Malware payload (Loki)", "value": "966ce8645329a52bdc5ae3e3bff53399df344146", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211908, "uuid": "aa4be70f-12a8-4220-bc80-8c25c6bdccd0", "comment": "Malware payload (Loki)", "value": "d061360b43f4bce77170d47587a2771a5a9ec80025deef1bf2e658ece9f6d0aa5aa42d1eea5c2778bfa0163e39b8a5b7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211908, "uuid": "74e23602-265d-4cc7-97ce-39ac56f0a686", "value": "T16493126DAF85237F6B3B32D84C4F0360DC8293134248CE6A6ED11B51B66DB5B4AC6265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211908, "uuid": "2ef2649d-a1c3-4cdb-933c-c75ffe469082", "value": "1536:WNoryYyTW+FaTD2kwzqYk/kkwbLbB2By0ZPnjY+bRmUm8VeSs5gtwtkJ:GyyYE+TD2kwzS/kkwbv0zZvjTNer5g2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211908, "uuid": "2f6a0c68-1a4e-447b-aa51-8350373a8925", "value": 94476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211908, "uuid": "440d688e-20dd-4a34-9f29-028017eda708", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211908, "uuid": "1b5b924d-34b1-455a-87f4-54b5d926fe3f", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b0807f-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183699, "uuid": "234ebe47-781d-4b93-bfc3-31fd219dd0fd", "comment": "Malware payload (Mirai)", "value": "4f6c82757370e8bafe5aef8e2eb2dc5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183699, "uuid": "e03e8d76-0d93-4d2b-b31c-6d9a2fa2663e", "comment": "Malware payload (Mirai)", "value": "4d2fc7afbe44b3039de98d445c2fd69c34b48c2a664ac1ee618ce53902478746", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183699, "uuid": "b501d83f-b173-4017-adae-3745f460a324", "comment": "Malware payload (Mirai)", "value": "5391444d2c55c08187b2b15359cbfd5e10362797", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183699, "uuid": "df28b8d3-55d3-487f-97a5-fcc55a502db7", "comment": "Malware payload (Mirai)", "value": "6faaad56511801da86c9f7504def983b19658b1cfdca02945ec81eba5b64b4bbeadb9b457d390156fdd4bab55e7768fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183699, "uuid": "b9c5bebb-4469-420e-99d1-77608a138d4d", "value": "T11AD2E02CD95D7D05CA6D3E7950CE56B5394CB0C1635EE6CE1B238448FA2BA8BFC070A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183699, "uuid": "9129a4b6-8212-4b18-8da9-66d1cbe8c921", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNeJbKWUe:DbDs06t4BEub4sU/MbUe+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183699, "uuid": "e965d5d8-30dd-46cb-9e4f-a4acaef4b623", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183699, "uuid": "18d2fb19-34f1-4db0-b6c3-9a6077797561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183699, "uuid": "76e2d4e5-f5f8-47fc-a43e-2951a17c68ae", "value": "4f6c82757370e8bafe5aef8e2eb2dc5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b6b83b-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693226492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226492, "uuid": "fc0b799b-ae21-40a3-94b3-1f74e943bba2", "comment": "Malware payload (AgentTesla)", "value": "baf1a744d05a824aba1e02acc0fc321d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226492, "uuid": "578b21c3-71df-4532-baf9-2170c41f0e85", "comment": "Malware payload (AgentTesla)", "value": "4d7b3859c1db7ce772df1e8aa86427a77268436d64aef82d9da0ba751890b22d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226492, "uuid": "5bc7146f-6db6-46aa-a393-df619c6cca68", "comment": "Malware payload (AgentTesla)", "value": "8e5e68bc71f2988833e5d12c3e403f9c6788f587", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226492, "uuid": "cfdccece-5aa7-4494-ab7e-4401609cd754", "comment": "Malware payload (AgentTesla)", "value": "f4a57244db0d67e80094ad5f707653bff3ccfc17aa343f150b50b38deee732bc1309368fd8e0ac2d26d831573584c4c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226492, "uuid": "3d3476a8-d296-4037-8e52-137100d492f7", "value": "T11EB423372E3108D199DD53EDBC1972CA3A68D236BCC1AD78CD5C13396B6B89F11812A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226492, "uuid": "b85f0c7f-c541-4652-a689-ed15f92742bc", "value": "6144:qUNhVSyN32qsIHOqQccuScJcjv/edlmd8XE6kBhiAHVo+Tsng1BOdFvWR+9gJ1VI:q/y2RzuSAcj3HaXEiAKUm6Mdt9I05oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226492, "uuid": "3a92d055-3da9-45d9-953c-c65037d97772", "value": 508371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226492, "uuid": "99aa167a-a7f1-4113-99b7-8aa6b8fbb73b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226492, "uuid": "f0f2e362-8fec-40a0-8987-c646882835de", "value": "ORDEN DE VENTA_22-08-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b41a9d-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693214064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214064, "uuid": "bbbee03e-810d-4e3d-810a-9c2d165673f7", "comment": "Malware payload (Stealc)", "value": "11d0ae245437d69482a619ed9a9cce96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214064, "uuid": "9d86fc1e-0328-4260-be01-50f497ad3a2d", "comment": "Malware payload (Stealc)", "value": "4d95c08bbac739d7c01fca4d179abe72306aaa06959fce76ad18754b61ba0846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214064, "uuid": "92175a84-f9d0-4c39-9078-1c4be9e10e66", "comment": "Malware payload (Stealc)", "value": "5660b410c571ac2b67833b8b63ed59fbdfdfb7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214064, "uuid": "9d778548-ab88-41ea-ae58-22b72bf8ac2a", "comment": "Malware payload (Stealc)", "value": "d77d385ad0bb546d48ee50c28804da0b7cfadc5fe64a707adbbb6555946079d0e01041a5f5a065dd4d356eedbd414a21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214064, "uuid": "370a6930-c03e-49e6-aeea-d89de97db49d", "value": "T18F54CFD13E92D472C4874D319834C6F4E97AB8728A999A473358FF7F3C71391A6A2311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214064, "uuid": "833f9e00-afc8-4e79-af14-074a78e87fc5", "value": "c3cfc3ae364145c34d2985bd43d1d7c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214064, "uuid": "40dbcbc7-aa47-441a-9447-e9ca6d35d92a", "value": "3072:3/X1m6axFrL4yRjNZkN3EYCLRROUWqv1AoVQCKmGZ+jDwT/d5:/1haFrL4yD+NUZRO5bSwTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214064, "uuid": "ead6cd0d-7bac-4381-8833-b019e33208d0", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214064, "uuid": "d752090d-8754-4b60-9a5b-d8197eefdf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214064, "uuid": "6cdc516d-41e1-455c-a169-e8973d3341c3", "value": "11d0ae245437d69482a619ed9a9cce96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ac73e3-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226668, "uuid": "252ff072-f62d-4a7c-8997-bbaf58d41e10", "comment": "Malware payload (Mirai)", "value": "ccb9f3cf87364c3916055c790019163a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226668, "uuid": "82618f12-1a0d-48ad-9a83-ffa189d23ad4", "comment": "Malware payload (Mirai)", "value": "4e4166470cc1301cc443d3bd5c627cf87c858da0dda7fb71502bfe42f45a7a39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226668, "uuid": "fe098535-9270-464d-ae77-e9b89c195db4", "comment": "Malware payload (Mirai)", "value": "5c84dfb01269e4d59bb1afb5d2303c1c0c02d52b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226668, "uuid": "a8e3a620-27e7-4245-970d-6b640afce451", "comment": "Malware payload (Mirai)", "value": "8c0c77530cca6ee7208d674dcd48428e8391fae97a6d9fab50531dcbc7a7650c2fc04c679f609fdb6ee8fb47f9522c84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226668, "uuid": "cf354e3b-7872-43f9-aeab-cedc23743767", "value": "T112B2D1A48BA06707C1B0B479A67CCF925A3B19F4C5F63926162093EC8AC115633FC9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226668, "uuid": "0fa90474-1b6a-43c8-b4d2-e3ed392691a2", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BEfGvLhymdGUop5hu7k:4GaKQFH0rs3zWoDDRsjt7LB9U+BIGTs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226668, "uuid": "b901efde-d521-4f2a-8a46-513d889c4d4c", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226668, "uuid": "431d813f-d4e6-425a-b965-daf72769a345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226668, "uuid": "edda6366-c447-4f95-bb03-65f8102d85f5", "value": "ccb9f3cf87364c3916055c790019163a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c61fda-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228261, "uuid": "daf3af2f-3315-4111-9053-042d821b6cbc", "comment": "Malware payload (AgentTesla)", "value": "57a1c7e3f60443e3b4dda849c99ece03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228261, "uuid": "c8558eed-3b5a-47b5-b104-64d6cae22c83", "comment": "Malware payload (AgentTesla)", "value": "4f3638af8c606225a59f687a938c5d30c098e11195225c2204c42646fec9024f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228261, "uuid": "01e71182-3681-42da-ac12-e8d3629975b3", "comment": "Malware payload (AgentTesla)", "value": "f4b3bbd76c5462ff1ac02eda09e8c38571e89132", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228261, "uuid": "abd61677-e3da-4a53-aed2-d4b1fa747ff9", "comment": "Malware payload (AgentTesla)", "value": "2d9b600b290eed48b38ddf4a378b5622908ceba64a3bd1160610156880cd67ee7957a3028428ed746c78a8576b5c3e8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228261, "uuid": "110757a8-3d2b-41da-a0c7-6db82043ec91", "value": "T136D43384741D7B01B2161693D98E0B589FCBBDBBDBA079858128B3C9C78C005BBEDA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228261, "uuid": "e09aa592-bad4-48c8-9e18-0d0a40558558", "value": "12288:4zfo/ZlBwdz3uP/wpcAMhvuBXDM3N0Dp5F14MOo1sfoLzyd:4zfGzidDuP/mcAMh2BXhF14P5myd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228261, "uuid": "981c4e94-e4c4-4ab7-aeb9-a0abbe078557", "value": 609476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228261, "uuid": "a772d03a-bf35-4857-82de-7b9cb08d9808", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228261, "uuid": "7b7a974a-e37f-43c2-b9ce-9e32c77bd9c5", "value": "PROFORMA INVOICE.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64408abb-457f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693212394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212394, "uuid": "6ab05575-26b4-4c21-a685-efb97b55d28d", "comment": "Malware payload", "value": "ce49a4c303e62093eccaead6a720db7f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212394, "uuid": "7bf3ffda-eef0-474a-802c-bca953c7e197", "comment": "Malware payload", "value": "4fbb9ccac278b395364fdf761de4a705b8a425634d517ed163613e0be6c42ee1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212394, "uuid": "53425ecf-db7f-46ec-9ba7-1e627b60a7ad", "comment": "Malware payload", "value": "a2f7834ec20f7b3c6ba7daaf93c2a6230eb1581b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212394, "uuid": "8c03e650-b1d2-4337-8265-9e240028d0de", "comment": "Malware payload", "value": "aae6a0b8dd9f2f0523db1fa591a1e80220b736b3cb4f5bfc521a06bfc1c2f2d71003294924c86cc1ef6181d3e62fe445", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212394, "uuid": "2a600619-7e2a-411e-93f9-bb51794d97f3", "value": "T14E64991065CFA48CF1723F931BDCB2DA4FABF7E65B2A419D7504030B5A66E44CE94A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212394, "uuid": "0aae358c-e888-4ae7-94b4-ba0485f5b549", "value": "3072:XM7k0Q43bjjVjy80M7kaM7kjSlSqSESeS6M7kpSQSQSQSQSDUgWgWXdSgSASdS9t:w1jjVjy8bamnUgWgWXItgnJpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212394, "uuid": "8a5c871e-5218-4440-89fe-409f072cc22c", "value": 317356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212394, "uuid": "8fab819f-a848-49ed-b6bc-c7d725ef2c5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212394, "uuid": "e840426b-5ee1-4150-8442-81d2ce81af42", "value": "Data Sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d2c54d-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266400, "uuid": "fc41fff6-7b21-4cf7-8dc4-11980a2c2512", "comment": "Malware payload (Mirai)", "value": "172f99e790ee87bf1b9ac6409fb0c95d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266400, "uuid": "72752fbe-aad1-4972-ad78-70c1db33c1c5", "comment": "Malware payload (Mirai)", "value": "51f466c360450fe9a31b3c1a0ca9bbc6182d03bd3e40be15818b141de6fb6e10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266400, "uuid": "ea6ce5f3-7c74-4748-b302-2f6de84756e4", "comment": "Malware payload (Mirai)", "value": "3ce7b013f376c9e6e39b5ec3c478ae3e222c6892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266400, "uuid": "0735c2a3-a853-4787-b42b-4b3071c3cbd6", "comment": "Malware payload (Mirai)", "value": "19a928cfd7933e522ccb39ee64ce8e90ef755f406f2abd9d288469347ccba2bd7c0423407bc6d99f7162b8ff58cd8c3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266400, "uuid": "cfa99844-691f-4f0e-b9c2-e2a38004dfe4", "value": "T132D34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266400, "uuid": "b86727a7-1131-42e8-8dd8-8ac7d1f31c47", "value": "3072:BxioDMQI5nrDaO4nt3qZg2IWu6b4JX7LkDM/98PmPw/t93:DioDtI5rent3qZgPWjWX74DM/9smPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266400, "uuid": "668adbb6-2c8c-46d2-9cd6-54ebba7a50d4", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266400, "uuid": "3b847cae-cd9d-41b2-bcb4-e244312e419c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266400, "uuid": "d36f949d-7f6e-4b64-a31b-548bfdcbdf9a", "value": "172f99e790ee87bf1b9ac6409fb0c95d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43031be-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235371, "uuid": "9ee624c5-6419-4003-894d-29ae5ebabec3", "comment": "Malware payload (Mirai)", "value": "f00b6e66f162974e61dae3c6b69dbe10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235371, "uuid": "4f11afe3-b23f-4645-980e-f0717e447dcb", "comment": "Malware payload (Mirai)", "value": "52eca48eb8332ff2f20434a2dc4131108f0563b18c6c247fd40377542f076613", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235371, "uuid": "6ea50c5d-37ee-489a-9247-edbafbd74b07", "comment": "Malware payload (Mirai)", "value": "52e87e5ffc15aafbce5d26d0e276c3bb059f5d44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235371, "uuid": "ab3a3c61-cd2e-482d-9636-a3d65f80f710", "comment": "Malware payload (Mirai)", "value": "649c0174db92d1646f6751e42619965c824261a99b63cce0b16c5a57ca495c1589a3a7d7ba02d7c4c558ba1b82dc3607", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235371, "uuid": "1e3fbec2-298f-4427-987a-3220afba2107", "value": "T154D2E18C76D363F68C8DCA7EB65E003A30E974E9B7B2A323B305D4534766140E695E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235371, "uuid": "8128f31b-f375-41d4-a358-523ed1da85d2", "value": "384:MJd/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKjsLHLWNy8:+lxKd2FLPxEnspd6IHE4RlY990+s38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235371, "uuid": "f5f0ce2e-6e5d-483b-96a8-525950332f9f", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235371, "uuid": "72ecaf7c-d43e-4823-b6d0-347e79593dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235371, "uuid": "2a1d1290-2c06-42b1-b962-199d25ad6f31", "value": "f00b6e66f162974e61dae3c6b69dbe10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5261e76d-4579-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693209787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209787, "uuid": "da63f9e4-c085-4acc-b7c0-f8f04baa7f85", "comment": "Malware payload (Loki)", "value": "9a59f394ebf6fe13599a158ed7ee3f03", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209787, "uuid": "7c985d8c-55b7-4d95-a4f8-d472a57ac03e", "comment": "Malware payload (Loki)", "value": "5383e2edfe184ea205cdfbf8e0bdc312e0608c03406e015566e339995b9cf48b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209787, "uuid": "83ed9138-4bd6-46ae-a1fb-c7b18af51562", "comment": "Malware payload (Loki)", "value": "395254a5c86757b0bf70b34d0ba4d93cb34bd71b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209787, "uuid": "07531672-d5af-4a2f-b4ee-cc5d550292a4", "comment": "Malware payload (Loki)", "value": "1165a5b2b49c5030f6989ec9be716bea91e44bd861092f5c71686a937827c1901d74cab4c8663f071be6fcc7d1c30a25", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209787, "uuid": "49cd5ce2-9047-46a4-a7e0-263cc89e4f01", "value": "T1FD2302E39FC24E445CCBC5F7C4DFA324C56BA2DF721021872A4A095BE4082A4F2FD664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209787, "uuid": "d440bca2-879d-4794-89cd-7833e7e20ee4", "value": "768:dM3bY4JGkP8o+LD+gp+Ug0J4n8W5wJqNjuW1ZH0NXm52KbZ/u5quSY4b5oi:mCiKLKgp+Ug0inT5NN90NXm5BZGYPb5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209787, "uuid": "2bc5e05a-1995-4e15-a252-7fec5bd1a5e2", "value": 46421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209787, "uuid": "8e3a1f12-f258-4493-9353-4d4fdff639fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209787, "uuid": "ae7f0d3b-ce4c-4465-8396-64a4142027a1", "value": "202308171304038951.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6387be-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212862, "uuid": "fd6f9056-f8d8-4bff-a374-c1a3674c41bd", "comment": "Malware payload (AgentTesla)", "value": "9e66e6414cf9660cf25de8032fc5135b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212862, "uuid": "5376566f-99b1-48f3-bd99-68d079fbbc46", "comment": "Malware payload (AgentTesla)", "value": "53e44ac1e55383e6d231d302d6abf040b409921b59b4450d68522bfd57cf8fe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212862, "uuid": "209635b7-2116-4894-a6ca-2c685c7c9e24", "comment": "Malware payload (AgentTesla)", "value": "194239f2ee8db0c86b940b60b6722b62ec02fee2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212862, "uuid": "590e64c2-d861-465e-8d30-f6025260aa2c", "comment": "Malware payload (AgentTesla)", "value": "fe33692a28c365ac2f05b94169daa3f5be42f47add2760917c33d8f2bdcbc79b7ae9ef1fcb8df08807bcea397d2337fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212862, "uuid": "ba808ed9-9850-4b3a-8b3c-fb2261b2d9dd", "value": "T177F423F098D2C96AF0EA165A57463DFD3BC8F64E5E1BA2DD01E17AAD7122CF01789013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212862, "uuid": "f84dfa9f-0418-4c25-bd44-36aa0b572117", "value": "12288:LcM5vDPeoBpl6m6SN95CoGi4jzNt2aMrYMCtYXkwFx+OL0HDFCUHqCkKmv:LRvDPJflf6S3kbNtCkMgYUw3BWFhkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212862, "uuid": "c1a73deb-2a03-456b-bf95-f0ed1c0d337e", "value": 757027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212862, "uuid": "823c672d-253f-47dc-bf72-86230f4b20fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212862, "uuid": "fc2b81c4-6d4b-414d-8af7-98fcb77d9028", "value": "new order_27223_MJ-RS.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fd0fe5-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229893, "uuid": "e0aba326-404d-4ca7-bbbf-bea4a1248d44", "comment": "Malware payload", "value": "dfa3f8cbec6876eecd7e992182e5e670", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229893, "uuid": "0522bc81-b617-4a03-84fc-a711093dfc30", "comment": "Malware payload", "value": "5408a39a02e1fc04bc75fc2aca0e840f72e5520dbbaf0761955ee68f7279dc30", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229893, "uuid": "07654480-524c-4af2-8529-5a511db698b5", "comment": "Malware payload", "value": "8f570e33d17e92e320a4acd19a9b18ffa6d101d8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229893, "uuid": "711f5afe-faea-4e13-8cf5-5769abd392a8", "comment": "Malware payload", "value": "349f21f4be8f67b729a425b5ec3562fc9c830a4cc51d6b0aa68b0d6c7ee50fe8da1993ea72268901cf2ab9749da8b95f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229893, "uuid": "57738094-7044-4457-8c4c-1dadf6f6acb5", "value": "T10763B56EE34F0919DF56927B434B5A4A05FCB73EB28140A138AC977437EDC2E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229893, "uuid": "d9075a9f-b896-4777-ab24-eccd29573c23", "value": "1536:iwAlRu2/pL8szGQWoYFs+BMIejI582TPc5d8JZHw+LYD/IOg2dcIRq4bKIZPTQVm:iwAlMw58sihluEM/jI5vT0z87w+e5tyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229893, "uuid": "7fcc9abc-96f0-4d95-9fe1-2e5acf146d26", "value": 71230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229893, "uuid": "4534c7bb-f67b-43a0-871c-557ef5778505", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229893, "uuid": "f64a49da-967b-4997-a6a7-9bdcc2c651fa", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.18498.30520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b0e34a-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1693223021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223021, "uuid": "2a1942bc-9b4d-428a-95e8-9fc1b12689da", "comment": "Malware payload (DBatLoader)", "value": "4d85bbcec832b4c50823e31bfe62b69d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223021, "uuid": "a04d9f8d-3a6e-4576-8b54-5a442136468c", "comment": "Malware payload (DBatLoader)", "value": "5417754e28989e0904f64192ce4af8f6fc528badffc2d59eff2a0b1bb0eb3c4d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223021, "uuid": "01c187f0-9c02-4753-a502-1a6d741d2715", "comment": "Malware payload (DBatLoader)", "value": "deb406fd7adfc3a64d375f4101fc8426ebc358bf", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223021, "uuid": "6747ee35-3ada-4488-a449-8b84cf5f955e", "comment": "Malware payload (DBatLoader)", "value": "6d26871f0a4501e52ee3a233dd78808857da8518740eec80b3de1d30c7d3109a1d17e8e609aad9077588da85f0356805", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223021, "uuid": "745a0784-89d7-417f-a5cc-78eab2d2bb3c", "value": "T13C65E155F2D341B3C1673934C8AB679AD8587E303E2CA40EA6D43E58CE763913D2A277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223021, "uuid": "841e32d9-c0eb-4df8-8221-dd43b3f13249", "value": "555fbb180099f7ea0a0860999295d5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223021, "uuid": "0eb56a9f-3999-48bf-a5bf-e26b63b23592", "value": "24576:/UWyWyLFqghcA0n9WUS20tFJTtf7BtdZhPKRKUW0YEq0UxX8OCTL5GJ:/UWX7WUktFJT5BtdZOWWqxxX8O0L5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223021, "uuid": "11f3598d-bd53-4b3c-a8ae-cad2356409bc", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223021, "uuid": "21ca8f9a-8afa-43fd-bc3d-080af4f4d90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223021, "uuid": "592d0b62-548f-462c-8459-da842a9973ed", "value": "SecuriteInfo.com.Trojan.DownLoader46.1078.5178.9716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35af1041-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693212745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212745, "uuid": "d5a598b4-7cf6-4021-9883-571d1e934f1d", "comment": "Malware payload (Formbook)", "value": "81fe64c486ffb3ed7bcf30b252bbf405", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212745, "uuid": "323020e4-ecad-4705-8b41-39aecdc7e1b2", "comment": "Malware payload (Formbook)", "value": "54b996853292264a07243297709446507d0a2ca2c02f2d210d13958cdbbbbb03", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212745, "uuid": "8a7847f5-fd5a-449c-93e9-1b9329057a25", "comment": "Malware payload (Formbook)", "value": "66333eaa49929e7d87c0e748bd6247634b690cd0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212745, "uuid": "36c0e426-43b6-4d56-8dfc-96e8246d7012", "comment": "Malware payload (Formbook)", "value": "1b06cd07a3617eaf9eeee2e520522a2fe3ecfcbe79da024a648091a96687bff677a071353045c0213e67be0d09e79d8d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212745, "uuid": "c5d3e456-1d36-400c-a10d-d256bddbd2fb", "value": "T108D40113BB25EFBED03E87F93C2495558661EE1EA820D71868A672D25C31B03847DF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212745, "uuid": "5aae9b64-9181-4a81-8f6f-fec22b2122fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212745, "uuid": "c8ada3b2-6b1d-4cc7-9319-91e714db808e", "value": "12288:82WJp09sbNg0sYkV4C4RBTQewHkUZhJDZt0T7niMQQu:82F9sbNg0sYkYRBTUkWt0vni2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212745, "uuid": "f9273164-961f-47ed-8fcf-56236f89f4bc", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212745, "uuid": "e943a23a-950a-49ed-b9ce-bbb0785f6fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212745, "uuid": "ccbed1fc-6f53-4942-b918-82ed71903a1e", "value": "COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68266261-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693209394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209394, "uuid": "95847ae9-b054-4c82-bdca-b6e56de7c204", "comment": "Malware payload (Formbook)", "value": "4508f021bca37d1727b1628d3c24b130", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209394, "uuid": "2fc862a2-cf87-4384-958f-7136dc837304", "comment": "Malware payload (Formbook)", "value": "566a9c22de6ae78594149eaeb3a37ed27111dbdd26e6016d9a01898a830b0b4f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209394, "uuid": "b111ff07-2180-43e0-8819-5f05ced1ceac", "comment": "Malware payload (Formbook)", "value": "28131359845755ba00653683798f41565ce74c54", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209394, "uuid": "570b5cec-9e43-46e0-a7fb-9ee9ebceb84f", "comment": "Malware payload (Formbook)", "value": "89593eaf1527034adfcb322b598da9374de67177534545be46544399f20526620fb5eac652f32779918a053484eaf296", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209394, "uuid": "57087476-ecf6-4a70-86bf-16eb3b8899ec", "value": "T1DD5423D992A21E35CD9339DEC8ECFAE7227A33E072477CA740F14E8650905F791842B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209394, "uuid": "671cd77d-53b3-4ce3-bda6-fa2de0dc29d6", "value": "6144:P5m1Dl49K84y5BhsBqhRbNC4WFI9M2AoHXPZlgwPF4L9ei4QrPv/wWaG:P0EPDRv6Iu2AghVPs9eWjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209394, "uuid": "e2af9773-3a82-46c0-a41d-b14e8f0a0460", "value": 279389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209394, "uuid": "0a8ca216-d36c-4e70-a377-7eee09801329", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209394, "uuid": "a9138504-d50f-46c9-800f-cdff4941be31", "value": "Order#2_W43550970351 pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273097e4-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693223028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223028, "uuid": "91c211bf-200a-43ae-8d83-d77ef35c68ab", "comment": "Malware payload (Formbook)", "value": "60f8db6075f833854e8067af85fcb23e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223028, "uuid": "c4f70974-907e-4b94-b3a3-a6a7c6520b80", "comment": "Malware payload (Formbook)", "value": "5765b61494d53c13cea4fa80a7aadd8bdf25d25690412ee3e809aaaca5c90924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223028, "uuid": "4f762a62-bd6f-476c-b967-797198a56700", "comment": "Malware payload (Formbook)", "value": "c17e0471228092898fdc86155542db2a0485ab19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223028, "uuid": "b5df20f2-365d-4cad-aed2-ee4adbe8097d", "comment": "Malware payload (Formbook)", "value": "d789c5238ae27cecf90ef7c86ed3ae151ffa23629f8545613027ca26f811c49bd5af1ac42af4a69e2f9ed297b9b2c9b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223028, "uuid": "04116308-7db0-4ba1-b5ab-0cb56be1bbf1", "value": "T10D250126F0B6AF06C67CC3F560A02F4463AB458E1176F1790DC668D6E2D97D20E52AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223028, "uuid": "01d3599f-8a3a-4e4a-b56c-66f634cdac5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223028, "uuid": "21d240ce-0e8d-4dda-a5db-4e52a68a8efa", "value": "24576:qSOlCe9qhJe2QjZAHsOZPgTL1sHW46Zv0YHsaCIXAM5ofT:8lCe9qhJVseQs2ncaCCvofT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223028, "uuid": "98c73cce-ad03-49cd-81a7-cbebb47a0dfd", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223028, "uuid": "524be78f-3927-4f96-9209-6874485de013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223028, "uuid": "dd94f33d-7c66-4409-b6c4-b0638ac048d4", "value": "SecuriteInfo.com.Trojan.PackedNET.2290.3654.4824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a4e630-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212856, "uuid": "7a54238f-9b71-4d9a-acdf-63a372ff178f", "comment": "Malware payload (AgentTesla)", "value": "0605344b0f6c71f28d23b1e09b1226dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212856, "uuid": "8fe880f7-eb52-45bb-a3fc-b66d967db6d2", "comment": "Malware payload (AgentTesla)", "value": "59015f14de08b5383e393f4f2d2f2694b84139d2c52f58d1607f94de020349e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212856, "uuid": "8f3c75b0-bcf3-4793-9921-0e3cd9eedcf7", "comment": "Malware payload (AgentTesla)", "value": "ff4b6802a50b09f6a79ba4b08416e594f2606548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212856, "uuid": "ea65ee63-3be0-441b-b124-d489965cb1cf", "comment": "Malware payload (AgentTesla)", "value": "d2931067a4a4f9d73e8a02bb24f6828f3d3d2f358840e6aace325f055fefbe6afc7fe5d51124685dc55ddb778cec7e10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212856, "uuid": "86e819bb-003e-4559-ad79-7010ead65412", "value": "T152E42329D3C36257BB4DE3F96DC482763939B110E7C90F038F57B89AA916EB52CC9610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212856, "uuid": "b92d6b4f-f5b9-44e1-af2f-c4f46813ba00", "value": "12288:WmnW9vXzjTaoq3nkH6UEU83q0BbACtyvddk98N9F9umR9qOZI4G9QGQ2FM8WxYr0:Z4XzjGoKneNEY4Vtsddk2IOm4G9QAM8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212856, "uuid": "02f82ddc-18be-4f78-92b6-c0e980f4d6a1", "value": 694139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212856, "uuid": "a46c6246-4271-419c-90d2-b875c6b21c8f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212856, "uuid": "f35f8295-cf1b-4b34-948f-719ab16e82f7", "value": "New Order #64717.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fea7a2c-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232143, "uuid": "ef2cef9a-a783-4cd3-ac6e-d0794fed2703", "comment": "Malware payload (Mirai)", "value": "44e31dc8964c7b6aa725b20171e42a4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232143, "uuid": "ef7ea512-f8fa-4c41-b0d3-2ea7e8c76684", "comment": "Malware payload (Mirai)", "value": "5a9086536d22bb43af77b40bc421f4dc5979384c2b765fb220abf169d8868fa8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232143, "uuid": "7037cfa7-b10b-4349-a4de-280e9ec0147c", "comment": "Malware payload (Mirai)", "value": "1e55e6dc0036d7609bfbbfd224e084ba84e593a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232143, "uuid": "d6a81fd1-f609-464a-8779-685d3596c496", "comment": "Malware payload (Mirai)", "value": "5ee4c7bde31576c97483181e1ca614aee0a6c3d54b0c5ce3b55bdde69dcc431e5bca97a9f8f27f2faf2b083a415d0334", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232143, "uuid": "a527a3ac-3246-46f8-9fad-111b7364a631", "value": "T1E3D30946F9819B12D5C111BAFE1E124E37131B38E2DE73129D246F647B8B8BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232143, "uuid": "93a4896d-2a50-42d1-9ddb-eee7862e73e8", "value": "1536:fpnCqGMzNoWTjkFuUlxykfxfrqXyPtvRlmIYBasr8lvigisF3TEE5fCpVEOE0m0H:/UCkZTqXeRwIYBasIF3TLJCpVWusU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232143, "uuid": "e722ff56-c3a5-412a-9f67-334f6e5500db", "value": 135580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232143, "uuid": "412fef61-45ec-4bfd-85f3-66074ae7f99d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232143, "uuid": "c7a12b20-8cdb-49d6-a4df-2309cf4e5408", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80896be3-45c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SpyNote)", "timestamp": 1693242935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242935, "uuid": "cb6c88ad-c69b-4dec-8b5d-4f8150a6bc4d", "comment": "Malware payload (SpyNote)", "value": "69f790a93c808659af655747399035a0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242935, "uuid": "76f9eec0-0568-45c7-b4fb-a446bd3b3d0b", "comment": "Malware payload (SpyNote)", "value": "5a9a8ec923000486ddb4ef1dd4412d1586334f126d0a7522022d6c8f3d1b9d42", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242935, "uuid": "5b9d98f5-4b02-4ba6-8f5d-aa2c687a64ab", "comment": "Malware payload (SpyNote)", "value": "eff4d52221788131654598c13f4ca4a465775c3d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242935, "uuid": "aaf0d944-d487-45a0-9d9e-af6cc8067a5a", "comment": "Malware payload (SpyNote)", "value": "101951ae2bcb221b5a858f184a63007cea274d59855c0cf636f10141e16ff26947e07246fc55fafba2306297cc3a34af", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242935, "uuid": "175d890b-4b10-4c6b-8b37-99968f26fb49", "value": "T12E76CF17B909CBC3C4AD93F57A274F982E671F1885426AEB40143BAE3F762D209E54DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242935, "uuid": "ffa57690-6a6b-4086-82a3-c4120e687e4e", "value": "49152:k24SbdN597BivimKmz6zdGGZQTOI1U1Yq10cgVo8T:k24MB1iqmKmz6zBWTo0tVo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693242935, "uuid": "af6df04f-1050-43b7-874a-9609c52da551", "value": 7708584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693242935, "uuid": "da1ed62a-d926-447f-8071-30fbef8f365b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242935, "uuid": "da48cb0b-b877-430f-9ce2-2ed98c61b3ea", "value": "mitao.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0eb8d0a-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228897, "uuid": "62ef50c3-d63a-4f4f-b739-54ace3d8c82e", "comment": "Malware payload (AgentTesla)", "value": "01ada8ece75e723850fd4796d691883e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228897, "uuid": "e979a045-8f57-49ab-927f-8db6dfbba4c7", "comment": "Malware payload (AgentTesla)", "value": "5ab2ba45e2190d5a88041adb9a7be32bebe71a846832bba6efde116531d087c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228897, "uuid": "fc3fb157-7b8d-43da-89a0-d36b89783aa0", "comment": "Malware payload (AgentTesla)", "value": "6a791249297ce7de40acdd9d48f46453cf76d495", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228897, "uuid": "ea1bc56c-9be2-4b3c-b4e5-97e36c2f3610", "comment": "Malware payload (AgentTesla)", "value": "6ede64168c6263bdba10331b0d794bae4f7dc11ad45168c95716b2c3783fe14c7c6722e2a57f71ebe49bbf425fa2a9cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228897, "uuid": "448c15a5-171a-4a88-b024-4abd6bf76215", "value": "T138F47BC1E2BADBD3E57A53F5205106000F767FDAB569D1544EA234EA36F4B402A83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228897, "uuid": "767de25d-8bf1-40e6-ba98-a9004eaa0589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228897, "uuid": "5e5a6360-de3a-4cac-bac0-31d421e6f573", "value": "12288:dTnJ2d1mbTdai5bMSjpjCr+OZxlJvpoGdNEu8HQeMLFdECbC:dTxdn5bfwr9RTwY/ECbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228897, "uuid": "d88f7980-e353-41c7-b1f1-3abc72946af7", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228897, "uuid": "521a589e-7a82-4095-9a81-b8345865d100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228897, "uuid": "2c085704-04d2-44c7-ab8f-520a66ecb02d", "value": "REMITTANCE DEPOSIT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734cf6ca-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212848, "uuid": "a46109ea-aa9b-4b48-a68b-3ef1c44cac00", "comment": "Malware payload (AgentTesla)", "value": "58863079381062d5603d3f8aa8299cbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212848, "uuid": "c628b8a2-1a9a-4924-9d7e-b528ea013cb9", "comment": "Malware payload (AgentTesla)", "value": "5db05dae2f61af8e60762ca1ff387cdb0fe491759169a08edfd126b353609f92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212848, "uuid": "2b77c7e8-93cd-4f2a-862a-f96642521c02", "comment": "Malware payload (AgentTesla)", "value": "f40ac177e22854422654248d9d3dd6800c55b3a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212848, "uuid": "0d106532-492b-4ad8-9346-2b3fa950cc55", "comment": "Malware payload (AgentTesla)", "value": "ba838b7f1fda1ca64e313229748f9100e47faa12b312df9e2381cf2aa70ef8f262653674459a5582fb8afbc8c2ef0fb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212848, "uuid": "d731cfe4-b66e-40b3-aa86-8a2dde891cba", "value": "T12CD4238CFEA36D44C73F4A7A16E47B74AF25F8A75DC62D76ACA1C584AAD33C004C5209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212848, "uuid": "55e20e11-957e-4d7a-a49c-1eca609f5c49", "value": "12288:Wc9OYlSieUsWpFSH7WENhxn13KZHPGMrEBEMm5CrtQ8VUiT/vfP:Wc9nJnsW/mWEDGHP1rCVm5wQ8eijX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212848, "uuid": "8e4c3662-954e-4878-b80c-dabf98b87e91", "value": 632388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212848, "uuid": "02182543-7a3d-4082-adf7-f60c3522be0a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212848, "uuid": "73c376ed-995f-4661-bf9f-dc31892f534f", "value": "NEW ORDER 54361.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec63262-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693212814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212814, "uuid": "87565937-6d60-43fd-a9a0-9ac1c8ebc22c", "comment": "Malware payload (AveMariaRAT)", "value": "1fc1bfbfa2b8f4decf0d7d06c9d3c5f1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212814, "uuid": "a6c9c892-c47a-4cbb-871a-ce4480aaf9b4", "comment": "Malware payload (AveMariaRAT)", "value": "5dd949076dbcc92cbd73cf485a2150c14f26ada9b754a0c0ad91ad019f8137e8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212814, "uuid": "783afdfa-6771-4ba5-ba8d-727513033bc9", "comment": "Malware payload (AveMariaRAT)", "value": "20712992994d92296032faa9a931fcf41be5559f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212814, "uuid": "cb065a43-e63e-4f9f-abf4-3c5d2d9f6a58", "comment": "Malware payload (AveMariaRAT)", "value": "0089525c4ab47b6bf9444fda92b129b7ed0d1aed31967a23bd0a88c8c4fe23d112452da5511de7678cb077ea64661e1b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212814, "uuid": "5ea3eded-cb8b-4e82-85e7-47fe7f5a25b0", "value": "T1C1F4A262A426294EE9293171D052F36D86458FFC4D37DA4CFC49B21ED272B831CBDA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212814, "uuid": "322db3e4-1830-40bf-92fc-c3427a786fa8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212814, "uuid": "50713f03-3b02-4af6-bbf2-1a2f8ec3d3be", "value": "6144:GYa6QA+J2nuRPS8nKLJJKXErMWSsbNB9d09zLAdlJmt7fNL:GYiAQ2uJShmSSsxB7phmZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212814, "uuid": "471b99ee-8d74-4ddd-997c-8b9b1cec3bd1", "value": 765544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212814, "uuid": "e2978736-5a9e-49d7-9c76-fc092e6d39cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212814, "uuid": "ebc5f042-e330-4cbc-a0c4-5583ef35a8e5", "value": "HSBC_Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a068e4-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1693214067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214067, "uuid": "216f0946-77c1-41a2-bb59-db850eee3c41", "comment": "Malware payload (DarkTortilla)", "value": "8abe5c11473a05f6c32aadfdb5571756", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214067, "uuid": "d745d7f9-fe83-4430-b0fb-6d3bc84d6c76", "comment": "Malware payload (DarkTortilla)", "value": "5e450ecf947f03c09425c3442a5d358a1ef5e5f9f18ec9934810c21e2c3696da", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214067, "uuid": "9eeb637f-511f-458a-971b-13ac535e9f3c", "comment": "Malware payload (DarkTortilla)", "value": "db4e628c0cd828ebf4d44d9ad75d2742bbbf3c6b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214067, "uuid": "4709fe6f-de4e-405d-9b17-94a3d5a5a30f", "comment": "Malware payload (DarkTortilla)", "value": "9d87fa21fb99c0b44454db8e08c8bc02bcda4c6b4961106fe97106404cd1321e5d4da418cf96ddb6cf5c9a8fc41ed802", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214067, "uuid": "a2b68dff-5aa8-4b0c-931d-d412a874f885", "value": "T1A065E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214067, "uuid": "8127e9e6-5391-449b-8931-1ab2cd72b1f5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214067, "uuid": "8ad684c7-971a-4088-994a-68df8de3abed", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214067, "uuid": "ab92b527-afd2-45d0-b0da-34f51b54d68a", "value": 1450732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214067, "uuid": "7eb394b9-e59e-4f5d-a2c7-94ac13433a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214067, "uuid": "0fb4bc0f-eb06-4e3d-99f3-94fa6419c1d3", "value": "8abe5c11473a05f6c32aadfdb5571756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3737497c-4595-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693221767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221767, "uuid": "a12b9d62-85b5-48e6-a566-8a45eb9744d0", "comment": "Malware payload (AgentTesla)", "value": "35f59b0b466cec9da9d301df11a5ee65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221767, "uuid": "2c6a8073-fd61-4549-8eab-5cba0d924054", "comment": "Malware payload (AgentTesla)", "value": "5e98c7efb65c9f3cd34e969582b4f0012d51564b4e476882c48d54052c60af99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221767, "uuid": "b1e89955-b855-4bd3-afc8-b304b5047c6d", "comment": "Malware payload (AgentTesla)", "value": "34c5dcd42b52ffe41938eae9046b5ab29a92a247", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221767, "uuid": "437bfa70-8a8f-4704-ba56-4e9cf4333cb7", "comment": "Malware payload (AgentTesla)", "value": "93430c93fac7cb3c4af6c9cb8c3fc60c1644421bbc4d9d11b1472d1fce796d5504479a459b8af87d9bf2bdaea666b253", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221767, "uuid": "6c4431e5-987e-4cdf-af71-62fd3a0739e4", "value": "T18935B7B8F625DB2BFC8C4DFCC4D5182E7AEA5CBDC4B1B254E233D2681AFAD5101A6411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221767, "uuid": "5807cba3-4655-4a9b-84c2-42e2e86f8a46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221767, "uuid": "66f2c116-4476-4da4-b360-5ec63b4bf308", "value": "12288:Y+70pKXQl2FNGp1SWr7cK9/EImSuShFeX4UGnpaC3YPguKkMtntGGzGtGGGlGtGk:36QKJEILmX4U6pWPguKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693221767, "uuid": "0ca3ad2c-ac5e-4155-8cb2-53ac4c8a0e57", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693221767, "uuid": "afe1074a-efcc-4a69-9ca0-335d5f094ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221767, "uuid": "eda7fe04-f371-4af1-b15d-d14009c5ccb6", "value": "C-117562683.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124341fa-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693233301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233301, "uuid": "caf9e0b1-b068-410e-996e-e17af112fc59", "comment": "Malware payload (AgentTesla)", "value": "c2e28bbd09b204324ed6a78e573d0dcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233301, "uuid": "18bd12ef-7405-4a33-b15d-66d8366a1d14", "comment": "Malware payload (AgentTesla)", "value": "5fb8426f8dd7237a3412490fbfbced9d853ce49fd7784b5184224d1d897e0ea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233301, "uuid": "3e074d97-3849-4526-8d1a-973bb1803349", "comment": "Malware payload (AgentTesla)", "value": "5aa3baa1d5ec301d50cf6a507012db6848caf8df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233301, "uuid": "571a36eb-45bf-437f-93f4-7a0455125a14", "comment": "Malware payload (AgentTesla)", "value": "36c1a2753f3e94f015f5f82967d63c97f5bd395e45e14c806e9bb4da282b98c1a9c3439438121e275ce91d291e03e38f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233301, "uuid": "13703651-6d0d-4de5-90d0-3ecf1da0ac02", "value": "T1BF15F10DB77446A3E8278F7A6664887A8F31AD35E86F560D3449BAC61FB33051D01B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233301, "uuid": "6f12ea8f-787a-4c8e-9282-98c864df0cb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233301, "uuid": "0a0a7449-76aa-41df-b789-e10f174c66bc", "value": "24576:fYnymlqT/D7f5cCjkK8NvzV1BwBCfT7H:fTmO/Dr5caDaV1FT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233301, "uuid": "606d5edd-a01c-4f23-9145-3fa20b1e9149", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233301, "uuid": "be4982d9-707b-44f8-b414-fbd9882bac43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233301, "uuid": "2beb3e77-134c-473a-846a-b250764919c3", "value": "SecuriteInfo.com.Win32.VB-AJBX.2137.29996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c562bcf-455c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693197321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197321, "uuid": "18a2bf00-aab9-46d1-8096-d50a1f536a5a", "comment": "Malware payload (AveMariaRAT)", "value": "b9914cd3537e25bb260ed8c379ed7b6d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197321, "uuid": "8840d51b-6e3a-42ae-96db-cd1b1914e5b0", "comment": "Malware payload (AveMariaRAT)", "value": "61581b67f22c8a59d322641223d954d5dc5ff4d710241fa0b459037648038cdf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197321, "uuid": "faa27c0a-e997-41cd-a00a-58605f16a6b3", "comment": "Malware payload (AveMariaRAT)", "value": "c17edfc747ab3b69fca05bfaf870906d1c8b0deb", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197321, "uuid": "f183f155-527e-4e5d-836e-d4ddd8a69f65", "comment": "Malware payload (AveMariaRAT)", "value": "71fb5eb32bb3fbcc9dfd1297eb4106c12960692e55fc446217d9ac46e490a250f7709b6a04573f1c2062729ff3fd95d4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197321, "uuid": "8403c189-a891-4aec-b4ea-780bb01eb4f3", "value": "T1AEE4BE23BA3DDAEAF42D7EF52914971056B1AD4A1470E247D85F7ED2EC73213C028AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197321, "uuid": "d3c9fe5a-b383-4c42-9d7c-3459e413a90d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197321, "uuid": "0cabb6b6-93df-49c5-b38d-b4224840f126", "value": "12288:rAWJp09EL9LKwtqLVoWHw8+3GzFr8YWK8JUE:rAF9EZLHtUoWo0FrCJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693197321, "uuid": "739413a9-b9b2-4fc4-b1cd-0c91ffbc7e69", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693197321, "uuid": "f34e162c-3309-478a-ba7e-84cadfc10fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197321, "uuid": "0ed15644-d8dc-4bfd-9c32-2f639417cd01", "value": "Attached picture and specification detail-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b88756-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220820, "uuid": "3e7c3d2a-dd80-4d35-9826-abe7eec19d86", "comment": "Malware payload (Mirai)", "value": "0d16cf3f4beedda0b61dbfc19b61636d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220820, "uuid": "df3737ad-4ae7-41e6-a135-e8357f28ae29", "comment": "Malware payload (Mirai)", "value": "615df81609fe78f4b37ac03e902725f2e768652803e7f142c0ae6ce17e25a450", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220820, "uuid": "d149408e-ee47-4eff-91c9-f5ebfff0cc1a", "comment": "Malware payload (Mirai)", "value": "f077bdca69567caad164d39701c26d6fdb825f21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220820, "uuid": "59cbc030-4914-4667-8958-2d0775ec8200", "comment": "Malware payload (Mirai)", "value": "7d6abb271821302b86f4773e33a01e01ae6434f33cf2b3a3530fbc15264b70838669bd1324044aef50e3e6dde683a752", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220820, "uuid": "008a7657-bea5-4272-8bfb-b7a4606b66dc", "value": "T1DDC2D070F9C179F2DEFEAD34885185D03BE51E4937A18CDA208EDE115212D339AACA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220820, "uuid": "b98e13ba-62af-4e9f-8302-d0937fb031c4", "value": "768:4KnqLiChP7gI5gBZw+LajRI4uVcqgw099:4KqL1h4Zwa6e4u+qgw099", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220820, "uuid": "39db53c7-484e-4828-8fd8-dd36b18f30ab", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220820, "uuid": "fd61b8a6-9b8c-4d5a-b75e-408bfa67c016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220820, "uuid": "2ebea60e-9740-4934-b185-a84793f49d34", "value": "0d16cf3f4beedda0b61dbfc19b61636d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08a3a70-453b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693183316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183316, "uuid": "02f0fcfe-38ee-4895-a037-c4df7094cbd4", "comment": "Malware payload (RedLineStealer)", "value": "d109b645d722163a08fce27cf7a7e722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183316, "uuid": "f377a46f-1b4b-4f24-8307-b343bf34dbcb", "comment": "Malware payload (RedLineStealer)", "value": "62141b062f3c6e3c9c5918613eac7d57de688d16b199e2731b93b08c8add93b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183316, "uuid": "9383eec6-6592-4855-9c0d-3e725bd483af", "comment": "Malware payload (RedLineStealer)", "value": "08e2d6c2f346ef4ac2c55b4457b00e767ca0de3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183316, "uuid": "aadd37c8-f295-4d6f-bf0b-dcfd6e2108cb", "comment": "Malware payload (RedLineStealer)", "value": "b444ad4b6edc2c837cc65a194e15ef219ab8fd80b3b7297acd68458aa02c0b79104550ed7412f90aa86f8af32f8831e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183316, "uuid": "093be50f-c273-4c5b-a9b2-86c90cd535b1", "value": "T174E41241A6D44037CAF927B06CF603D72B35FEA1AC78834A2249BD560DB37859C7236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183316, "uuid": "e7e906d4-6b77-412e-8241-8426e4f345c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183316, "uuid": "0792eafd-14f3-4e1f-9062-244d57e20193", "value": "12288:6Mr3y902smWi0MFcA+jqiNR/IcBbijaa5BTysmRKZQfWTcAfas+h5M0FKpGx:NynsbMFdgqwRfijJPyTR/RAfUh5/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183316, "uuid": "ae359b29-2fcf-4b54-b710-d6a86b52daad", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183316, "uuid": "387d815f-6c09-4071-92e8-34fa5d8c4947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183316, "uuid": "3955f58a-a49b-4a31-8b4a-961279d22d91", "value": "62141b062f3c6e3c9c5918613eac7d57de688d16b199e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a8f4c5-453b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693183318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183318, "uuid": "626cb169-13cf-4f59-ba32-d336da434b76", "comment": "Malware payload (Amadey)", "value": "2015dfc1d2570d30a15a66a5db61b4f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183318, "uuid": "3781070f-29a1-4263-bb25-fdff6bdc8a2a", "comment": "Malware payload (Amadey)", "value": "63597f1b20938fdb65672a052e4e66cab5fc45461ef0175af6e0cbf1101936a9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183318, "uuid": "a6884941-1bf1-4244-a5c6-47ac7c7b2903", "comment": "Malware payload (Amadey)", "value": "befa7514e58cacdbfa270b75f2c00a6517487d27", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183318, "uuid": "4203ab63-68fa-4021-b6d7-dc54990d762f", "comment": "Malware payload (Amadey)", "value": "76e15d6bb30935e3c622f32263020b71e78aa21501f02c50006803f66d1c90349049b689bd24f7e7d27c2dcde86f0242", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183318, "uuid": "1745ba56-1d35-4b93-90d2-7f7d1c213b07", "value": "T1EB152307A6E80132ECF66B7099F602A727367CE15C78835A6B40AD5E4C735C8E831B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183318, "uuid": "2f2ffeb1-d3ec-417c-841e-ca289b986bf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183318, "uuid": "3ab6e7d4-18fa-46f9-829c-8898fff61aac", "value": "24576:Xy0mFdc9wdklaBtLVdbyMt3PRvGmIJvvAxm:i0mFdYMBtVZtjemIRvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183318, "uuid": "2b89df75-9bd2-44bb-be91-e0c1d361b96a", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183318, "uuid": "50a13eca-cd81-4a17-8f60-af26562a224e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183318, "uuid": "43f260f4-fa1e-49d8-ab78-daea22517f2e", "value": "2015dfc1d2570d30a15a66a5db61b4f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e6b1ac-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232145, "uuid": "21735d26-a10a-4b42-820e-604864475fe0", "comment": "Malware payload (Mirai)", "value": "ca68930b54ee31e08a0f827185654a53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232145, "uuid": "b8e80672-c2bd-47d4-9fd7-0fc30065518e", "comment": "Malware payload (Mirai)", "value": "63d79cffed191d9d16729df50c84714779d90b36217ec9068834a65ed809bfb2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232145, "uuid": "d8122802-ed8a-4bc5-9863-273168165705", "comment": "Malware payload (Mirai)", "value": "b4120504c684910f6732b9ad3368b12586e27e4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232145, "uuid": "8f5b4a4e-62d2-4348-9099-569161ab288b", "comment": "Malware payload (Mirai)", "value": "6bcb49effbd8da1f9d575de24e3e2e41608099b4a673aa9c395234fe4fa015c1687406aa9648cb345382f212f4762c4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232145, "uuid": "b1535f07-a89b-4ff3-a601-6fc53fdd1450", "value": "T1F3C33A85FC405B13C6C212B7FB5E428D7B2A17A8D2EE72039D256F21378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232145, "uuid": "d13a9a65-9cd7-4c0e-a9c8-a831c451a89b", "value": "1536:GJJcUqwyNlHkRFHAKqE4V6GWsTgVEthw1s2EzudrlUB6wywbFBCN8nOtZqPKKO9c:GJPulUFHL45tMVEthyuuJMg3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232145, "uuid": "83d2c00f-7ca3-4d48-91ae-ade13e644f0a", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232145, "uuid": "2aa55435-ce62-4424-bb69-cae09f1f0fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232145, "uuid": "76341deb-5a59-45e5-a4b5-d83402b950ae", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf61ea0-45ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693244755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244755, "uuid": "46398282-efa1-4bea-b216-2b34753f82f6", "comment": "Malware payload", "value": "9de996bb3f5aa0395ae4d9fdbb2dd06a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244755, "uuid": "38d26659-5f65-4ae4-972f-6d20022ce71b", "comment": "Malware payload", "value": "63e3f6c5c1f8972fe42b31452f17d6983cbcde25ef385d6c742d501137a10f25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244755, "uuid": "215c2bcb-c3fa-491e-ade7-7ed09e1788d2", "comment": "Malware payload", "value": "e87395feb01ecf339ccdaea1748fbd9f727aa259", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244755, "uuid": "2f2593da-f5c8-48e3-af74-7220ce17d3a3", "comment": "Malware payload", "value": "ddec076d25d0c77c2eae5c9d18d48b2425da91a2c76fd749c769f41c0b8829e09e197af236ca8134e55f34db0c3d6759", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244755, "uuid": "cdaf3cb3-ba64-4a69-8fe2-77550b907bbd", "value": "T14503B6513ED069CC13DB4B7A732B60D9E1DA087B2CD59D9BF201FD9068A8732DAE4931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244755, "uuid": "7ee1ca2f-b8b0-4863-a92e-1653ce7b9f5d", "value": "768:gsu+bDUlj212OIcdk1Eamtmq5BE2SmUh7vyChcfqUtJo13QSo19laVfQzczp/GQ4:UFcs5r3fQzEuA3Z+aHqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693244755, "uuid": "ce977923-c138-4f91-96e1-5c5a68256797", "value": 38173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693244755, "uuid": "34b3c9dd-d1cd-4cf1-ae8b-067bc0be9b72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244755, "uuid": "aae2b7bb-e817-4e19-8f4f-441803cdb5b4", "value": "validcc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc64283-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183685, "uuid": "0d11fc46-29c3-465a-9dc2-9cea18d57e80", "comment": "Malware payload (Mirai)", "value": "9f8c84e87fbbeb44b5e7b19426475f29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183685, "uuid": "9d31e649-9e68-4efe-9882-6692c2589275", "comment": "Malware payload (Mirai)", "value": "641263192dddf6e512a6d9c7258b6fe136e11deebfa2a8dbc2aee9386e7a7b71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183685, "uuid": "6cb00cb0-70a7-4e93-a055-1faaf5e3f575", "comment": "Malware payload (Mirai)", "value": "91e00b0f4385ea5d5545d2329756730b83555aeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183685, "uuid": "b346c8e3-96d8-4604-897f-2fb7b129a4bd", "comment": "Malware payload (Mirai)", "value": "272716e82801bd21f2301bed0717dc56c368f5f356a6cd5b0936a14312f4314df07a4b5be489175c41129a1c3bb53854", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183685, "uuid": "cb4910b6-dc54-46dc-8edf-d8dc3c287537", "value": "T1B4934AC2A703E6F5DC060A746037F733CA7AE5662119EDD2D3D4DF36E822602CA1669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183685, "uuid": "8ce12dfb-294f-4c86-bdec-893146bc0211", "value": "1536:ZC6zEqohEjaIZt6aXot/pi6SX6eP+J5k4qwlEEIdOXeHzi6o3X9UFAZLUNBFtoAB:ZdohEOct6aXotBiPX6ePczFI8XEOXnGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183685, "uuid": "46a99ae0-581e-4b6f-a018-264e0afa3322", "value": 95952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183685, "uuid": "5cae2e5d-ed42-4d7b-8d65-e5cfffd563f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183685, "uuid": "05630790-2b24-447c-b37a-776f5b5c4698", "value": "9f8c84e87fbbeb44b5e7b19426475f29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06721da8-4599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693223403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223403, "uuid": "ee3a9fa6-354a-42a8-83d1-407b07426a80", "comment": "Malware payload (Mirai)", "value": "2176e3d2a6c7bb25e66951ae3ebcf3f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223403, "uuid": "14268a40-3ce0-45ae-9e8a-69b3cfb5c2fb", "comment": "Malware payload (Mirai)", "value": "645d611cff582f9fd66186ddc8326af81e2140a5189db99a69e1db90dc3120e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223403, "uuid": "96d7b99f-b961-4288-9e8a-dd650d779582", "comment": "Malware payload (Mirai)", "value": "73beb678b40f0f8612453b6d1a7a7f74e373b3ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223403, "uuid": "2b34cd89-5ace-4a11-9cea-c3a0766625d6", "comment": "Malware payload (Mirai)", "value": "a81945a7e9515e50e59f149bd50624caf64cfd251fce3dc4e91bb5335447bb8769ec24851d2eef529f26e8bb60a11bca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223403, "uuid": "d211ac30-e177-4d8b-865a-189ea3b67787", "value": "T158C2F1BFB2AA6A66F61C233DE035C11B03E8F51CA39D679767040432EA5E81D7531CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223403, "uuid": "da2b6994-4f65-4aa1-a7b1-a9d2606ebef5", "value": "384:MB1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHotBxO3:0MwxdyoEUnDz+Y8tqHWXmItBvQfC0Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223403, "uuid": "b49d8d7a-b77a-4717-8a59-5105e3e38533", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223403, "uuid": "9fae4766-f2b1-44b0-8765-bf99926961e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223403, "uuid": "a2dc0c2c-3ea3-415f-a2ef-4c1215d5c29f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e293df-45dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693252204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252204, "uuid": "2a21df3a-c250-4fd2-895b-8994bad3c611", "comment": "Malware payload (Mirai)", "value": "de7a14685782cc2b19b0f38615d18e99", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252204, "uuid": "c4d65c6b-af16-44ce-a430-d2a7664a21f9", "comment": "Malware payload (Mirai)", "value": "6737c3a0b6e8adc26eb486590385fa0261d5d73a1ef60681c330d1605c30ae75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252204, "uuid": "a894a1f4-eb8a-4172-a33c-337864ab5b26", "comment": "Malware payload (Mirai)", "value": "e94e6871093c76c41e6c8c487e1bc83e1bc7856b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252204, "uuid": "cb7d1906-d171-4461-8c3c-139c5d2fb4ae", "comment": "Malware payload (Mirai)", "value": "85446f57bf04fac4ecb012f72cfa9701b915548772155830fef04cc74092a9b17c75305c12167cf8bdede04d212f1bf1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252204, "uuid": "3558d772-cfbc-48e6-b487-db6301d8af7c", "value": "T1D5330272676E6AE291B04377FC32AC16669C17F85DA730A62CF0661977C1C024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252204, "uuid": "03329749-c637-4baa-8d5e-e3da14723b90", "value": "1536:j9O/ZMAXIxNUk0wTLcPqF1aBexo4opKZba:j9O/ZNKyMTLGqFUFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693252204, "uuid": "31171c8e-6beb-42e4-80d7-269d832bba2b", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693252204, "uuid": "49f5d2cf-7973-42ac-a0bb-903a93c49a43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252204, "uuid": "fc475573-4081-4dc7-a29a-f906d07126f4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e38dae7-455c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693197217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197217, "uuid": "76ae7b85-624c-4a95-a0c8-eeb18ba998d2", "comment": "Malware payload", "value": "76c381c92a2c3aab5d89ce7db27b1d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197217, "uuid": "34b23e05-6b39-4cd4-85fa-5e6bf8504427", "comment": "Malware payload", "value": "67851e4fc08710df92cf6ca5dbf09eaa4e247648e947bad24db854ca789ebf39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197217, "uuid": "ce26fe83-58db-4d21-97d7-9b862ab8c5c7", "comment": "Malware payload", "value": "5ab7117071fa75aecb93d91d40b988348d772757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197217, "uuid": "b9d5cf4d-042c-484b-b781-6ff34b48b359", "comment": "Malware payload", "value": "2e018c3dd726dc257bcb64f3167ec5833130e7530d817bc56d920e3071722cf357462505a72ac9fbcff55f8a6a01e080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197217, "uuid": "b0957b61-a4c1-49f7-9469-b00b1fee4c12", "value": "T1AE047D1174D18032D473153249F4DAB8AA3EBD600BA65DFF67D80F7E4F306D1AA319AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197217, "uuid": "9eb960b7-b14e-4645-a029-05d62a708896", "value": "f7aca7eae1bc8ea85a83c7d86feaa68c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197217, "uuid": "68702e05-c898-487c-8eda-c302980f0b7a", "value": "3072:yS84Oa6MqYqhZqJj1/GsOoZ18S07EcAfGOAg0FujCmgFUilK:44jDqRHmj1/hZGSvAOTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693197217, "uuid": "3b278f19-7ac9-44be-aa4f-b83562a99e82", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693197217, "uuid": "0b696ab7-77f1-4333-9257-75565fcfe6a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197217, "uuid": "2764c304-b198-4ed9-9f59-af424640e9ea", "value": "SecuriteInfo.com.Win32.PWSX-gen.19491.26060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ddfd1b-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229385, "uuid": "8c38b7c4-e44a-43f6-b749-3b19a3936c09", "comment": "Malware payload (AgentTesla)", "value": "2c0f7daa0637923f321617d6bbc2c968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229385, "uuid": "e60d958e-7534-4222-91d4-5772f0cef568", "comment": "Malware payload (AgentTesla)", "value": "67a1d95ac501b3239795c12bdebe20853519e92810d5124bff570a5f9001d440", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229385, "uuid": "4e771dad-8a71-4d49-89ac-0cece8fcf10b", "comment": "Malware payload (AgentTesla)", "value": "da5f7fca6da24d2f065d68bc32a127089b7c42ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229385, "uuid": "ccbbfb75-0a0c-45aa-99d6-3c7afdfbd83a", "comment": "Malware payload (AgentTesla)", "value": "d807a73b19e04f6476e98f0c3fe00a1d4971d47bdb87219de177095a60d88644884f8e9189a82808795b9415ff190b46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229385, "uuid": "c571617b-de09-4d5d-a8bf-52c4a526bad2", "value": "T1DFA46D21BBE08D1BD43F6376E4E20A1747F4F4467227EB8F19D49A695CA3B454E00BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229385, "uuid": "35131a3f-c44d-48fe-a6ac-d92e26414413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229385, "uuid": "076efb97-22a5-4b2b-81d1-2de349ca1f8b", "value": "6144:z3IaL+ZdLqbt3de/e1L0U0iA3o4U5miBdthFjPLW5eVHtM3RirSdkbrs1aq:z9/p1gUVA3KxjzKeVHyRir5rs1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229385, "uuid": "bbcb41ee-51ae-45ee-ae3d-94fa01798512", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229385, "uuid": "0341abab-432b-4844-a9a7-2dd77a104719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229385, "uuid": "70f1fa1a-d8bf-4195-85bb-16e92f55e45c", "value": "sat\u0131n alma emri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbad17ce-4563-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693200541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200541, "uuid": "0c8fb80d-670e-4e7e-ad95-1021c1dbb123", "comment": "Malware payload", "value": "58b4a4eed74fbfbf104d0ffd92207018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200541, "uuid": "c6e96e9e-e328-4fb8-8ed5-b4981f4a5c87", "comment": "Malware payload", "value": "68bce3a400721d758560273ae024f61603b8a4986440a8ec9e28305d7e6d02b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200541, "uuid": "6fb05905-b361-4a5c-8595-260bbdfdddf1", "comment": "Malware payload", "value": "994edc8d183a1a7243790539044d12b80b1d5d84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200541, "uuid": "c6a39ad5-7de7-4302-a6f4-4a766e79b7cb", "comment": "Malware payload", "value": "14c42553d9c36ee56aa22a3eb2808048bca106ca57102afe8580958b8843662f729765c3c7ff0f289d749c8ca1f7a455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200541, "uuid": "0a955c1c-02e2-40ec-a2e7-08f3bee3af4b", "value": "T152E4CF2031A7C532D51152F21979AFBEABBCAD2047F715DF63C41E3A8E202C17A35A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200541, "uuid": "7ab2bdea-769e-4b38-9f5c-096cd0c192cd", "value": "2ea80d6d8e6b605a053f2043fd68e837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200541, "uuid": "013b5680-de79-4979-b73a-e481021f5d77", "value": "12288:VxxWLFgnM770lZwVp5f4PyrF8jykulgK7MaDdph0lhSMXlCFGXFXs2wnq7hPVWcx:VY8mkCgoD/h0lhSMXlXx0shP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693200541, "uuid": "b32c5120-561b-47c5-853c-6c03b8e0c9ab", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693200541, "uuid": "c176c1f9-3a36-4d2b-862e-d055437adfab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200541, "uuid": "66111c9a-b190-4728-b2ba-18d0ae47c68d", "value": "noescape.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9886597e-4599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693223648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223648, "uuid": "e2743d89-1628-4568-b2e4-662f32de12f1", "comment": "Malware payload (Mirai)", "value": "8d112578184ff176fe9959aacd1b00ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223648, "uuid": "c739415b-5881-42ba-a3dd-ade1500d222f", "comment": "Malware payload (Mirai)", "value": "6a8e50b99bc3e626c1af70710a1774b7846691f6faae60d1371b4ef64d6d3cae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223648, "uuid": "8779d233-9272-4239-9a4f-518754cd8aea", "comment": "Malware payload (Mirai)", "value": "8b4cc067c15ea2fb444718a4cf808e03f1e9ca1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223648, "uuid": "3efa3dd6-9d09-4468-a9db-6c9a1f25839f", "comment": "Malware payload (Mirai)", "value": "b781afba90a5609b6421102fb4c120eb5f5023afd1a6adec6b1e2963aee74dc7eecc33e8390146eee13de3dca845b68d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223648, "uuid": "e78985b6-79fc-47f3-9bb6-65b56d248f21", "value": "T1A2034CA5B8D1492BC5C11276BA6E998E3730A3E8D2DF3303CD245B5079EA42F1E97F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223648, "uuid": "841e255d-f72d-4b95-8907-64e5a77f89dc", "value": "768:Ca1eKVgXL+2PqRoMG5RV+iUDroT43LShHKK65hfY9hDuhNPDQ9fqbSiNkZ71dU:eKN2P4G5RVlUDQ43WhKhIhbhl1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223648, "uuid": "d94f1ccb-8a11-4aac-bac6-e797404b1bc7", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223648, "uuid": "4615ee4f-4ea2-4214-a143-afae93802a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223648, "uuid": "948c6b95-f7c7-454f-bb74-1160af2f51a1", "value": "8d112578184ff176fe9959aacd1b00ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25286ff1-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693223025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223025, "uuid": "13e77e9b-3a74-43a2-aeb6-532049426f23", "comment": "Malware payload", "value": "84b755b79809c2ffe2f67eafea2d1a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223025, "uuid": "3acf4947-8678-4329-b007-4fc4b48fb2c4", "comment": "Malware payload", "value": "6aefd54fa38a79c06e9e652ed657de89171ff12c5db2a1b896e0813d3f53bb6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223025, "uuid": "53774ff8-a5ed-4ead-82cd-0d2a940fff17", "comment": "Malware payload", "value": "558d789f1e7085bc1ad054d798042dba56a933c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223025, "uuid": "d6d64037-733e-44ba-ad1c-4ae2c5c22398", "comment": "Malware payload", "value": "d3e0437211f8bb6609a1df0219b5fadfc0551f9ba229b86f8b85fe05723c32598194b867bc93ad9e064596595fe92d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223025, "uuid": "392cbe0a-3f4f-4728-bbf5-f8cf5c45f4fe", "value": "T106046C1074E2C073D977193149F8D9B59A2DBD200B299DFB77D80B2E4F306D2A631AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223025, "uuid": "92edaf15-9172-46e4-8a6c-2159cbd2e85c", "value": "0954beaebb211de35605a05432b8cbdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223025, "uuid": "3e801d4d-0864-450a-85b7-6999634ee396", "value": "3072:J3q5H5Ya6vBw57NAJ6p+8uUKgNcCI73OvFJiPAg0FujDvPL49U:6HmlvO766U8tN4AO74e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223025, "uuid": "0007195e-bf73-4624-ad7e-c69a57c009f5", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223025, "uuid": "0db66678-6ccc-4611-b82d-148e7437e039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223025, "uuid": "0a22854f-0a3e-4cba-9577-0d672bb83182", "value": "SecuriteInfo.com.Trojan.Win32.Lokibot.DECC.MTB.13449.13417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623fd82d-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693232147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232147, "uuid": "d28d0468-849e-4a4a-b727-b71114acb15d", "comment": "Malware payload (AgentTesla)", "value": "e1f060e395b7a1b90f41e58cf1bbcf3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232147, "uuid": "7acfb4c6-6df7-4cd0-b66a-8eccb2a010aa", "comment": "Malware payload (AgentTesla)", "value": "6be5cddf29b81421edf93e6011b33bf25906c92ed1eecfc62a389fb57f8cafd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232147, "uuid": "9f3c9c67-cb2c-457d-9b6a-5473357c01cc", "comment": "Malware payload (AgentTesla)", "value": "5f021883c1d25f2d837fa0c0b02d5999ce20b4fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232147, "uuid": "739573a6-fca3-47a6-a797-0b07aff424a2", "comment": "Malware payload (AgentTesla)", "value": "cc1951342a7940590247af4d9cf00b25e7c1ccd92ec57696a8acf0594c18f0e5e9189ce796196839dca679f5b0343bd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232147, "uuid": "47663939-65c2-4d34-bf6f-4eea96862b86", "value": "T1E1642AD327A0491FCA8E23F4D8414999C7FBE34E62DBBB6D658255B1ED43360B809393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232147, "uuid": "72a3ed81-6017-46b1-a95b-fe4de8ef9869", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232147, "uuid": "5bf085a3-e877-466c-b6e3-98f45f4422ec", "value": "6144:1WXIzO//e87eBVjMngLyh7ha9poCcilTCcFWh6e1to:1WXIzmVeBLy9haV/m6eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232147, "uuid": "6936513f-f605-4293-b7fe-d951bf1c488a", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232147, "uuid": "884ec7be-7039-4229-8804-0baeb0479e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232147, "uuid": "b84dfd24-8a0e-4c8e-8fc7-2c6a8e904e3a", "value": "Invoice #280202308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ce16b-45e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693255803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255803, "uuid": "8874a4d6-15f2-43f4-8475-8683d78addf8", "comment": "Malware payload (Mirai)", "value": "5ac692cab12732705d2b943a017e1820", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255803, "uuid": "f4143268-cf93-4d2b-88e9-7d8cb8f10186", "comment": "Malware payload (Mirai)", "value": "6ccc69015c06c14cc66b27d02a5bab710ec19698ef94791a8b9ddc2590dad013", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255803, "uuid": "71407e92-a827-4c49-a07e-a711bb58961f", "comment": "Malware payload (Mirai)", "value": "d0f6a45d418fe65756527c55f16ca917d61d1f23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255803, "uuid": "5f3ba38c-abb5-481c-aea1-48e54483b214", "comment": "Malware payload (Mirai)", "value": "2697664114e4693a464556c8e558f53bbd8da95b2bde7c3d8ba8bedcb01106af4cd4759020f678bba3f36922c3b207e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255803, "uuid": "2caf4e96-3e51-4711-bc9c-231c977e2b0a", "value": "T13DA2E055BF1C86CBC832293455D9EAD21256FC72F2EDDC096940C16FB4B33A96834F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255803, "uuid": "cd08064c-2402-4832-8a49-0e46c1150c1f", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK/:798o08kxofBE+ZkXaqGbp2F2TWul0c5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693255803, "uuid": "f2695562-9600-4fce-a9c1-cb9e2b7bdae9", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693255803, "uuid": "5cdcc77e-e7cb-4040-adc9-5297bbbffb00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255803, "uuid": "baeed16b-5726-4bbc-bccc-f7b4920e927f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd01bc0-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693214126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214126, "uuid": "a9b0d026-07b5-43db-8422-342e7552594f", "comment": "Malware payload (Fabookie)", "value": "783585f4ccf2fb73e35e784169e30745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214126, "uuid": "60acbac1-4a8d-471b-8df0-05162deb4dd7", "comment": "Malware payload (Fabookie)", "value": "6d382caf21dcbe7dbae511e238852798c9b11b69cbc02ff46916e7c47f24c8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214126, "uuid": "9301c44c-7ceb-44d5-8995-71a417cc5675", "comment": "Malware payload (Fabookie)", "value": "8651025c9406320f01c7b579d469608368e2fefa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214126, "uuid": "4f92db1c-a75f-4987-b38c-3b7c5f957520", "comment": "Malware payload (Fabookie)", "value": "95bbbf1114338cdfe24e746ad4b9a8c14bfcdae5a18cbc2209b91e97181032fdb35f9dd792c090fcd1af38a26c904399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214126, "uuid": "945841c4-a3ab-4dd0-b9dc-2c91718c2635", "value": "T18CD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214126, "uuid": "58dc565a-7b91-4219-ba39-a36de28b95e5", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214126, "uuid": "2fc12190-6c7c-4721-a63a-40571f8dccd0", "value": "12288:TeE9CMmn1yBvivHTPjPTXzGRDJciMuGEPnW:qE9jmn1AuPjPTjGRSiMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214126, "uuid": "3e8780bb-d7d9-49e3-b284-cb2f733bb9c8", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214126, "uuid": "a1ea2276-d82a-45a2-a776-761b4e2863ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214126, "uuid": "43894a78-347a-4385-90a1-dff2d6a77ada", "value": "783585f4ccf2fb73e35e784169e30745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247651be-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1693212716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212716, "uuid": "a6c70600-1f31-4603-b009-0e13cc7c5114", "comment": "Malware payload (DarkCloud)", "value": "4598a9ce228eb74fcb798dff73b6387f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212716, "uuid": "06bd5765-b44e-4af1-bfaa-d71c75de52f7", "comment": "Malware payload (DarkCloud)", "value": "6ec733375cbfab2bc5cb2c37a453a9384e3a5030aaac4f937b0c7ddedae32053", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212716, "uuid": "b946172c-8192-4d29-8e01-f018c0d7f4c1", "comment": "Malware payload (DarkCloud)", "value": "3c6c5f67737accb396574a619b7c42d84ec70eaf", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212716, "uuid": "fabe2621-0bd9-4720-b236-a52e2339188c", "comment": "Malware payload (DarkCloud)", "value": "d9fdb12d9d11c78c71c744aa690e486d5f199be409277e2382efb18109fe1192f08680d8d672bc5be0501d509f5c6bc1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212716, "uuid": "066f4085-e2c1-45f8-8702-c710d7dc64c0", "value": "T181151227BF45EFAAC43F8BF67C11D1010A66EE5DACB0D758588A76E62C31613507AB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212716, "uuid": "f664e1ef-128f-4e42-974e-82435431f33d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212716, "uuid": "f61b7a09-0256-467e-8c0b-10d74f770bba", "value": "24576:RiF92Yfkw1UFvTDB6P5hv3NOJjJ6g31Rh:cPORWPDiTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212716, "uuid": "1490356c-afae-4c21-b620-3d4b4b338706", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212716, "uuid": "f7567796-ab54-47e6-b4a7-545cd021586e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212716, "uuid": "02b23bfa-fa22-4305-bee4-fc6c6e8e7e5e", "value": "INV.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07b7881-454c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693190590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190590, "uuid": "112fc8db-b351-4d79-a1c9-4ca17a13b761", "comment": "Malware payload (AgentTesla)", "value": "19f72dddd2eaf0cdfffb42c727a7b5b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190590, "uuid": "3e5956ee-7aac-4e41-8919-6abb1256d249", "comment": "Malware payload (AgentTesla)", "value": "710fa86210820e8990d72fde020d01022c213ef03c036d1ed1ce96e8a07eb9ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190590, "uuid": "345b61fa-844d-4040-a089-aeef3dcd51be", "comment": "Malware payload (AgentTesla)", "value": "949b73557bef451c0ca6dc097584f62d5467064e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190590, "uuid": "7662649f-0ace-4707-b427-4eb657b03096", "comment": "Malware payload (AgentTesla)", "value": "3613ccdb0bcb5718610a26ea7aa413d5412592bede259b6ad7eb1a51c276cf8c5f862244c5c4211d3ff54e3d84b186f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190590, "uuid": "c754142e-dfa5-42e4-a471-5b1bdd726487", "value": "T12BE40223BA25DF79C53E87FA7C16E40403A6DE1EA864E758989A76E21C31713403DF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190590, "uuid": "1a87c45e-4c43-4eb3-8c0f-bec9bc44974b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190590, "uuid": "83aba8b6-8906-4ef5-a6c2-0682d07c6b29", "value": "12288:oHWJp0942DdlPDXVFS0KRlOEK8aFMVUb6gdPw4AYmBK85ps:oHF95DdlrXbSbRoE/4XbvPJMKes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693190590, "uuid": "2edb483a-c84a-434c-9e03-e933a8eb2b7f", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693190590, "uuid": "fd21da5a-1165-4cc8-9022-201055473721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190590, "uuid": "7f2de9ce-4e10-4301-9558-377a1823bb13", "value": "SecuriteInfo.com.Win32.PWSX-gen.16876.13981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579e698-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693233307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233307, "uuid": "5de51108-9711-4c76-a9ab-5ef7f0a45167", "comment": "Malware payload (AgentTesla)", "value": "fc8b5fbdfdb754082b4f99f673ef047e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233307, "uuid": "8874d637-a462-4922-ab1b-576e28b8ed01", "comment": "Malware payload (AgentTesla)", "value": "712c208264fc1565ff2125863c1c04a10828d9a42aa8a522f254576bcedcd2e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233307, "uuid": "b760ef73-1ed4-4b3d-a87b-c817ce2078b3", "comment": "Malware payload (AgentTesla)", "value": "2e1b875af41aa450de64574ec4aa72f7dc87df89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233307, "uuid": "56d8d8f5-ffc2-4066-805a-65c908ae28a2", "comment": "Malware payload (AgentTesla)", "value": "6c081b6ff528385af331de8afbf686f5126ceffef2eb56297380fc05328e7f68974eb6bf0f5227b2520fbd690e4ea156", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233307, "uuid": "9f534b33-3816-46a5-a92b-965b7d3748e7", "value": "T187532B61AE1C45E7FF7E11B6687B478A05709CBF5792E6AA644EF0161C72303081BE3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233307, "uuid": "14412603-82f4-4c07-8758-d9314a606580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233307, "uuid": "92d12f98-8ee7-4a4e-8cc3-e07865a76398", "value": "1536:0D9GOo9EELwwd+TUOYsMDK3EaqB36G8hTugo/:0D9GO7v4B3go/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233307, "uuid": "04d7c696-c560-4bbb-baa8-2936502f3740", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233307, "uuid": "053147d3-a34b-4334-8d67-62450fd1f62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233307, "uuid": "7e7df8ae-eeb6-425d-ba89-72c93791eb80", "value": "SecuriteInfo.com.Win32.PWSX-gen.14895.4336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4e6cb5-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693214076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214076, "uuid": "261b7ae9-339f-4bbf-a557-25aa077b4608", "comment": "Malware payload (Fabookie)", "value": "f2ae3234c028d00361a654f755639af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214076, "uuid": "228fb20f-50c4-4ad9-a308-1b3d93be113a", "comment": "Malware payload (Fabookie)", "value": "718fb159a0802f563779496344b77e50ce75f3e1010c8129587603212cf8ce40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214076, "uuid": "32df1394-cc02-4bc1-af17-99c235b6571f", "comment": "Malware payload (Fabookie)", "value": "84aa24bcaadf0d8d818abcdef50563fac724c0cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214076, "uuid": "15b35cc9-ff83-499d-8acf-629330cd2d45", "comment": "Malware payload (Fabookie)", "value": "3097731bc74225579a6a54ffd6722a52cdd84be24e397f611ddb607a255268e93f9fd63b0932c1e0b21b17c42116ad5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214076, "uuid": "94379f63-6ffe-4fae-b0ea-5cbff460f11e", "value": "T170D47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214076, "uuid": "0fc59c87-ade7-4440-ae18-346ca8c1c81c", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214076, "uuid": "f60b253b-f774-4ba7-b0a2-3463eced17c6", "value": "12288:TeE9CMmn1yBvivHTPjPTXzGRDJcqMuGEPnW:qE9jmn1AuPjPTjGRSqMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214076, "uuid": "78ae5d3e-24c4-496b-82ef-34c4ecb17609", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214076, "uuid": "dbfe4143-53a4-46db-8a5c-c8a65b2c809d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214076, "uuid": "f63c2fbe-4c24-481e-9df7-ddb31edf7a6e", "value": "f2ae3234c028d00361a654f755639af8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfd32af-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "7fd503a8-3bb4-482b-ae06-955055848969", "comment": "Malware payload (Mirai)", "value": "3edffd470a6cc76df63bc17bb190b942", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "2272f3c4-74e2-4f0f-baf5-4f20e52abb06", "comment": "Malware payload (Mirai)", "value": "72d5cf3f8dcfdcbcaceed6cf6426569b2e899819401a299548be69033d94db49", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "f1971873-dce9-4fe9-805e-b0a415915804", "comment": "Malware payload (Mirai)", "value": "d1b34d9ac388e65abebd9497507c43b81c5bb86b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234205, "uuid": "58a84151-4940-45b3-8dca-e44ce48b18d0", "comment": "Malware payload (Mirai)", "value": "982cff5ac3950b39289b470adba96945a1333deed9f6ff03645a87004122902f060a545aad55fc286afd5cc393372cf3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234205, "uuid": "05a4f222-f89c-4ea6-8e70-a83f47ae909d", "value": "T112C2E0E53E773A6BDA25003D385DDE368674F016C76EA713A240924C200717DBB769ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234205, "uuid": "af0af871-d724-4514-8ae6-33c26271bd9c", "value": "768:HMwoDZLFbBy6HQHRYfeAxdd80YpvVQ0NL:HolcYfe6KzzPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234205, "uuid": "4d9f671c-616d-47a1-97af-64c7291c0523", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234205, "uuid": "5982cec3-d8fa-46a9-a5da-c57fa8723767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234205, "uuid": "f3b31af9-fb87-46b5-a41e-efce20d9223f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613897ca-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693214106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214106, "uuid": "f7b4e9dc-bbb1-4640-bfdd-34e8c2299ad4", "comment": "Malware payload (Amadey)", "value": "b19ebc6e82f0dcb3f8bee28145254615", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214106, "uuid": "38ef2287-e6e3-4ef5-8d81-2f9a6970f349", "comment": "Malware payload (Amadey)", "value": "74d3bed942fd32f797f40ea43ae51591e5612d673d6c459f0378ab882dffbd3e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214106, "uuid": "e63d1d5f-bd81-445a-b5c3-ff01c723c308", "comment": "Malware payload (Amadey)", "value": "e39468f5f9d374e8f50e0b141be02a2694bbfb88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214106, "uuid": "2bda014c-68a6-400f-aa97-9cbf4339b6d1", "comment": "Malware payload (Amadey)", "value": "55979c22688c33d7437024742bcd60f2983072aa4886b2370fd98c605f12f5f46f8532aa91a1eb667051962abf358305", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214106, "uuid": "f70da571-b429-40e1-b499-18a0e17d5f34", "value": "T1EC6439417952C072D960A1721AB5BFF2C59D68249BB049DB7BC00F76DB212E77A30F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214106, "uuid": "e54e50d6-fdbf-4132-8905-a32da0b90b14", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214106, "uuid": "9e00cda0-bcb6-4936-87ac-2a013f395706", "value": "6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214106, "uuid": "8d048009-df13-4e00-b080-3b7ca03ba4f2", "value": 331379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214106, "uuid": "bed7953a-d729-4ef5-8178-80485a080940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214106, "uuid": "bac781cd-0172-4609-a5f0-85924054c04a", "value": "b19ebc6e82f0dcb3f8bee28145254615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc6210a-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212864, "uuid": "07ab0f0b-d7c2-404d-ba39-815043521f39", "comment": "Malware payload (AgentTesla)", "value": "a136c026581b08648a9cfc2d7cc5ccef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212864, "uuid": "999a403d-b5b7-4a61-82c0-b3bbf576b2c2", "comment": "Malware payload (AgentTesla)", "value": "75ce7197683d85acdc6ab2dfc57de56d252112ca924e22e030571a118910a17f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212864, "uuid": "20c22939-adea-48e6-9b5f-293e9112484b", "comment": "Malware payload (AgentTesla)", "value": "ca00363386ffb5f9c6c2d685c2f4c72de567865d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212864, "uuid": "94dbd6ff-12a7-4156-9ad1-5d86295b8f65", "comment": "Malware payload (AgentTesla)", "value": "72e7df845e59c9e730dd7c638f2146392fb997b18e5fe01143ca1f37a4321ab9d83034d1579b594784b46dc922345b0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212864, "uuid": "0dbe1ac0-d93c-496f-b2a4-f6c2b0841978", "value": "T1F4F423B2E3F4D4949FB3702E95110717F852795DE223F60232AB447B0EA522FAA7425F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212864, "uuid": "12152736-dd6f-4dfb-a297-572c1621f127", "value": "12288:BMfkrBGEbShd8GFS4PnFYB35fyJHF6kvpv0olXsqJbwjjICQzpasfG9e1hXw:msrBGRSOFYJ5fgHF6svIowjjJohA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212864, "uuid": "18c14cff-e9e0-44bf-bed8-85ba4499cf62", "value": 753109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212864, "uuid": "f8ebde51-31b2-424c-83c9-34a6856328af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212864, "uuid": "ca462e8d-6c48-433a-bad2-f5802f121361", "value": "PURCHASE ORDER .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5b29ef-453d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693184035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184035, "uuid": "29b43c3a-8eb0-4042-ae17-e358b4ef6c65", "comment": "Malware payload (Mirai)", "value": "7dc40e7c6a4327e5a57b0d2fb9063b03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184035, "uuid": "acf77686-8285-4a2e-8cb9-8bc9145b184b", "comment": "Malware payload (Mirai)", "value": "75e76718c32af45ab09fe94a1ff87606f077e46c1e5e78b75b52f3a1743da0e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184035, "uuid": "2e8454a1-9e82-4cba-bbce-37e6b7b4cd58", "comment": "Malware payload (Mirai)", "value": "a0a09db5828621471ddf30d60901b51eb277f00e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184035, "uuid": "bf39278a-bf06-4ea8-9de3-a7b3f9b4e402", "comment": "Malware payload (Mirai)", "value": "fc26032e7abac9eab1773204e993e51848c7dc847a246fe8004d25395cca09216add02e26ee8db3d622e0d9d9867c681", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184035, "uuid": "90241054-dea3-4173-8721-72191163b405", "value": "T173C31999E8C24B15C5C513BAFA2E518E33221778E2DF72139D109F68A7CB91B0F3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184035, "uuid": "75d89bd7-268d-44ba-92fc-04f9d27258e4", "value": "3072:eAMPLF7Wu2Xw/Ia/XgkNxkaUx+VwCr7VW22M5o:FMPLFiuaMIaP7xkaUxKwCmMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693184035, "uuid": "db9703f1-5dd4-4f7e-bac7-42dff5d9c4ca", "value": 120288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693184035, "uuid": "b9e5d1be-10c0-4e4b-a9e3-8090ea12b5c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184035, "uuid": "aa1da3de-f48c-44ba-9635-1789c769b23e", "value": "7dc40e7c6a4327e5a57b0d2fb9063b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee672f7c-45d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693250421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693250421, "uuid": "999e1be6-0d18-419a-b167-9dd89ab693f8", "comment": "Malware payload (DCRat)", "value": "c7fc4fba6a117300ddeff12d77a6cf35", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693250421, "uuid": "47e64e24-43b9-41a4-93fb-bbec597f06be", "comment": "Malware payload (DCRat)", "value": "7675c8630359aa83692821a309ba1ac8837975ced6e254b0da1d15e7b200ab13", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693250421, "uuid": "09b95dc6-f7db-4dc0-b13f-c1bc7c71bcc1", "comment": "Malware payload (DCRat)", "value": "799b7d73746f4faec2bd8101e7ebfa8c1b6bacb4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693250421, "uuid": "db56c71e-8347-477f-acf9-37ed9053e337", "comment": "Malware payload (DCRat)", "value": "dfe9e6d480559c4c1a3d41d7dab27186d539f848a104381cdad1b303d57cb83d48c5360a68a789c5f1858530feb2265f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693250421, "uuid": "4f4d1e97-abca-426f-8b22-de7fb518667b", "value": "T1865524D0D988FCF1E9EE6332A6DF82180F1DD9CAB4302DF45A65933F651A304A4B652D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693250421, "uuid": "0a4219d1-d8fd-4d83-9297-5756de102551", "value": "e88a529caf2666acedc4a4b0f2baa386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693250421, "uuid": "1f9bffdf-42ef-43f9-a9c6-dce7ed193432", "value": "12288:Ox1FmC1YlQVHpyuELrQRMUub6342shE740Fm7jVsyOwy+H2ybfkAWekMLGy7PsiC:aQWlnMfHE7zooPiGyj0VkUyn7kNY0gPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693250421, "uuid": "91d16959-5fcc-49fc-bcb3-a6cf361487a7", "value": 1309536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693250421, "uuid": "9268b716-3185-4d81-9af6-5f1d2763d54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693250421, "uuid": "6dc7110d-5e9d-43b9-bef4-8cc6a84221c0", "value": "c7fc4fba6a117300ddeff12d77a6cf35.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267086de-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235053, "uuid": "dbd14ec0-dd0f-4149-aeea-ac36ecb5ddfa", "comment": "Malware payload (Mirai)", "value": "9149022117be0b34fe1f79fc730ae7a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235053, "uuid": "e90abfe9-5236-4791-8af5-2c6106d4daa3", "comment": "Malware payload (Mirai)", "value": "779d4d418a76131c36c6a03a9eb75755f0b2bb0e5dc02a3eee43ccbcee4494f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235053, "uuid": "f3809d37-7279-42a3-b7d0-f724267e1c89", "comment": "Malware payload (Mirai)", "value": "ecda925bbed8681306300b4be991efc3eaae444f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235053, "uuid": "5b8061a9-f06f-4992-b81a-461b4212a270", "comment": "Malware payload (Mirai)", "value": "20c4abc2fc67bc8704c0e9424524e95567a4225914d542194e28a14a3c2660f8e773a526beeb9a2261e949c4bebf3893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235053, "uuid": "296b873a-cbd6-471d-a4bb-3b22310006db", "value": "T1CAB35A73CC296E58D564D1B0B0B08FB92B53A990818B5FBE15A7C2759083DCDF6893BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235053, "uuid": "b565bfb9-cfb5-491e-ab43-324d46121ffd", "value": "1536:oCFO2AMJUWx/iq3xVxE5DEkC0K4wde6X/8qgUAQWn3h7Ev9UL:oE/54DEky428qWQW3h7yUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235053, "uuid": "cdd09011-c7d2-4da4-b9c2-83bea35a0ad2", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235053, "uuid": "5d5807e5-e08e-4fbe-9208-b4ac40089ebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235053, "uuid": "37b9953d-6062-4cb3-a8ff-e8092d6c6f06", "value": "9149022117be0b34fe1f79fc730ae7a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e9c673-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232153, "uuid": "7d8684e5-cae8-42f1-bbaf-99602a80969b", "comment": "Malware payload (Mirai)", "value": "ad67fefb7a732ce2cd9cfd5ac7fbe049", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232153, "uuid": "b80c9ce7-1fae-4b9d-a85c-458c249e0a84", "comment": "Malware payload (Mirai)", "value": "796868e0a12ed25034c51c30ae820ff65fbd235f1306c6a6c88bdde10b7e1ac1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232153, "uuid": "8b76df8c-44a2-49f8-8a25-a846e436e147", "comment": "Malware payload (Mirai)", "value": "015c322e4acb7db154d129c52813e44bcb8908ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232153, "uuid": "7f29f53a-1a7f-4452-871d-8ee17ee3f998", "comment": "Malware payload (Mirai)", "value": "1bf8352a822e610247110a330a3c4fcd2f0b8e65e9c1bc7a87b9784a4cc70f848eee46065f5f2163ceaeada8712cef75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232153, "uuid": "4f4a94e7-dd34-416c-a79a-51e3027cccd0", "value": "T11EF31A46EB408B13C0D62BB9FADF424533239B5497EB73059528AFF43F8679A4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232153, "uuid": "0d21c862-5508-41b0-ad4c-d3bb300a74e2", "value": "3072:z621WpoWkYaazkqzZoMDMsCX8Fe/yR7ZkonM/ROj7Xud9:D1WGxYaazkqVooyqe/sznM/ROj7Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232153, "uuid": "6f8607a5-4d2b-4c2b-9715-03cc68f7e9ea", "value": 171914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232153, "uuid": "478642d5-fa1a-48d1-a36f-7f0cb74ee360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232153, "uuid": "ebce746a-8874-4768-88d4-48848430feb9", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4cb77b-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "fe3f0c86-f47e-4b9e-94c2-f5557901d299", "comment": "Malware payload (Mirai)", "value": "a1db6d39635264dd700eb037569d0393", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "ca697c97-8c14-47d7-88d8-05a6eb9ec469", "comment": "Malware payload (Mirai)", "value": "7a37b2fca2de70386a6ab1d5838042ac3ee5bc1e83ef55208d679c3a59372906", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "397eb202-8fde-45e0-aa6e-b2d89ed06d57", "comment": "Malware payload (Mirai)", "value": "fcc47e8ed36acc03f22a7bb38ac4b248c58953e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234207, "uuid": "c20ae42c-f00e-407d-8688-07f38af37011", "comment": "Malware payload (Mirai)", "value": "089f900d96d3bd011cfe9222097ecf254dd3296c324b36ec4d14fa2f0990b3d185b98ac04cb86a97768b41d982413344", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234207, "uuid": "4074c26b-e2ca-4be8-b3ca-767bc39af01e", "value": "T109C2D17096ED1CB1C7600573F7B85AC9BE520F7DFAEE3890214147BA7D4190529EA8CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234207, "uuid": "4b01eb47-6feb-460b-9c41-0201029584fe", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEvyWpQkshymdGUop5B:A7soTAZ3alkXLvFh8nNEvlas3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234207, "uuid": "314a2d2e-cfad-4fb9-aae9-d15687a6425a", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234207, "uuid": "0fce4ba0-23a4-4582-afc7-1b435b8fdeba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234207, "uuid": "e00c64bf-5047-4a96-94b5-b7a77a0d15f4", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ede8dcf-455c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693197218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197218, "uuid": "538a5705-8608-4433-83a2-6dd863a9ecb5", "comment": "Malware payload (AgentTesla)", "value": "9608e5332caeeeb2d5b22951ab2815a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197218, "uuid": "2ec2695d-3b22-44a6-a5a9-a350abe40ba5", "comment": "Malware payload (AgentTesla)", "value": "7a3f9e8c7610b1b6bc6433234fcc92a41834657cbe2f0bf74442d772df664568", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197218, "uuid": "5d676205-3177-43ee-a838-bd9ca5ec483b", "comment": "Malware payload (AgentTesla)", "value": "9e6df259ca094ae71bb5e0cbbef67ef565a4c14b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197218, "uuid": "aa5b0083-906c-46eb-8251-7b43cc6d9043", "comment": "Malware payload (AgentTesla)", "value": "2332b97774fa0d6c3bd1d51cc64f2ac4493ed985bd0bb3b9e855f8159f631c41f40af480591df086fdf9bf5bcb0cf4e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197218, "uuid": "77971acb-3162-4c60-afb5-e7cec031502e", "value": "T1EE059403BA878DB2C149573EC7AB8C241771E5837A13F60A758E23695C437B76A49F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197218, "uuid": "f7c9de7d-7eb9-4381-8fba-709ff40a09ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197218, "uuid": "9ee0369a-15ce-49b8-89f8-3d66815c0562", "value": "12288:3Ev0Fby3IByTMUrfjNtN3UQDdwZjaTNq/L/+qdteqXU6kpUW31O:0v0NwjtNkCS92Nq/r/Cf31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693197218, "uuid": "4b1dde6e-6227-4d7a-9bce-2567a6351da3", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693197218, "uuid": "b23bd684-a8a8-4504-ab32-a799e9c21186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197218, "uuid": "f961e4ef-8492-4d8d-8cb9-8f05c521b202", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.4900.8862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345eb7be-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229064, "uuid": "57875b74-e8a8-44d0-a323-fca798fc0737", "comment": "Malware payload (AgentTesla)", "value": "341dd1a8ac9ed32e5b5f27af48fabb2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229064, "uuid": "f5dfa401-773b-4eee-b3db-29858aaaaade", "comment": "Malware payload (AgentTesla)", "value": "7a93579b3be38115cba7d6a42aa9d26c39ba8b2d31e74602187bd8884b931690", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229064, "uuid": "ea96afcc-5aa9-4003-bff0-0dfb2a00194a", "comment": "Malware payload (AgentTesla)", "value": "8b62b525fbfd81e3c978043bf23dd192d5104d9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229064, "uuid": "106aba72-4989-471a-90db-39c0323161c7", "comment": "Malware payload (AgentTesla)", "value": "66d682ca0a1fa9fefb446234f08f7403e07d235d2628dc57e704010dd7ed3d37348d5cbfb1ccbba21e935601db49714b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229064, "uuid": "b085a931-7572-4d4f-a5c0-4556543390a7", "value": "T14DD423BEA03CD11A9407446BA57F2F192D33243BE91857CD18389F68A96DC119F738F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229064, "uuid": "d8a93720-b6e8-48b8-bea4-c1c774a3f63e", "value": "12288:4HvOiqw2Zwt37nafQCo9VlW+53CdgpKgbNIFog6ywraz1hWM/V0DQFbQvL:4vOXw2yihIzWoYGKgqFog6ywr+N0UFkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229064, "uuid": "d3e631f0-ebc9-443a-a6eb-2d7ce80c7936", "value": 599019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229064, "uuid": "81fbb194-c549-4954-b490-be88171e88e3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229064, "uuid": "b563b07c-4ae4-44ed-844d-72f7c630d8ac", "value": "PO $120,000.23.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b8c2d0-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228313, "uuid": "dcda53a7-a511-4d2e-b716-67400669b089", "comment": "Malware payload (AgentTesla)", "value": "2d23499016373c8b4a458f5e2c296164", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228313, "uuid": "3e7e45f5-edff-4086-ba10-f76ab446e6c3", "comment": "Malware payload (AgentTesla)", "value": "7ab7083330abf0ed2be1c4021d8eca50423f48f988aa80f587c924c67caf6357", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228313, "uuid": "63e5786e-73b9-4c3d-8a40-cf725865f36c", "comment": "Malware payload (AgentTesla)", "value": "722fb05b9e9f2093c2336e5b0c876b9c1cd093e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228313, "uuid": "a2640d65-816f-4a3a-8ce7-44b6d7fd1631", "comment": "Malware payload (AgentTesla)", "value": "cffd0773acbdba75c0fe7f5137291e832415dc36b04dc2bbdb57fda5b8a67c166342b3949ca2d21c5c962c207e5cdd4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228313, "uuid": "66fce06c-912a-4f07-97f3-874f1e77bbaf", "value": "T1DDD43384741D7B01B2161693D94E0B589FCBBD7BDBB079858128B3C9C78C005BBEDA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228313, "uuid": "a7d7dd11-9335-48fd-9398-9f26f0b5c226", "value": "12288:Nzfo/ZlBwdz3uP/wpcAMhvuBXDM3N0Dp5F14MOo1sfoLzyF:NzfGzidDuP/mcAMh2BXhF14P5myF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228313, "uuid": "bfc0366f-41dc-4bf5-802a-7a2c74ab31cd", "value": 609462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228313, "uuid": "a176b397-247c-4d35-867d-d3b587719a48", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228313, "uuid": "a15ce2cb-1c45-4f60-83fe-0d54cf8fc241", "value": "QUOTATION.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b9c31d-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693209170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209170, "uuid": "16b6b382-414e-40f7-b3fb-dc1cc1bddb01", "comment": "Malware payload (Formbook)", "value": "3dad58acd89c8445e7825060d82a37e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209170, "uuid": "c470a023-e9ba-475d-a74c-ffd3c5d8cee5", "comment": "Malware payload (Formbook)", "value": "7b004dd3597a83a76fe18e9e835a7aa46b1164bc6309f6b3b4a663ecaf1beb09", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209170, "uuid": "502378a4-d88b-45b3-92ab-c8bf1a756616", "comment": "Malware payload (Formbook)", "value": "1f300d528df2380548ff12fad220e29e13152e53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209170, "uuid": "53baaf44-f9a1-422a-9c1a-0db4956d06a4", "comment": "Malware payload (Formbook)", "value": "6265de3bce3b969ba076dfcc7fa78357dfe1b86f7c7667ed53f3bf218a3d3bdc029e4d73ccff44a2d6e3eb5bc214aa36", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209170, "uuid": "4da4c169-2031-4a4a-b395-ba278dfa4296", "value": "T173C423222D3DBD1B42C1BB464DC6A3067264E3E6E7C219BEB11517CD5678FA9BA313C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209170, "uuid": "0afc65db-f075-4e0f-b3e7-d5afe6e18dbd", "value": "12288:j0YiYF6rXdk4ivjac97qt60kt3tpkPI9w1nQ7mCC1peKQz0H82oyc:tiYF6rTiv2yWCt3Jm1nckozZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209170, "uuid": "0c136022-44d2-48cd-aab0-d86757b0d595", "value": 588704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209170, "uuid": "6ac99b83-877d-4f76-96f1-b2cce4e3529c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209170, "uuid": "b2f51619-d5aa-4315-a9e3-c55b07e5251b", "value": "Proforma Invoice(1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfff9cb-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "5a707fa2-d3c8-4167-92d3-bf479a0c8225", "comment": "Malware payload (AgentTesla)", "value": "e9bba37f730e97e15b77aa12238578c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "54b7a1d9-0d49-4275-a2f4-30ac9439e8e2", "comment": "Malware payload (AgentTesla)", "value": "7bfb46f4c55dac1e9f9181216d2972c632ae36e8dd7874eb03d89fcea16ef43b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "a9d71944-166e-4d9c-b0eb-9d69005ffbea", "comment": "Malware payload (AgentTesla)", "value": "a4204d038a4961136ec3aec7391ecbd4875f19b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229909, "uuid": "09299c86-6c46-4e72-a710-9e185e6f6454", "comment": "Malware payload (AgentTesla)", "value": "6da12233e38be408ae04a43ff991d64782018096cc635979f491c72ad430b8f6543bf8982c88bb503e30480df8a9d6a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "52a3a6e9-d141-4e6b-ad09-3012eff70a1c", "value": "T146D41245B7A88B1BC0B90BFD0AA0861443B86F95A522F61C8FC7FDDAB4767100661F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "f3e37a3c-31ae-44c7-92ec-706c6e3d52e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "634b8ebf-de50-433a-8c5b-9168da61dbcd", "value": "12288:uPYPfY7bpOiVM0l0wf3Xbleca0k4V+2/npAv9:uPYPgEiViwf3Bep0+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229909, "uuid": "e2b4804a-4753-4567-9db1-4993059957cc", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229909, "uuid": "81af194e-2894-4492-8582-3c67027ffc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229909, "uuid": "029f8e34-bcea-41d0-90fb-c9afaf5457fb", "value": "SecuriteInfo.com.Trojan.Siggen21.9825.15288.28742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5286e457-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693214082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214082, "uuid": "0e56762e-cafe-429a-9a73-103c5ebb482b", "comment": "Malware payload (Fabookie)", "value": "004a327d652788f5bc5fd38ea3ea69e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214082, "uuid": "0e575746-ba6a-4ad0-a62b-4df3b9c10adc", "comment": "Malware payload (Fabookie)", "value": "7c153ecb0cc0b6c1c4d3033c806bee89285db6e37902df15ebc4c85b46f24338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214082, "uuid": "6b4225a2-8bd7-4e34-9d86-0ff5c02ca4ef", "comment": "Malware payload (Fabookie)", "value": "7b23829f204f800a08999af58f7e4933c2d59898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214082, "uuid": "098fdd4e-8904-4a8d-8195-b61984764a06", "comment": "Malware payload (Fabookie)", "value": "27db9569c96a782df7d72afb61e8c08e2b73a6e690a5a94086494d365d47fae0ed1c99b4ef79a9b23fdf4130dd1f0ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214082, "uuid": "e407c305-c9d3-4564-ac32-b64cbda666c4", "value": "T14C949ED2E25040E5D477C2B982734B62E7F27C285F214ADF4659B6292F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214082, "uuid": "83c405a2-38c9-4abd-ba1e-9b7d95d65cd4", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214082, "uuid": "db7c3e7a-a059-449a-9785-5ec1d7a1ab66", "value": "6144:ul073J3gYxsK4ibO9rADW64t0+eoJAbB3T+cbJp:z3JwYiKdqEU0+5cCIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214082, "uuid": "4a6781eb-e2b8-4793-9c69-7beed60400e7", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214082, "uuid": "da262f2d-f97c-42ff-a94d-29c9f7f4c3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214082, "uuid": "cef0005c-7a8c-401e-be89-c6bf997dc882", "value": "004a327d652788f5bc5fd38ea3ea69e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebde27ed-45dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693252994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252994, "uuid": "8b5f258b-13f6-4114-97d0-38bfd0ae4256", "comment": "Malware payload", "value": "f3b0e72e66e1324a2ab94285f069501a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252994, "uuid": "73b2717f-77c2-458e-86f5-16eab59f74e3", "comment": "Malware payload", "value": "7c796e8277fa41ad68ee1a5bed21591ddac49195de6285b628e9d6265ecde2ca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252994, "uuid": "2fbb6c31-6f90-4d5a-b927-bce3ee2a9448", "comment": "Malware payload", "value": "d96cb05ee0d622d3cab1c163bddc5e1d8e5280d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693252994, "uuid": "11eb6e2c-bf73-433a-a358-2e370fe214da", "comment": "Malware payload", "value": "7ccb8c8ad5cca940f12ebd1463ebc78ae48d6a3c45a0514f32e798bc07a1108e61c3467160ef2bf9a74b7a89cc03f913", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252994, "uuid": "ba79385b-30d5-4cbc-8201-23bda5be0bb5", "value": "T12B06F8F472917EE60FB4191CB38F80B26C27B867F17E5ECA2296195DC5C4244D9EACB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252994, "uuid": "2862e26a-0a3f-4af8-ab55-869ae12c5db2", "value": "49152:KHEsW6XqiNJhdW2QwkV++sNUrw2CatUbUt:vcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693252994, "uuid": "60b782f2-d0d4-489a-9a96-f6735b4819c0", "value": 3882784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693252994, "uuid": "b06a8bc4-4903-486e-b28f-df12a3885ecb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693252994, "uuid": "8d21fb3e-fefa-4622-a42d-6b02aced44d3", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3b68ee-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238178, "uuid": "81f384a8-7db6-465e-9a80-c01bca0635d3", "comment": "Malware payload (Mirai)", "value": "939fe1fe9e29de9d81990bf2d3bbe3fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238178, "uuid": "532d9628-a7f8-427a-9734-6c29a4dc0c2b", "comment": "Malware payload (Mirai)", "value": "7d433e838220502bcf905d3ca6758e67e06ce5675d3461d9811eaac32b5cbea3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238178, "uuid": "21d56412-3971-4a31-8ace-f9e8f0cfeba5", "comment": "Malware payload (Mirai)", "value": "e5178011cd9decadc9c483f846bd83a10113c8f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238178, "uuid": "0e5dd186-c1b8-4897-b7ad-1c155ab72a95", "comment": "Malware payload (Mirai)", "value": "571e17d30962b7e60f97f8efc31aa9596432605a60adcaf01bd1beeb5dbf3c7e99f75cfdd1ebf959c3128a7a43f78e26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238178, "uuid": "b191f63c-e09c-4d41-8fc8-4ff10b49dbae", "value": "T1F1432885BC819A13C6D0127BFB6E028C372627A8E2DF7307DD266F11379692B0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238178, "uuid": "0d0142ae-c1c7-4ba5-a3d4-60d7ffa26d61", "value": "768:melU9Ov37eFDd9RR93P3C0qeCKWj+sB/N+khm8pMiJzTHR7XoDXVcxbvJ/I:FU92yFzR/fC0qemxBNhMitFXozwbvJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238178, "uuid": "161a1a99-87f9-4791-8f0b-bff0d5b52283", "value": 56380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238178, "uuid": "277e3df6-808b-4ae3-aefc-4c44f37a5c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238178, "uuid": "0d23109b-a444-4f5e-b698-9f9a1f9cd300", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2763639d-4590-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693219593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219593, "uuid": "3c61458f-0f3a-42f7-9961-8deeb3f9a4b2", "comment": "Malware payload (AsyncRAT)", "value": "cc24fe23ca0a4e00e4bc4c2e8b96a74a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219593, "uuid": "a4784653-3cf4-45ff-8403-791b8078e182", "comment": "Malware payload (AsyncRAT)", "value": "7e381d3ddb444239382c13e96c55db0f72b6d13f5d63ad4c5b04d86138d1aeba", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219593, "uuid": "d43e8c6a-5037-477b-a617-a40e7da9e5ba", "comment": "Malware payload (AsyncRAT)", "value": "357eaef9343024bd9542b8ac73fb502e2f3e7afb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219593, "uuid": "8a12373d-a7c4-4cc0-8cd9-3ae95a784172", "comment": "Malware payload (AsyncRAT)", "value": "211cb4ab4872f98e18109d47b6a0c786d90fda028a0183fa71997292e4cc57fb2a2e1cc56ace4a2ff36634e55906b9a4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219593, "uuid": "3a9f804b-ab68-48c4-aa09-6abc50ebf7ee", "value": "T171F423319DF3CD2F1AD867357A587E9526C31E9840A8FBBE95CB11BE047EC02505BD22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219593, "uuid": "83c6e4ad-41f3-422a-8695-ea5dd2414dab", "value": "12288:0Vji+DSNWQO8tBnYn5RN/j/NUF1GJ9ZplsF9hEcQcNFwkRjY0cvR7F5uGykqI:jWQOcnYn1yyJTLsF9KcQcNikRjdcJ7FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693219593, "uuid": "cb1db383-6f02-46da-9749-75799356393d", "value": 769537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693219593, "uuid": "22d41ab0-daf7-42c5-9215-adef823ff979", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219593, "uuid": "a3529647-794d-437c-adac-3833a39f826b", "value": "2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc06263-459a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693224083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224083, "uuid": "0c13b457-eadd-4717-85fc-c14bd27d92b6", "comment": "Malware payload", "value": "3eb6d13afd7f595c18ec9e2077b09b92", "object_relation": "md5", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224083, "uuid": "eb9a586e-25ed-4219-a1a9-629250699924", "comment": "Malware payload", "value": "7e9e46a00533d741e4d9aaed4716eddcac6f7470bdd2d2366e13a473c11ac7e3", "object_relation": "sha256", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224083, "uuid": "8f23064c-833f-4cfd-bb45-ef28d0af7096", "comment": "Malware payload", "value": "948ed442e80e6dfb2a67180c8774e0477770103b", "object_relation": "sha1", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224083, "uuid": "41b348d6-9cb8-46e8-b18f-1916fa2e60dd", "comment": "Malware payload", "value": "5ee6cb55ba19770d65f3abb75dee29b40b284b00eb17ebd1683ae7f5edfa41bffd17db63a0244ed2c97b04568c6caaa2", "object_relation": "sha3-384", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224083, "uuid": "60f73afc-1737-4f0c-b5a3-01b271864094", "value": "T147D41253C901DB43D6B217F9A9278CE0768F8B567000A9CF44E95E0F0E98A871FDA6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224083, "uuid": "1a2f0288-93a7-4fcf-8839-9cd9f1f34349", "value": "12288:feOasHX4me0ckfU6bw6QIOVskgIJkMvdZZuZf+6h:feTM1e0cWE6wPWMvdof+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693224083, "uuid": "6b048b09-a8f8-4a25-b454-fd8fb42c14b7", "value": 641293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693224083, "uuid": "b8730f89-26e3-455f-875e-b978856e5fcf", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224083, "uuid": "6915cf62-7257-44c0-affd-75c57cf70b0e", "value": "ACTi_Products_ST0%0D%0A (3)_20230821061649.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4e3689-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234206, "uuid": "783a495b-0c5a-44ca-9f1c-8d57eba2e9e3", "comment": "Malware payload (Mirai)", "value": "cf673115e47924ed8d24a331c4be53d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234206, "uuid": "6fe65f1e-e851-4d3e-9949-cc2cd69b5466", "comment": "Malware payload (Mirai)", "value": "7eae2079fe5315e2f9b3f4016b87dd53b4e437a00101ade3419c5aa7a2f1a0c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234206, "uuid": "7de62ede-bc2d-4381-bba6-1afdcb1e0177", "comment": "Malware payload (Mirai)", "value": "420c7668c9fb05e4e427755b78bd256678fa47a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234206, "uuid": "61c41d34-d7d1-4fb0-bd88-2f56e99872e8", "comment": "Malware payload (Mirai)", "value": "dcc4d92192ba4792239a791919f47d47fd3d5b36db69cf203ecd1e672376791b1848200429e68517b9d9f595ed684e05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234206, "uuid": "6fd45bcf-5794-4fea-9c82-9f09b883383e", "value": "T1F833F2725B6E29E251B09377BC33FC5A629C17E89C7730D62CF0A61577C58024EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234206, "uuid": "f4b15325-143c-45ca-ab72-1c7d527a334c", "value": "1536:j9O/ZMAXIxNUk0zwfLcPqF1aBexo4opKZbn:j9O/ZNKyHwfLGqFUFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234206, "uuid": "7a1265ec-3555-474b-a8d2-ca64492e44b2", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234206, "uuid": "ebaf3177-4ecf-4efd-adbb-a2a5ce7a7c9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234206, "uuid": "1287cf76-3d18-468a-8598-7a111de93ab7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a20092-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228470, "uuid": "d7deca8b-8be3-438c-bb2c-60d291897dfa", "comment": "Malware payload (AgentTesla)", "value": "0a46639be287efdd80c383559c102d6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228470, "uuid": "bff09b5a-d168-4c65-8b00-8b4c444a87a5", "comment": "Malware payload (AgentTesla)", "value": "7f9dbb80b521659c42f8ea8199a508f454a5ebe4a7960f90c15f1f1f9f4f471a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228470, "uuid": "8b08636e-3430-429f-b753-4989e4d53830", "comment": "Malware payload (AgentTesla)", "value": "8dfaec552cde46b3bbc05afe349dbb0034099fb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228470, "uuid": "d711e4ed-3344-4877-9373-7599ae03faf7", "comment": "Malware payload (AgentTesla)", "value": "69ba5882faebdfa8353875264f04a3f1d60efb973146f22319786ebd0c400a1d4844bfd52bb17874074ceccf8cba281f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228470, "uuid": "dc924bfc-8ff0-4494-bf3f-33fa33439c0a", "value": "T10BE4335AB224B62B2D01BFD8DA0E57E753237C3497D216072FB0A9B3C1461F9394DE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228470, "uuid": "86a5fdd3-da62-4997-a333-416c95e1824c", "value": "12288:tGNk/pN3wzUep9XTWd39CrwtRKhIENylDEvQ/fFmEJhrHD1ONqN1rKUaD+6gaW:tKcN3wzx3TrwjKCDNVme5CqfkD+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228470, "uuid": "5078b5b8-0959-4fcc-9f01-8ee97584c008", "value": 711772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228470, "uuid": "34153bee-4aec-431d-af89-7ec5da1645b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228470, "uuid": "054a7f17-a242-4f9e-9efe-04832521da87", "value": "overdue invoice pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6dca3e-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209506, "uuid": "f9f62a8f-fb71-47d3-abbe-e22c7f2c2e59", "comment": "Malware payload (Mirai)", "value": "16f38769ad44608f8732b4c2f799b0f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209506, "uuid": "3deadecb-fc32-4147-898a-1ef64e0beba7", "comment": "Malware payload (Mirai)", "value": "802c9e5ff9e319ffdd42840e1ebc5115e6918f2173fb51a4025f115191667152", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209506, "uuid": "212f60dd-d184-41ae-bcf2-2e80abcb6286", "comment": "Malware payload (Mirai)", "value": "c8b921210caeeb410d302575ca76882a03e7967d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209506, "uuid": "f0f6f876-e5ba-4240-8f53-b82a9d645033", "comment": "Malware payload (Mirai)", "value": "61ddcd69ead68d51301b7e710d2213938ad68bd1b0a9391f880f4b2759690aea0de1ceed39e52c8928cb9a4327a4a3af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209506, "uuid": "80db54d1-9658-4288-a011-60a96896eb5b", "value": "T1B7634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209506, "uuid": "6156ab63-deae-40fa-be2c-0c7c17329055", "value": "1536:ZjVO2KsrO4zb5BdhgBpTaQnQSe1ECj5ds:CPsTHdheNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209506, "uuid": "cb1d3bb3-7d0c-4054-8559-9bf7f6a588aa", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209506, "uuid": "e34105b3-3a6e-468b-9cec-f0ac78b51fb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209506, "uuid": "40126086-ca0d-4156-b67e-08dd120cd943", "value": "16f38769ad44608f8732b4c2f799b0f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b434fb-45e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693254841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254841, "uuid": "b87f672a-994c-4098-9569-e012a6bd8df6", "comment": "Malware payload (Mirai)", "value": "1f32ef3ae1d01762f225468594561e5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254841, "uuid": "9cc6f18e-75c8-4897-b378-37cbaff4c38e", "comment": "Malware payload (Mirai)", "value": "807e6006888a9ef7392c042b58e83f95a34fed41ef46481026e4ceb9dcf0c587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254841, "uuid": "3ae48362-6b1a-4bea-90a6-adf200ec4801", "comment": "Malware payload (Mirai)", "value": "3c97aa4ec64b8efaa1eb3d780fb47da919267167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693254841, "uuid": "c2b33d0d-4ea1-4daa-9547-d3af24d2438c", "comment": "Malware payload (Mirai)", "value": "b1a0bc9ac990b1d83090dbbda25414ec71c92914f04731fd88d4ffefcc1b268d60d825abacb96db83c92f6c9dc5d999c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254841, "uuid": "a6af75f5-c0df-4a6d-b1d1-acd67aa4be24", "value": "T129E2F197D372A452CD787BF1F52E86CB6BBD4B6CD17730A31615561829AA0434E3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254841, "uuid": "47dfb6c1-81ee-4b8c-955c-4de64c3447d9", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9XHuDM9q3UEL5Il:uorm1vpALgUJWLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693254841, "uuid": "20f43eac-96f0-4407-a0f3-51f06a8b1b99", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693254841, "uuid": "624eabe2-b317-4ece-9f2f-27b91a31e607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693254841, "uuid": "d7311a03-e01a-4d5c-9490-1154ccc582a8", "value": "1f32ef3ae1d01762f225468594561e5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651c2e4d-453d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693184048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184048, "uuid": "a58b5ad9-6e76-434f-b2ad-0488c73a4fcd", "comment": "Malware payload (Mirai)", "value": "b732018c639dc714308f71f435d93a69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184048, "uuid": "5f700b2f-f4b0-4893-ba86-1ab2bc1e6488", "comment": "Malware payload (Mirai)", "value": "809a6859304b29a3e067bc028ec71a60593a963db1fe917dd3004b7839597918", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184048, "uuid": "7cf16256-7221-45a7-af21-3e80347fd01f", "comment": "Malware payload (Mirai)", "value": "eae731f3376b5f28a09b5eaf30f1a5a72d186236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184048, "uuid": "6e52bc5f-353b-4cfe-83c3-f3207fd7b1b1", "comment": "Malware payload (Mirai)", "value": "43bedc868db9cacfd32399a35bec05ce9c98ed8d3ba7fae85b7fc9167dabffe99f9e1c0ff042008e8810c56d6b854198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184048, "uuid": "5302810c-bd4b-481a-84d7-b59636e878eb", "value": "T18B73F782EC925B2BC2D013BAB6BE118D3361A3B4D2DF3152DC215F69778950F4D77A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184048, "uuid": "2c5ee9d9-7b16-4798-98b3-05eb2aa78346", "value": "1536:CTDPW7ytzUcRnUrQup5gYQjbJ3d5h9X8Si+LSH:aDeycVQ/JNPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693184048, "uuid": "3d3089dc-ef2c-452e-b866-27f10f98e688", "value": 75164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693184048, "uuid": "1b44baea-6414-4cff-bac3-ec6c1e2a1cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184048, "uuid": "fb3f4560-0935-4d3a-b7d4-9b75f765de96", "value": "b732018c639dc714308f71f435d93a69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7554678-45c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693240558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693240558, "uuid": "83fcf080-6853-4f93-8988-0ada31d6e6eb", "comment": "Malware payload", "value": "52311e9748e000af74873436d80a8629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693240558, "uuid": "7f5f34e4-19b9-4b41-abc7-fe8e223c9a03", "comment": "Malware payload", "value": "80c911bef098606c89bffa959999956ec89f3a2221f96fab5359374e2473ba9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693240558, "uuid": "732188f3-deef-4904-93d1-13eea14719f5", "comment": "Malware payload", "value": "38573624ae274d3617da62386acd86eba6dc4c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693240558, "uuid": "002899df-6af6-4820-ba53-b20501be752d", "comment": "Malware payload", "value": "6320132b847b4e8cb91baf891f6b065b6e3822ea2d200d43c2beec41001d44370164021c4018d2109e2addf03a81cc7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693240558, "uuid": "1b66450a-d2e9-4f93-bc33-1d2a6275555e", "value": "T114045C00B4E2C073D877053149F9D9B59A2DBD210B649AFB77D80B3E4F306D2A535ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693240558, "uuid": "fe71282e-12c5-4232-8365-a29d5ca8094c", "value": "0954beaebb211de35605a05432b8cbdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693240558, "uuid": "6f1ad914-c816-4e26-8352-3ade79bb9822", "value": "3072:v3045s5qBPmhnY0SJ15+kuvZZpNthk973OEFJiPAg0FujkvPl:vScFm+n1Ek0N5AOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693240558, "uuid": "c8e48494-6970-40ac-9901-fc6d29cf6d4a", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693240558, "uuid": "6b29f082-8c43-475c-a969-9721d8327376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693240558, "uuid": "8b6b4150-71e8-4a75-846b-320789f4a174", "value": "SecuriteInfo.com.Win32.PWSX-gen.29331.30206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d7e533-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212792, "uuid": "02bf71f3-f223-4024-9e0b-2822caf19f4f", "comment": "Malware payload (AgentTesla)", "value": "15248a8195d4cfdf095ce49a0af3b029", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212792, "uuid": "dba94dd4-2f4a-46ca-bb05-82d6647cfa8c", "comment": "Malware payload (AgentTesla)", "value": "80d364f78cb0db515317beca01125013fd3bc60eb5f8319f5f56156f31111736", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212792, "uuid": "28286d55-9187-43d0-8e30-71b0e0224c48", "comment": "Malware payload (AgentTesla)", "value": "53a4710564a76238b9383c431bc9693985f7c684", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212792, "uuid": "d3a79c09-1753-4f59-88bd-be790afe786e", "comment": "Malware payload (AgentTesla)", "value": "312457cb69721e2c88fb08a2b60ae9ea5c3e993b37ba248950c15cb267920e1feea4af2f70fc2ea568ba6c1114f58403", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212792, "uuid": "6244b7bf-49b0-4091-bae2-e9e2d1e321e8", "value": "T16945A3ACBD9C5187E728CD28669F243C1C26D6526D2AA384DBB7C4D71FA01073A5DCE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212792, "uuid": "a7e74aea-d26d-4db3-b79e-23e8333629f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212792, "uuid": "898250c1-a15a-40ee-a52f-82e7b65464a0", "value": "12288:dOlrf02iN25cSWreiZdkqzI29LzvZNJffyjCoxe4ZP/gk6o4Zrb:d4f01s6eiZFI4LzvZnfSBe4ZhJIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212792, "uuid": "24ad6abb-910f-4229-a589-036ece821dc2", "value": 1230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212792, "uuid": "2cde71a1-b694-4773-9e03-64bed32b7502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212792, "uuid": "ac1806f4-d576-4464-94ea-4e5f9ab3430b", "value": "DHL Overdue Notice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2388f635-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229894, "uuid": "32782832-dc54-488a-ae75-94cdb5f778da", "comment": "Malware payload", "value": "3e1cf6f2494eb53bca88b2c3fa457d2a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229894, "uuid": "9073b2a5-b9db-4f0a-9de7-c74501444d4c", "comment": "Malware payload", "value": "81163131a2ec3fafb14d43e570ba4e31fef55653b4082b00aaf214c90ecc0f7b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229894, "uuid": "a76035f5-6d97-4adf-86ac-e724eebbcc65", "comment": "Malware payload", "value": "65f34f8f92c6a3b4ffcfb8973880ce224ef5cea4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229894, "uuid": "e45dc106-c3f9-4567-bb31-a0586f4a55a1", "comment": "Malware payload", "value": "2bedda62c74f5ad43338a69487f4ac8a40ad4f69143a9d09ca511b46a8efd16f62114a2bbc13894d8b368972559f53cb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229894, "uuid": "a02b7e35-6c38-4aa8-a51a-ad1e0afdcfe4", "value": "T17D152390EE514FCBCB461275D802EE6612E5FDAE9B89F4FF8394B11A123F35601DB812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229894, "uuid": "ea668eb2-3bfe-4942-824f-b14b9cacbb02", "value": "24576:MeI929OyxVTqRBHacQ+HDWJ3UFREvk8JqACY/kDts:MZlvpSJWvzACj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229894, "uuid": "151fff75-8225-4dd8-bafb-aaa0d94dd556", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229894, "uuid": "06a4f0df-9c11-4cf3-9eaf-c4d688b53f01", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229894, "uuid": "0f775ac1-b9cf-42a1-849b-1089ab4191c9", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.22855.26260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4668fb51-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693223081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223081, "uuid": "e8bd985b-504b-44dc-8de3-8f74b3e87bf1", "comment": "Malware payload (AgentTesla)", "value": "1af86ac12866629b9f97564e00f54554", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223081, "uuid": "47259c43-688c-4164-bf0e-a2fc32236810", "comment": "Malware payload (AgentTesla)", "value": "820803b6b2db0cc4c741621bf2b973691a3ff9317e2420ce7186287e19a8f0a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223081, "uuid": "a99c5c0c-5543-4580-8cdd-b2635fc81be7", "comment": "Malware payload (AgentTesla)", "value": "fc810ac535f29b4ad23250467e1ce8347c072c8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223081, "uuid": "66730eac-0e2c-4b55-9a74-0c22d2d3216b", "comment": "Malware payload (AgentTesla)", "value": "167b540ca70fc28bc1ee444effd24776f6dfbeb5e6b76f12d2c676b8cb27015d0b8a07c8174e578155d6fb611be62fbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223081, "uuid": "8ae41e60-fe29-49e2-aa02-7378e69e27b7", "value": "T1F8616F3D5F554342BF991D63901B58FF5E102213BB472C55C1073A197744EE239F219A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223081, "uuid": "f8e26426-0503-4fa9-adef-1c9970cbc8d4", "value": "48:0oK/idxw939NxmfhuCQzvWT39vbvKwsRTIKjVYWV4XoFAGyL00CHg5MKIGh0y2:w0a5xmfzGE9vbKrRvjVN4YGLP+KIQ0y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223081, "uuid": "0c312042-b21b-4db8-90cc-8c368145f5ce", "value": 3252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223081, "uuid": "fe7353e0-a5c2-44dc-bf13-f0307d8c40a0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223081, "uuid": "adb1b82e-229d-4a07-981a-2b965af3c812", "value": "DHL OVERDUE LETTER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556fc846-453d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693184022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184022, "uuid": "23647be2-ab61-4ce8-8a0d-fb24ec67736c", "comment": "Malware payload (Mirai)", "value": "d0f09a66eb731c06c51b72f3745bd9e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184022, "uuid": "980c2235-4d27-4290-bc2c-fe128e9817df", "comment": "Malware payload (Mirai)", "value": "8226a98079e487b193009c50947a6fc2894c099c842d292006fe476daee68103", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184022, "uuid": "8e0b5095-aab9-45be-bdcd-31a07ac3242e", "comment": "Malware payload (Mirai)", "value": "22d8ef0b988a55d370a0eb8f984f03f0e3bebbcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184022, "uuid": "d4f7fdb2-c761-46c6-ae7f-24eb8cdb2ec7", "comment": "Malware payload (Mirai)", "value": "98d3f7c47e63acc9eebc36145b2d8f85427dc95ff44f13482f87bbd1e3d34f8463ec17e1bbb73ac139d8b9a8ed45cf13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184022, "uuid": "16d9cef5-ec17-4682-8bed-df825e5e7f57", "value": "T1E4144B85D6818E03C4D617BAB6AF42453332A764D3DB73069D18AFB83F8765E0F27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184022, "uuid": "0feb49f5-e92e-4ec1-9d6c-3b8b4fd26a0b", "value": "6144:cCRFEfOh1QksaP0Os0vK/WHAYveI1UM/9AT8emWwPRPvkP:xEfesaP0Os0vpgGb/JemWSRPvkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693184022, "uuid": "454b4263-e043-4380-9f73-0baeebda2350", "value": 199982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693184022, "uuid": "aa36ad8b-506f-4845-a49d-b79f3dc45b7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184022, "uuid": "6b6dfa1d-cdd0-4a58-a05d-ff39420b8a1d", "value": "d0f09a66eb731c06c51b72f3745bd9e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32af9d17-458f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693219182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219182, "uuid": "4041c894-1334-4aad-a289-5a483d480442", "comment": "Malware payload (RemcosRAT)", "value": "b8d8eb9a8cfed04b9624e9e3d8c2569d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219182, "uuid": "df8005fe-7b13-468b-ae33-64a5f9b43a5b", "comment": "Malware payload (RemcosRAT)", "value": "838943f1ce7de236a0a633dd4a6675a65e5e5cbce86d2a1440ae307d58dee757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219182, "uuid": "1f4d8d4f-4cb1-4f79-9bef-0e069dcb1514", "comment": "Malware payload (RemcosRAT)", "value": "49fc38e83fe4905946e8a31e40603256c5ebf060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219182, "uuid": "c3982a18-29cc-4dff-bbe0-fa21ab1f0201", "comment": "Malware payload (RemcosRAT)", "value": "891822476c547f7e3e64fc9c4c1c1268b1edce9bd8fad6aca1d1eeba4c8ae4546046ef7055470e2452074d1bf372eadd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219182, "uuid": "80ac892e-c1b0-4b3f-8add-0eac52d24abb", "value": "T1676429DF2BD41A2FC69F02F5D5414AC8D7B7C26D6297F79567821AB0E84332EA807183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219182, "uuid": "248ead47-737c-46f4-975a-41c3f837262f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219182, "uuid": "afdc0edd-890a-44ed-aa75-56144e4b4aa9", "value": "6144:15ddSORmAGqepnEsaZ3L+5TlvYrZ/7FWhlLno:15ddSo7eK0EZ/Cl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693219182, "uuid": "56711bc5-fe7e-44d5-aa6b-7ae06164f529", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693219182, "uuid": "de7f7387-0100-4d4c-9f14-0a5ae6696611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219182, "uuid": "4b3581ad-d735-4bf3-bb77-b2dc060301e0", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.21639.22575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c124a8f4-458e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1693218992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218992, "uuid": "584a8936-5619-4c6f-afd3-96bba32539ae", "comment": "Malware payload (Neshta)", "value": "253b21547cc9cb67b21c30223c60cfeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218992, "uuid": "e8b2715c-31b0-409b-ac4a-e0d140584a6e", "comment": "Malware payload (Neshta)", "value": "83a4b6cd0fa89d77f39c1ac7e3ecf5260bd7bffa07ab30fc6c7ab17e87525e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218992, "uuid": "8103e0cf-fa1d-4486-9b82-324e5b438476", "comment": "Malware payload (Neshta)", "value": "2626ba70352d3a19cadbeac4e1810e08968a9c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218992, "uuid": "77b552ce-a640-4e06-b7c9-02003beaafef", "comment": "Malware payload (Neshta)", "value": "b32c957cc25d187cceaa9e3cdd10ee1bf397ec4d409cb497349c4165c5a9a4ca92697ebf5293279cf01f9aa762f33f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218992, "uuid": "745361e6-7693-404b-bd0b-acd58fde778a", "value": "T100350127F1EADF05C6BC93F160902F8063A755CD2175F1384D8AA4E662D6BD20E52AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218992, "uuid": "17d38f90-833f-4246-ba86-116dd23ea48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218992, "uuid": "4ab62fd3-13fa-4c0b-9e19-b86e48233705", "value": "24576:cSnlCe9qhJe96OE8uz2xxz9/cQVb3sFEg9SkLO7Dlw+T9koak48:/lCe9qhJesONuyxbn7sFLsw+T9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693218992, "uuid": "75864572-704c-4633-be91-69715566840d", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693218992, "uuid": "1b1ad63c-2907-4266-b0c1-6c39e375bd1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218992, "uuid": "c5cb84da-dfb3-470b-8340-1b6d8f1a8bfc", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f05d06-4542-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693186380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186380, "uuid": "7a3c6d29-5935-4ddb-81dd-0f73fc9d7a9c", "comment": "Malware payload (AgentTesla)", "value": "9b2f5ef32b9412d5bbf8249d61456d19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186380, "uuid": "fad786b3-2117-4f61-abf6-b3a98bef917d", "comment": "Malware payload (AgentTesla)", "value": "857d75d1fc8d218e230d8721329c3fc1f34c4fc8a3910dff8505fb18ce8f3a73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186380, "uuid": "7a4ccfb5-45ea-4d2b-9527-8d1dc7ab121c", "comment": "Malware payload (AgentTesla)", "value": "07b43f5db865740d215322c59827dd386905cde7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693186380, "uuid": "e8a2f31f-4a38-434b-be5c-a06cdab20fc2", "comment": "Malware payload (AgentTesla)", "value": "ae12ed63b4cd25d263eef2ca8c5a03da753f06da637e86769bff8c014d9ad279e3eb5d95dcea92b5eb70341f24a2eed8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186380, "uuid": "1117976d-7cd3-44e1-b622-4fce928425f8", "value": "T11A45D06176F746ABF06BD1B3A4E2C5052FB8F342B6A3E30A098097565C83F815C49B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186380, "uuid": "2ce0e15e-dd15-4d48-9160-1b25defc56c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186380, "uuid": "b05db70c-550a-4cda-8521-4694af963e40", "value": "24576:zSZtecHm+/1igt2pM512X/GOOwLVhgyGxA3MGR4Vp9:koVgt+M72X/GSVhgXxA8GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693186380, "uuid": "7019f8d9-80b4-460f-ad05-104d134ef158", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693186380, "uuid": "e7aff4e4-627b-4b7e-90b0-9474e1175768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693186380, "uuid": "c2587e38-ad68-4fd3-8c1a-c856d3d52b63", "value": "SecuriteInfo.com.Trojan.MSIL.Seraph.AALF.MTB.26331.13695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd92754-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693214099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214099, "uuid": "3b9028ff-43b0-4a80-91b6-86cabc446a49", "comment": "Malware payload (Smoke Loader)", "value": "c73fb37d5fbefade95ad116b23a08f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214099, "uuid": "32842d4d-6d65-4b42-a621-563ddec124cf", "comment": "Malware payload (Smoke Loader)", "value": "87026781f4f06f6b871d504bfc7d31876085265e4364ebc4a2b673f18c5e9a19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214099, "uuid": "22e84a25-8817-40fc-ab50-69f798179aa8", "comment": "Malware payload (Smoke Loader)", "value": "91dcb806063243c415217ec371d31f72ee349d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214099, "uuid": "f8e966a5-e8e2-450a-8a80-82b1cad759b9", "comment": "Malware payload (Smoke Loader)", "value": "052eb4e95b1d374e0ca92d6ca20cb0a0e4b3fe7ad9cbcd1deec133ec5e81722c6a2c488223bddd077bf14ae21d3b8f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214099, "uuid": "d29323d8-efa3-4eae-bb53-f2f5ddd2a26a", "value": "T12054BF11FA82D472C49301349834D5F47A7AB8B2BAA4DD8777AC3F6B3D7138166A2313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214099, "uuid": "28589979-3805-4419-ba9b-48b4a6b01655", "value": "c3cfc3ae364145c34d2985bd43d1d7c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214099, "uuid": "b5f998bd-e7bc-476d-b968-f8208e5b7a92", "value": "3072:2/XgrZkxFULc64j2NkN0+T7gEMgkkkkkwLo5uCd3JXa7WkRIjDMTjOx:0gdIFULc6x6N0kLkkkkk2oDd4RIMTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214099, "uuid": "30da31ed-b70c-46b5-a216-8e4882770067", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214099, "uuid": "957fe1a0-062a-4098-838e-e021fa5a11d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214099, "uuid": "1410e293-47ca-4fc6-aaec-2f03749119f9", "value": "c73fb37d5fbefade95ad116b23a08f1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c283e647-4579-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693209975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209975, "uuid": "4e7ce14b-9079-48db-bfda-f1b7ddbd2377", "comment": "Malware payload (Formbook)", "value": "fea75adfb896bb167ad3f52a14ed9703", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209975, "uuid": "ff2e5035-29f4-436b-a777-b7fd8f7603da", "comment": "Malware payload (Formbook)", "value": "87aab068269767a819df1107ce146100b4e1467ae221cfd00ea1c24961085782", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209975, "uuid": "3570065b-9d1e-44fe-8e0f-5a011b33f1b8", "comment": "Malware payload (Formbook)", "value": "bcc5f688ffbde19923c90a61e12f1bc4d8094f5b", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209975, "uuid": "ddbb3902-ab35-4d3e-afd8-d42075c9c8dc", "comment": "Malware payload (Formbook)", "value": "fd27035f986a3b30614b3043b813c9d7d5c5539f2d4605281eb97b41c8fff2addf60d08db01eea83013c37e417dec4a6", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209975, "uuid": "d8df6988-c612-400d-b388-752ec619f7fe", "value": "T14E64230EAC1A50FB9B21974A1FD733B3A1AA7E608EC6F3524A0709B55734D806FB315D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209975, "uuid": "e8301827-9c1a-4197-baf6-8c9672f35c23", "value": "6144:Jtw0vakGcvgl4zMXbwAZYDgg5TCJrxoHb5txe3lB4rjdnGZEfSTJ7dPQNwD:Jfvarc24zMXjZYDFUVo9noTyjkZnT7A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209975, "uuid": "171c787b-466c-4bc8-b99f-bde2b675e0ad", "value": 316655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209975, "uuid": "71b522de-9ab6-4501-87d1-5fd89589daa4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209975, "uuid": "593c84d2-ce02-435c-9b85-f8923e01f6d0", "value": "SOA JULY ENDING 2023_PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcf4c13-45c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693242528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242528, "uuid": "df53f712-8be1-4e4c-b691-e97b1084a1f9", "comment": "Malware payload (Formbook)", "value": "aa53b49466385185d27209e5eb28ed7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242528, "uuid": "9b701f12-b616-4774-ac56-a835149eacae", "comment": "Malware payload (Formbook)", "value": "8820174c886cd517334df9b2b4395bc504a8fe471e7b60f920564a0405c2631a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242528, "uuid": "3b762544-114a-4c13-83c5-06ab7a9330d1", "comment": "Malware payload (Formbook)", "value": "e519ffb33c58760c40139039324f2c044ea85564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242528, "uuid": "804f92fe-72bc-4720-96d3-b50a50a6dc40", "comment": "Malware payload (Formbook)", "value": "89637c19a963ec3078070665e55336f31a8d0bcb1cc1ad631126d20e028f6e46ca160e86d15a4ae03260a011f97931d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242528, "uuid": "c7435fd4-db30-40c3-a559-c55320032557", "value": "T1972412417981510FD46E2770A2DEBFC048C2EFAB3DE58B67B4C4642A7536B901BDC89E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242528, "uuid": "b8063b52-397b-4900-8d25-8f121a750419", "value": "3072:A8GYBy0NYz1IEb4Cq6DiHBSK+vM/+U9s/G/WGNa/J2e0adH0ZP4Fb19R7:ZByaYzlPiHoKf/+U2++h/Ey1RJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693242528, "uuid": "574ba578-0000-4a5f-b3ce-062009a616d3", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693242528, "uuid": "7c7f3196-0294-4eae-967c-71a03f6f2645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242528, "uuid": "9160d5f1-7501-4283-a9ba-a8aa2bcaafea", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f131f339-4585-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215207, "uuid": "85c06139-3681-4ed1-917e-d77ce0aee291", "comment": "Malware payload", "value": "d8fb5cc1ac00612d5aed7d300e98074b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215207, "uuid": "ec8114d0-455e-419d-8c5a-2dd3b74fac11", "comment": "Malware payload", "value": "88c05d927e45593f9f830cae0e3d46778cb557ca6ba101a41e52358beeded2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215207, "uuid": "2e5b9b76-3752-4a58-a5d7-3bef5cb9c0e4", "comment": "Malware payload", "value": "b389727dd9c71e676d138bc630d7bd00f3a05ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215207, "uuid": "060f030b-01e7-4e1c-826a-bbe2f2cfdc6f", "comment": "Malware payload", "value": "663ca40042e3f3d2ff6049d6bc3d316f2f1d8f44e574972fe53a0a55bb300c16e3880ec0871f628cf2da94f3ac3d96d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215207, "uuid": "963e591f-f2c7-4e69-b88c-f858ea7ac226", "value": "T10126F1B684F71126FABA4538597A0DF4167F69E617CC1D7A1A00992E027EA0C33EDDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215207, "uuid": "664f2f51-1273-4a6d-913a-46b06282773d", "value": "98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgITL:vIlQIN33nVKboT7MAwtCYzQQjn46yQln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215207, "uuid": "19b044b8-79da-46d2-9cc1-d83c7fd58a7d", "value": 4860507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215207, "uuid": "4a7acaf0-e405-4a35-b48d-4826bd39eb79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215207, "uuid": "ed1e7530-7e44-4f35-9f79-b55cbc075346", "value": "d8fb5cc1ac00612d5aed7d300e98074b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fde2081-454c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693190589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190589, "uuid": "2e34bea5-05fe-46e7-ae00-85c1137fce74", "comment": "Malware payload (RedLineStealer)", "value": "96c135845ebc9d611bcf8bf17972f0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190589, "uuid": "a3b297dd-91c8-4c82-a6d4-6acd78db40da", "comment": "Malware payload (RedLineStealer)", "value": "88d96221f92ff7a469bf2c8573c7cd3dfc7dda8bb122229d9591b192c7c4cf0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190589, "uuid": "178be29a-6a15-44e2-8071-c423da2e8f96", "comment": "Malware payload (RedLineStealer)", "value": "3244da3e542246f96efa14daf699c8f2c5390da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190589, "uuid": "429613a7-facd-4f19-bd96-4d60ccbcf879", "comment": "Malware payload (RedLineStealer)", "value": "950e544b5710e101546a366bcf26790375cfc1c186d380fecd312bfad7ed93484a768a2fe9e523e87d6223d0ec95d9cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190589, "uuid": "38d0e4ff-4caa-4148-8660-4d2b30db1f8b", "value": "T1D2343ABE64E06860EC81B2FB4351BF6CE57634169AE0933D137A22E6736E5C0C778671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190589, "uuid": "2f70aca9-5137-478d-86b0-f2550b002197", "value": "0789ffb4698151ed5478258ac60f998a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190589, "uuid": "c458b085-4565-4f1f-bc1a-b3cf9185f051", "value": "3072:OKppHwFECxXcdiy0mgK3cy0Q9WVoaae81CbuUN0BPkf11gr42xfsjwsfuB/:tMECxXcm4MpQXACn0nisjvfuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693190589, "uuid": "8115d0e0-f139-4dec-a7c4-0ff9a9215858", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693190589, "uuid": "e2a4b79f-77ed-43fa-b07d-9d0a57dcb688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190589, "uuid": "82210476-8c71-462b-afa6-3f7bb039bf50", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.37076.12071.9961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f611509-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228250, "uuid": "6ac1356b-f613-44c7-9606-b7a96cc15cc7", "comment": "Malware payload (AgentTesla)", "value": "621d1e131764d5ba0fef68dcc8e55172", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228250, "uuid": "f0bc74b1-a3d0-4869-a848-068397c47e70", "comment": "Malware payload (AgentTesla)", "value": "8982a242386705ce046e1315f71c44182b40840ef4d0d985983d32c20098d2e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228250, "uuid": "80738a08-32fc-457e-b1f0-40f0398178f1", "comment": "Malware payload (AgentTesla)", "value": "ee635269b84310cf5deaa4e2ceb8aca099361dfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228250, "uuid": "f495c439-41fe-42f5-9a2a-9450fdb8ea6c", "comment": "Malware payload (AgentTesla)", "value": "be6aea46cf9cfa0db0569b1cc2cdb7e4bf2cc67650ebc4b078be6813fcd41d57f79e5b087d68d6601434a0a1539961f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228250, "uuid": "f6fce26d-4a40-4827-a17d-71560ed3cd20", "value": "T18FD4E035AA47AF0BC57D837A5021691493F0D603E326FBD77FF208DA1A16BA48877943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228250, "uuid": "ad77d00d-a00d-42e6-8b77-3051c568fdf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228250, "uuid": "771ba32d-587f-4130-9d93-58e12277f9dd", "value": "12288:n9mm4FTSrRueOeIr6ixmmb6bZCV5ZMkwq5TWJFzYMismBdHr5Yai:km4UrRueFI6iubEVXiq4JFzVSBdl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228250, "uuid": "ca722f50-c69b-4c19-89cd-ee0c2a11dcb7", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228250, "uuid": "ab491315-4ff3-4636-8ba4-9c27139a22ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228250, "uuid": "2a0dcbc2-11b1-4cf9-922f-dac89d969d9d", "value": "Revised Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affd5e6b-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229271, "uuid": "dd6a3c1b-024d-4efb-b0fe-caccbf09f7a2", "comment": "Malware payload (AgentTesla)", "value": "66232823c66e96a4346fb0db1949b6b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229271, "uuid": "864a7ed3-b734-4bc8-aba2-88f9b2d3d4db", "comment": "Malware payload (AgentTesla)", "value": "8a74737cd563828a070e74b5fa4af0eefc7a98cf8b52fcc0ee5db3c83a2d9cb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229271, "uuid": "3ea151e0-23b4-48ed-99c8-7607cde894f8", "comment": "Malware payload (AgentTesla)", "value": "32d63485662841b12f69772e6abd7db2a8e9d57d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229271, "uuid": "c5f556e3-6c90-43ce-963c-16b3f44ed43d", "comment": "Malware payload (AgentTesla)", "value": "e645b812de193dd47b72032d725f54a06a99f0025102dc7dacf15c36302e0e24682ce36eb7caed3e3b1622553d3fc763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229271, "uuid": "b9c76426-f882-46f3-aecd-794e937ac7bd", "value": "T1C5D41240B37B8B95EABD53F90A61225057FAE51D393BF3580ECAB4FE1121F418901BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229271, "uuid": "29dec07b-bdbf-4c01-aa65-9f84e849c6e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229271, "uuid": "3ddfe11f-b54a-4ef9-ba29-a3fa5f0f8d35", "value": "12288:vpLI2d1mbTtedkelZM+IhLcm4OPAqMyYmamIRJmDHFkewsj:atejq5YOPAJmnBkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229271, "uuid": "ca48c160-0e63-4ecd-9b4c-9bca337d813a", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229271, "uuid": "3f7c6eb6-57a2-4d07-a34a-9f56b908fb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229271, "uuid": "6d4bae39-5ba1-4b77-80fe-3476f0fec497", "value": "INV_S1016628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d00f02-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229898, "uuid": "4faca65f-030c-4ae1-b083-b9007f8c2aea", "comment": "Malware payload", "value": "6a21756cf0cb7bcd5031fe7c1efdc86b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229898, "uuid": "7ea112a9-0b41-4e0b-b519-c801ed5063a6", "comment": "Malware payload", "value": "8b6f50368de19d4ac34ac36a138e61397698d8fd7cc08e62a661ae8e33c54603", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229898, "uuid": "d2ced438-ac37-451e-a77a-612086497a52", "comment": "Malware payload", "value": "b36496be594a9227692279a25c49814ea6a05d65", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229898, "uuid": "fba77bed-81b0-4432-85bd-4db50efcea6b", "comment": "Malware payload", "value": "526d326b362d0cc7ada401be42d11364a9ec4c9bb20b23ca88be43dc199095428762ea5d9632f0b52de60c5006022260", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229898, "uuid": "bc70ad72-9ffe-46a4-a535-4c5beadbbc25", "value": "T1C3052394FEE86F5ACB6AD1BC800BDA4EA85DFE8E8742807B87D674430379B7F4490154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229898, "uuid": "6456ca32-1ed4-40f8-ad1f-67334e30e28f", "value": "24576:mlYZyC422YGnqL4Hh2Wlu6SWa0pzexZ6:HZKjFPT9pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229898, "uuid": "fec788d8-f2df-4a18-8a1a-64c0d3a442a5", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229898, "uuid": "ca1bed06-a477-4079-8bc5-20c4d1122076", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229898, "uuid": "ec2707d5-18af-4223-9cda-156a199e4924", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.855.29719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bde7263-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693266603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266603, "uuid": "74bd3187-c3f8-4130-a756-04a525c834d4", "comment": "Malware payload", "value": "7ddb8e6fcfa1ab7a987463dedc0bf0b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266603, "uuid": "a74ca6cd-b8d0-4efb-828d-4c5664191206", "comment": "Malware payload", "value": "8cf1aaa7c6c4d27d0d7ab3d47505031e599c8a47feb3d6e3152a86dc6b4431e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266603, "uuid": "badc1293-647e-4937-bd52-f747bbf0ba78", "comment": "Malware payload", "value": "35df28426f9db85d1f1bc214a2e9aeed3f161ded", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266603, "uuid": "d479e42e-a9af-40c9-9c69-69d9e5ac6c96", "comment": "Malware payload", "value": "73267c0ffe11d4f84bdb67c7b39d4fbd94c2c77a7add9eac1b86b021e8c9e366e74788ec29de1397c47b8d2c11e8262c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266603, "uuid": "d399dee1-13d9-4d0d-b836-5d2889e19abf", "value": "T1CD434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266603, "uuid": "36d9cf60-53b1-426d-853b-e0eab65bce49", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmceDj5gk9vWnTI4eBH+4sToQLDKFv:Yn/EsW5qhSh6amLlWnU4GH+dNLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266603, "uuid": "7cb4c2c1-7117-4e0d-ab94-1e63efb38d44", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266603, "uuid": "7ca0afc7-b42a-40c9-804c-67b6d67fa7af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266603, "uuid": "87cff1b9-2dd4-4bf1-8963-e407ab72b598", "value": "RpcSecurity.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3fa214-4582-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693213828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213828, "uuid": "154f4d06-5fb6-4796-9fb8-c5f3fd887eb7", "comment": "Malware payload (Loki)", "value": "fbaaf5cf61406c0149b288cd2be13cd8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213828, "uuid": "1d401580-981f-49f5-b633-f717e39c80e4", "comment": "Malware payload (Loki)", "value": "8d96f81a4816b3a227b154ed431cc38ab763ad6f57e7007c79f5568c08a58ffe", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213828, "uuid": "f45b6f16-4f13-44b5-b78e-53b83614699c", "comment": "Malware payload (Loki)", "value": "206ad8898ea00b82554514860f2bac65d8d102f1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213828, "uuid": "d02d5cfc-9cfb-4cf4-b266-99c773ce3acd", "comment": "Malware payload (Loki)", "value": "c8d60dd327da97c3cfdeed422db95a0c54ea040df9ca9b7b1c03af00643e261e1cf9dddcb588f51ea135c3deb2cd9782", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693213828, "uuid": "d77ea269-f2de-4acf-b0f9-461ee6e7170f", "value": "T11BB312DF31FCCE506CEA0A984657D4FC90E844839D1A5894666EB363FD998BBF00261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693213828, "uuid": "53f0ac25-a76a-4a0a-b35d-0021c601d020", "value": "1536:9djR4KLxRF04i6CA9UyQRwS+gFk8we4gE2i9nHUO4Q3Ho9UKmDRf65fq/7jCNbNi:9/P6WUFdwJ2i9lXo9UTwY/vC3q2xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693213828, "uuid": "0503e531-b80c-4a86-a31a-c9d71aebf6e7", "value": 112326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693213828, "uuid": "291c1fec-44da-4d32-bbac-23da488b4dad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693213828, "uuid": "fab4cf37-321d-4139-afa3-ad0f06f7f5c8", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8f58ac-45a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693227603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227603, "uuid": "787e219a-b93c-48fb-91f7-345776e959aa", "comment": "Malware payload (AgentTesla)", "value": "f5342deacb733e33fb97c19ac8c5efca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227603, "uuid": "afc4f8aa-00e1-4e78-98f2-ba50ff88c03f", "comment": "Malware payload (AgentTesla)", "value": "8d9c9f112c90d7614561656d29fe8bdd569b0b88d6e3e0f430b295e45e52ebb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227603, "uuid": "09199670-736d-44b1-96c9-530795d669d9", "comment": "Malware payload (AgentTesla)", "value": "593ec43414bcf75c9f198fbc09706aae0d3c72ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227603, "uuid": "398e78de-cd29-4b14-8e2d-d2762ee3acb9", "comment": "Malware payload (AgentTesla)", "value": "19c76453298975d79b5073be461331e75b7be1043ca2b51292a6ddc8547ac39fb5c38dfc7b731a5e371ca63d0087987f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227603, "uuid": "630ee8c9-e38a-4ebe-83dd-3621d3a66015", "value": "T1D5050157A187ED52C649477C4220E69C03BCCE629B27F24A69B93152DE73F874F08E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227603, "uuid": "68f7261e-cc50-4376-aeee-1bd19c2c7768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227603, "uuid": "86700957-01e7-4b47-ac15-ce77caf2f32b", "value": "12288:GZlusWbq2QOjogLHqMDvcsP6S/6STz0PJtDL/p/TmxQuOQIZdKOfJo1mJxRHHE6U:Gp2bogLHJD9SySPDL/p/uXOfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693227603, "uuid": "0becbe8b-f6e4-42d4-82a6-9f17259acdb3", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693227603, "uuid": "d3788da5-bf1d-4c67-a242-df2617afbb84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227603, "uuid": "33438d47-e41f-4d57-9694-2ccd84d4bd87", "value": "PO - 12619.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f8199f-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693215267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215267, "uuid": "7142c282-c6bb-413c-a280-5e716e6aeb85", "comment": "Malware payload (RedLineStealer)", "value": "448bd3cde5dc78d1569fccd49ac6641a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215267, "uuid": "128982f0-cf79-40ca-9883-0ea7884085ad", "comment": "Malware payload (RedLineStealer)", "value": "8ecdd7b54d0e160eb62b6a46c7faaf330b2ce88a030d7ff4fbe3822ab878aad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215267, "uuid": "b578c3fc-f7f8-437a-a33b-25055311d573", "comment": "Malware payload (RedLineStealer)", "value": "6966d702004302a5bd73e7da3bc7a18648714c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215267, "uuid": "90d7e49d-1470-4f74-b86a-1f016e26912a", "comment": "Malware payload (RedLineStealer)", "value": "d8865867dcf1586ba600c84585ab7a34b0be4db191def9708c53e76d211050e5e9b108ef0701c75bd50fa2c5fa7a861c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215267, "uuid": "38c22a1e-63b4-4364-88bc-99f3e626044b", "value": "T113052322BFD91537FDF1073018F686931736BD626E789247248BA49E2C722C8717672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215267, "uuid": "cbfff91d-0179-422f-a9e3-b3e74f008111", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215267, "uuid": "76e8e02a-6f2a-4820-be23-deb69759d2be", "value": "12288:rMrAy90Zd4sxIlrJfl0oFsCWsVHxOhuCoFh9kaIKzTHUq0gsZxl157/GeT6ph9VZ:HyKxIlrJ6o/WSHPSGUVgs7hDoJ+SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215267, "uuid": "2d16429b-6efe-403e-8270-8329a3cf706f", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215267, "uuid": "89b4c3bc-931a-4988-b142-6b20b36252e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215267, "uuid": "cb1caa1f-c88b-4045-b1db-9540ff10c000", "value": "448bd3cde5dc78d1569fccd49ac6641a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcdf257-45ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693231522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231522, "uuid": "9385e8a5-619b-4fbc-883f-a7e22f6e8666", "comment": "Malware payload (AgentTesla)", "value": "cd7be02e43a9df831bfa8d9bea3a5cb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231522, "uuid": "0716ff1f-1a51-444b-8be3-b9d15a7da14c", "comment": "Malware payload (AgentTesla)", "value": "8f9c3c605f01435a65bbfbc042d64e96bc3f116105327a9ff25ded111ab9f317", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231522, "uuid": "7fb3ad21-ce0b-45d3-99a3-2cd336f00099", "comment": "Malware payload (AgentTesla)", "value": "230156928b9e51ccc2f2b9ec40b30cab7b5cd920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231522, "uuid": "635a6b62-04b0-4965-919f-6ce46da5ce3a", "comment": "Malware payload (AgentTesla)", "value": "48c32b43630ee3b13a42e7439330a0b2bf1135ac0f008bc68408ac5ff15edad7f8261733d3de0c1765fda24bdb77549f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231522, "uuid": "bbb71ccd-d64c-4503-911a-28d572e8cad7", "value": "T119F423265675407FDFC017333181D54D7A86A8840E22A3B32286FBCB4E6B9479FBBE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231522, "uuid": "8e9365f7-4d44-4c5f-a125-626f83bf8d61", "value": "12288:P0yre87oGoY31afq+8NDinhhtYrWKqzXg3haL7VyIG9z127pkbPm4im5Mr7eMQsw:P5re0F1bDi+rWKqzXYhMyRximFMxEQ/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693231522, "uuid": "13b88154-c6f7-483c-a6f1-7d3981ee6a70", "value": 741205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693231522, "uuid": "9f9a740e-1dfe-4b9b-91be-fbb9f5f6a5d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231522, "uuid": "304ecec4-82b8-4c1c-ab59-affaf11279fb", "value": "URGENT ENQUIRY - T2190 27th August.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fa6b0f-45d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693251024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251024, "uuid": "39bc285c-65ba-4aae-bbb2-da3a5ce51e6f", "comment": "Malware payload (AsyncRAT)", "value": "00178324ac554e6e82c85a75dcb5ecd1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251024, "uuid": "ee5e7ea3-dea9-4171-a31b-96802748a0e4", "comment": "Malware payload (AsyncRAT)", "value": "9050f1b2fe9de1303a608ad5329db45d101ff616009add295d67e162ab4d8dfc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251024, "uuid": "b2b99797-54e1-4680-b3bf-595c0a6a54c5", "comment": "Malware payload (AsyncRAT)", "value": "80e0d833b4ac41eec676194bd80ec0f55d5bc526", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251024, "uuid": "fac6f8a3-1240-4f65-a12b-dfd6c4872d23", "comment": "Malware payload (AsyncRAT)", "value": "14f5eaabd6246c8fd24072300cab505d0af54d958636c2f117bc47c1ab087c5f33def4cdd1dc973b284ba920bd643746", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251024, "uuid": "427be44f-f6e6-44f3-94bb-bbb2e8bf6f33", "value": "T155B34B0B96987DEEE51B97735E5B9F4EEA38B953790ACF052221074F10620CEF206D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251024, "uuid": "1ed3903d-9308-4a2b-8bbe-d50b2367f6c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251024, "uuid": "f90924cc-879f-4eae-8379-68af4d59dc85", "value": "1536:egVaNakN+AcOvfpKUmrFZlqgdpZ+rwVINbvlC9bgKXRK9f2kt:egValNvcspmr7lqWZ1Ixk9bgKXRK9fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693251024, "uuid": "a0c15f6f-5df9-4ba4-9153-d21a66557aa1", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693251024, "uuid": "640b6638-ac62-49ad-8fb2-97410432f302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251024, "uuid": "8be8f22f-b9ec-4097-ba28-a7588469e6e7", "value": "00178324ac554e6e82c85a75dcb5ecd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd41336-456c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693204306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693204306, "uuid": "0c9f48a8-53fe-4e8a-9343-876cbf59c49c", "comment": "Malware payload", "value": "be82ea0c15a8161fcd03fd624ffef4f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693204306, "uuid": "606551ae-6b2d-49d3-b147-797c1bf39014", "comment": "Malware payload", "value": "914d733211ada97527d6b5ac47098c1b45dd9f45c455696575681dd335c659bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693204306, "uuid": "53716397-34a4-4839-a636-e00ba17a2a5c", "comment": "Malware payload", "value": "d8ec9685ebae5bc1ce2a2871d660eedf5527a487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693204306, "uuid": "3705db14-7a74-4121-9cc4-267d89f8b688", "comment": "Malware payload", "value": "f1ccdbe60e331fa5452f127c5be9dc86059951b5b4ffc4898c0073c23357d5a5d59cfe8f3763d7ce73463fc65fd1ab1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693204306, "uuid": "e4da0ffe-0cb0-4329-93b1-1ae8e547f578", "value": "T1490733817240C8E5D4A2923EDC4AC2F169F1BC25C780E54FEA993F993F732915E72B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693204306, "uuid": "f02c52d8-1a45-4a96-9c8f-2a80b6686e70", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693204306, "uuid": "a0abf7ad-9e02-4a2e-8f09-baf066a4836d", "value": "393216:p0XUryQJe+ooDfDg8lh2pAc6BnzMmxBBok9ei1Z:fyQItob0SQpfa7OQei1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693204306, "uuid": "1acc1389-fa0a-4344-b13a-2fe0dcbd151f", "value": 18386199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693204306, "uuid": "7e414947-15ae-4dbb-8708-7c8a2d44601e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693204306, "uuid": "96111432-5972-4faa-a000-d9b196018aa5", "value": "COD_MW2_Steam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43612881-458b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693217492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "9b199a2d-bd8b-4829-94e6-90caeeb63678", "comment": "Malware payload", "value": "fcb4fdb203a30b098fc7eb51e25ee665", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "56736df5-ff34-42bb-9c04-f8bc3070f130", "comment": "Malware payload", "value": "920f8d170499189194e768a73f448a58addfbeef9b745666dbb01be22345f5cc", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "61429028-8330-4cfe-b1a6-1c23c4daa390", "comment": "Malware payload", "value": "f806f50e7cfed835c0329b45e20ddf59b9e4e8b9", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217492, "uuid": "14292ed9-94e4-4ac2-bfe3-47a4ab7d92b1", "comment": "Malware payload", "value": "a0fcd3c44dab2cdb17873f85f7da685111413f1076436f9ad3b94854cf930966b7bcbc404572a82f7431e492b5915972", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217492, "uuid": "76526baf-66cc-479f-8ec4-f7aae5b40535", "value": "T1AF519556F7B55C1FB22396B82523BB447317C2424701CF2839A034AB92DF7A368F46D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217492, "uuid": "7fdf9850-a6b7-47c3-94d4-adf84a6651f3", "value": "48:CqdR4G0cr5k9WDZUkPz50mZcf7DH2gUqGSK/GSKi2PO7gW136XvJeG54Wjqgk:ZdRXr5k9WDZU4N0mZcfnH2Yy/yxPUpFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217492, "uuid": "cebbdbd0-a9e3-4c5e-94f4-395e06f37034", "value": 2963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217492, "uuid": "1b605d80-74c2-42d3-b417-b25b5d3fc881", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217492, "uuid": "23945368-eadf-4d79-b613-4ca7f7386e0f", "value": "RFQV21019612.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce79bb1-45a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693230608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230608, "uuid": "17546871-2a53-4881-b36e-4fe21104abdd", "comment": "Malware payload (Mirai)", "value": "1a3ba02e6c759d80613a81da76b6e66a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230608, "uuid": "0b9bf912-5c28-43a8-9330-9c4a8b167092", "comment": "Malware payload (Mirai)", "value": "9219e1cb938ffa2765044e8b0c2c27db30d91adb990907d8d756bd976360a74a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230608, "uuid": "6a1e86a5-1106-4105-89ba-c10d355e9406", "comment": "Malware payload (Mirai)", "value": "9c4e0cb7193aa96d4365001f595f51d40552f250", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230608, "uuid": "dea3c1a7-caef-423d-90ed-db117ef5fe06", "comment": "Malware payload (Mirai)", "value": "306cf8a7ff98abbb9b30b9cb283336231433fdd8f23ee3e932ade56f52b1bc3e78d6135628a7a035aa6770243c79cfcd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230608, "uuid": "b5c0acdb-9a20-4b11-b098-dcc4955a0868", "value": "T1E9631851F8819A13C6D1127BFA6E02CD3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230608, "uuid": "5b10551c-528d-431c-8ce5-473043c83cf0", "value": "1536:rNHlxvmiiBmLv/RN/596yw4BxF+2YWfwz2vvW/:rNprxIr4BxF+5sbvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230608, "uuid": "f68eaca4-d126-4023-b9da-9b3a5ed7711f", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230608, "uuid": "b7855d04-3510-4ee6-baa8-33cecb154025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230608, "uuid": "3515eac1-9d4c-413f-b308-e09edcbf4b22", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c40ad92-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220836, "uuid": "44419645-e577-42a8-9014-6a1ff54a3caf", "comment": "Malware payload (Mirai)", "value": "33862369644d63e97741c3f8a70a3f7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220836, "uuid": "2e22d457-3e62-4161-86a2-5d253baa87fd", "comment": "Malware payload (Mirai)", "value": "925f96556df51e195c2707276490db684a3d588aae6ff7d1b20ec9646649d010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220836, "uuid": "ea33c1fc-15cd-4a07-a293-71b371701857", "comment": "Malware payload (Mirai)", "value": "ceb31c18bd4d07380bf9d727316358678413ca88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220836, "uuid": "f2136849-f3f2-469a-9107-f4822ad49f1d", "comment": "Malware payload (Mirai)", "value": "e6f210d0e07c093e20f2f1c05f42d29171ac310af79fbbb680016540664fb9c12af1fad501653db57dec84e8c7498c55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220836, "uuid": "d7fd0f65-d73c-4e46-9ad1-519a6a90b854", "value": "T11D538D75D11DAEA8C0414AB4A9198E704F13E4C046733EFBEA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220836, "uuid": "0fd6a831-4f82-46a9-8f7c-41697626f63c", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220836, "uuid": "1b870209-2e95-4509-8a9c-18918fd603df", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220836, "uuid": "e16bc4c3-0b70-4c35-8b0b-6ad28b247c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220836, "uuid": "b59b4357-07b2-4364-8742-2b2cd199eaa3", "value": "33862369644d63e97741c3f8a70a3f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d45cfb-4588-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693216203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216203, "uuid": "1b0d4504-c308-4e1e-a8e9-442274ec4a09", "comment": "Malware payload (Mirai)", "value": "9b6a9501b12ac508ec9fa3478fdceafa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216203, "uuid": "70f9fd1e-96ee-460b-8590-c8c7c868afde", "comment": "Malware payload (Mirai)", "value": "933bd49da16886eaec020f28d09c0e3c5946133a5351cda98d16c3453971d5c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216203, "uuid": "ffdc6c26-bec5-42ad-a049-a6e0fbe0c015", "comment": "Malware payload (Mirai)", "value": "c5cda90c1e1b287f45c27b3f75acd92921b08b51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216203, "uuid": "c842d76d-0c06-4b1a-afd5-78574bad7b1a", "comment": "Malware payload (Mirai)", "value": "03ac08f60c82be5aa2a099f3be7822120eb822466b93bfa5c54e8e0bcca8fa9da5c355d8f4a2455afbdae04c4887f735", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216203, "uuid": "6cff138a-a34e-451a-9d55-d8ce273ce316", "value": "T1A6330223A354FC63EE361D7A62FD8C8A3548426DD4DCA82235C469B063C2147FBD55E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216203, "uuid": "a579273d-c585-486f-9c41-dcbbfaa1601f", "value": "768:ffZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbudgP9q3UEL2qEK5J6OAsNTGjf2tl8X4:EPtQjiZVcykHRDh+L15J6RN2tA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693216203, "uuid": "bae61fb6-2ac5-482c-93f8-1a2c6270d56f", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693216203, "uuid": "7b7538b6-51d1-435b-9d3e-c7a12b855ce2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216203, "uuid": "eec97797-e58c-489c-9714-73a081d61679", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a42ee93-45ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693231811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231811, "uuid": "9e83cd0b-34d9-4397-8028-1cabae7af351", "comment": "Malware payload (AveMariaRAT)", "value": "e4af3dee89d5f8dabe318c2f54437100", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231811, "uuid": "2a4444ee-4011-4086-9620-d0c43191ab97", "comment": "Malware payload (AveMariaRAT)", "value": "93a68fc550810812a2ca3b2eab316e7e0093f29eb643c1f295e48bb09ae7be05", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231811, "uuid": "5ac3ca29-8252-4f89-a3b5-85da8bd54cf7", "comment": "Malware payload (AveMariaRAT)", "value": "8638d1300ab08eb177ddbc9846a9895286766b1b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231811, "uuid": "7f02718e-796f-4394-b9ba-e4929f57968e", "comment": "Malware payload (AveMariaRAT)", "value": "10eb837eb3831703339fda510fb0ea911b8bd0da876fa55082826be35d8cf7b7df12e009917625d56d02c658ead371cf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231811, "uuid": "e5d906bb-ce43-4af6-992b-6616c03685ef", "value": "T1E7E4E11062E89605E5BEABF546B406480B377E265633E34FCDD118DE2E727C08E1AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231811, "uuid": "6f96077f-2338-4fdd-9d80-b94dc7c5248c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231811, "uuid": "1ef4bb9a-adf5-4e28-91d1-ceb4984284fe", "value": "12288:b8clVgEfo8H9WmDYmYjsl3qDaN/LaarQsbdTTy0Lhw7cVOFJOmqmuHK:gcLgb8dVaslr2a8sbdXy0LhduOvmuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693231811, "uuid": "f3acd8e0-55cd-4736-92ee-0fc5d83bb33a", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693231811, "uuid": "cdba6c14-1295-4bdb-84c6-e554122b25d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231811, "uuid": "de79ba0a-3c29-4aa3-85e8-630602479e51", "value": "INV0027378237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05b9a6d-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1693228520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228520, "uuid": "16b5b70a-db1e-4080-a766-7221b8301490", "comment": "Malware payload (DBatLoader)", "value": "c4388d5cb7fe2f1465013f2c2d4f3539", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228520, "uuid": "4746cf24-9f2f-4473-ae0e-937d6a5da963", "comment": "Malware payload (DBatLoader)", "value": "93dcd7125d7fa98ec24b3a79fe0138c933bc95fec53dd3da39ad07ecea548df5", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228520, "uuid": "4db0fb4a-61ff-4baa-acea-ad1282989ab9", "comment": "Malware payload (DBatLoader)", "value": "e78d5dc047eb8a772baad61f7e36aa8f7a9d873f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228520, "uuid": "1e09a2a9-21aa-4947-b6ff-edf5464fef06", "comment": "Malware payload (DBatLoader)", "value": "4272eb36b92cf3f1b6e54591ba76efe31a0808613788caa385c4490516e1a5d0edd9a0132a13d8680941f89a747195f5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228520, "uuid": "5efbfe07-85e2-4eb8-adba-fbefcfdc79f4", "value": "T13065E1A1E6A344B7E0637D30C85B5295DC697F742E2CA80E6AD43F49CF363D039252B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228520, "uuid": "788f5c5e-86f1-4a20-acca-51b21fedd822", "value": "555fbb180099f7ea0a0860999295d5a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228520, "uuid": "a8906993-2044-4d34-8d85-a6430a5350f7", "value": "24576:/UWyWyLFqghcA0n9WUS20tFJTtf7BtdZhPKRpUW0YEq0UxX8OCTL5GJ:/UWX7WUktFJT5BtdZdWWqxxX8O0L5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228520, "uuid": "d7e0f55e-c8ea-4334-9235-f58872c9e164", "value": 1516544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228520, "uuid": "655777c5-37a5-4b98-8ae0-01e24e3cffd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228520, "uuid": "2441d4f9-8675-421d-9b04-a4206bfd8632", "value": "Request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb6ba8d-457f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Zyklon)", "timestamp": 1693212327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212327, "uuid": "59a1c3f8-5a1a-4631-ba1f-f77a3dd6420c", "comment": "Malware payload (Zyklon)", "value": "a9c1a64a330f7efb69db6bc253553412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212327, "uuid": "c24f617f-bfb8-4de3-961e-32a0c7daa57e", "comment": "Malware payload (Zyklon)", "value": "96c6e2e05cc2fe89a0a88aa68ea749c06a35621ca4a74732aaccb25ed890657d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212327, "uuid": "e5209275-04a7-4588-a5e4-a744fcfc426c", "comment": "Malware payload (Zyklon)", "value": "39b827dd01d06b9fecc3c309d94440ba1001b3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212327, "uuid": "596792aa-67d4-4bc2-ae9b-7bb5e8cd3a00", "comment": "Malware payload (Zyklon)", "value": "4db5a852abfa57fe48be6ce355645c4fd61feb017eae5d400a242d35d858b3976470c4cc0c862fc076a83864c96f9e40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212327, "uuid": "46c54a9a-c494-4fee-b2d1-c1bd0d903ef3", "value": "T14E35419E3F5AD9B2CD4EC1F383176ACB5F31CC8AAB0390E61A5395C9E60D113598E097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212327, "uuid": "67378efa-227e-4116-b5c0-58e2b459336e", "value": "12288:ekmcopRKZ7xBgQ5J3GD+h49T151rJ+r9OzcTWB53V1LKGh9KhH3Jqv:ekqfKZ7jgoZm+y9v1lE0nfL5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212327, "uuid": "05dad883-257e-4b71-a597-2eb2610aee5e", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212327, "uuid": "84de8d8c-7915-4b1c-8ba2-fa858b06bd24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212327, "uuid": "9b8498ed-a5fc-41f5-ba9d-6d42356d2b78", "value": "a9c1a64a330f7efb69db6bc253553412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28476a64-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229902, "uuid": "03f5f40b-35fe-403a-a117-2ba768fd3204", "comment": "Malware payload", "value": "bf670f096395a9f6596233ba8aaf6a44", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229902, "uuid": "9fae3bba-ab47-4491-95f2-3a62d5de0fee", "comment": "Malware payload", "value": "97e1df275bfe4fbec6c493d63629f1746ace9e372c164ac08e55dcd061df53ac", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229902, "uuid": "535a2eb6-0967-4377-83bd-1dec43991cf4", "comment": "Malware payload", "value": "400d068c0f9653588ddb59bf14b211bc9b8a8bed", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229902, "uuid": "2ec5838f-058d-42fe-a9bc-b025c67200ea", "comment": "Malware payload", "value": "696d3b547b0ff0a16bac6863f657cda145fbf5e8a3ae17e0c3b5bce343ef7654115fd240375deee89a425ed293abf4e1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229902, "uuid": "0512cfc8-4773-44f8-8ce4-1fe95afbe261", "value": "T1A11523A8BECA2F5FCB1913B5521FCD9AA655BE4D83EC80F78381718E223D7B15C85844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229902, "uuid": "9b258c92-f5e9-4d8b-a7cb-81b30ef7389f", "value": "12288:GfFaeZyvk+qQOsSRxgPOh40jgV/T6YewuaTxZ1Ja/KkvUBcXWr:GFa2+qQn+Ph5jlmtdO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229902, "uuid": "789986b6-0686-4f71-acd4-0d53a19ba33d", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229902, "uuid": "ed68639c-ef4b-4346-a502-28a4314abbca", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229902, "uuid": "47ef1c84-7b4e-407e-b1d6-202aa8f02b83", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.23734.24346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e83b219-45b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693234208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234208, "uuid": "eebfdfce-fcc0-4827-8a7e-814d291c3854", "comment": "Malware payload (Mirai)", "value": "e0e3843a9ade868f83fea4a9bcc4247a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234208, "uuid": "25df957a-2db2-4cd5-be0b-e9fa3b767ad8", "comment": "Malware payload (Mirai)", "value": "99774221c045a6ae77a17cef018b801303bf9c1c25f8e69ca9e1e5e68aa3b449", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234208, "uuid": "e0c252be-53b9-4a5d-8efe-7e65e4cc633c", "comment": "Malware payload (Mirai)", "value": "f62839fe452aa7c2bdd4842338d8c22362bc310c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693234208, "uuid": "04d112a2-e598-403b-8c9e-4cc5a169319e", "comment": "Malware payload (Mirai)", "value": "b5c60f6a118f0e6569fa0f3760a8c81b467c4e4eb5f9513d69e71dca540577303ebf63a681cc4f359b2ef082c97a9d76", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234208, "uuid": "313f7e24-7616-424e-a692-c79388a858b3", "value": "T1EFC2D13097AE28B5C7500572F6BC56C5BA530FBDFAFE3C90124157BA3841D0929EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234208, "uuid": "d568128a-3bba-4e77-8def-53f1b4a6e76a", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE7YhymdGUop5hv:AWsoTAZ3alkXLvFh8nNEcs3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693234208, "uuid": "695d66d0-a3fe-431d-836c-773e174337f4", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693234208, "uuid": "8112f8a4-5c54-42a9-a49e-039e5f6c60a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693234208, "uuid": "3d950087-427e-4b5f-8106-d75bf58fcc03", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6f71bd-4585-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215229, "uuid": "673e7734-11b7-4a22-9ae6-01edfd44643f", "comment": "Malware payload", "value": "0c977850ebeda3f1fd57095bb74888d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215229, "uuid": "1c27ecc6-ea84-40f9-961f-c1acdbbfd8d8", "comment": "Malware payload", "value": "9a578cbffc230ef49dd2aa99c837b3c18b9894bfeb53bbabc0306d8bf9f4ed55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215229, "uuid": "71147400-1b4b-4c65-a436-95763235c962", "comment": "Malware payload", "value": "88f8bb7d4ab29da1d1063c84b9d1518a9b3db9cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215229, "uuid": "1b34d28c-fdb2-48e1-ae2a-5bb190857ec9", "comment": "Malware payload", "value": "80bc9927a5e59d95ba9c28fd23571108ecfb31a8512b8121dd57f1be4182cef9624803c169a536b256412229d0c2923c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215229, "uuid": "ae275280-c322-46d2-8aed-53ef5b854054", "value": "T1C936F1B684F7112AF6BA4538597A0DF4167F69E617CC1D6A1A00992E027EE0C33EDDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215229, "uuid": "5b7666ad-02c5-44ea-857d-0bc3cb13e2ea", "value": "98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdgITp:vIlQIN33nVKboT7MAwtCYzQQjn46yQll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215229, "uuid": "3b0b9e01-10ad-42f8-80c0-a08d950e1130", "value": 5045111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215229, "uuid": "e27a43e9-2fec-4b7f-b9d0-e74885f87dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215229, "uuid": "bfbbae8d-ae8b-46aa-81d4-88677d8c3aa4", "value": "0c977850ebeda3f1fd57095bb74888d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d62883-458c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693217819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217819, "uuid": "053be8bd-0b6c-4a7f-bb39-9b9678a8d430", "comment": "Malware payload (Formbook)", "value": "b8b75428d55e404d203d820edf8c7cd1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217819, "uuid": "7ad7cbba-8f38-4748-af4c-443e2490d189", "comment": "Malware payload (Formbook)", "value": "9a6af106a8ccd3da3a88d0367543f8486acab4ad765e7e540486e298b39c4184", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217819, "uuid": "af844bf6-965b-4796-95bc-37bb8026952d", "comment": "Malware payload (Formbook)", "value": "8e6c8163669ef4dda038fcaa7e033dfce392b64b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217819, "uuid": "8c9a8d1c-0e5d-4275-a518-dc94968323a5", "comment": "Malware payload (Formbook)", "value": "afc5893876b567eb7e67e2d2c215af4a46f1c986fd72fdf9b128693b09915b502db26a82b516d5ea6ec802ac3aeb4482", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217819, "uuid": "0159eb30-5da0-46b5-927f-037269b7d12f", "value": "T1F73423CBE641B4FF651456EF603B8889CAEA314DC512FD04E2FFA9E2F6D010C5AAD560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217819, "uuid": "38d969d0-ae3e-4c1d-9042-dcafb5bf01a9", "value": "6144:6bZPmMEME2VNwmdzdrGAiO0WijUg0SkuQPnGbY6z:aPVLdArWijUg0tuQeMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217819, "uuid": "0b2cc463-9513-4107-b465-10934772364a", "value": 245880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217819, "uuid": "b51c7255-a342-4f13-ad54-b5acc1b39408", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217819, "uuid": "c0720a6d-b8b3-44b0-b52e-00dfcc6e3a75", "value": "Payment Confirmation REF No 016747 PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d316673-4597-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693222743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222743, "uuid": "fb46ccea-465e-4247-8ff6-8249edb16bb4", "comment": "Malware payload (AgentTesla)", "value": "2ecd1068b71f8c0721a1a62334750c66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222743, "uuid": "8851f8f1-a2a9-4fa4-a3ae-d3d0361730b7", "comment": "Malware payload (AgentTesla)", "value": "9ca55c9c6644686ce6bda36e4aaddfddc520d5b7ce29ab32e15a78793e7fcfea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222743, "uuid": "57586cc3-e1fc-4345-a0a2-39944eee74cd", "comment": "Malware payload (AgentTesla)", "value": "68da71e2e8c5c434bc71d3a8ab98ef984bfa3b1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222743, "uuid": "335852b5-29f4-477e-96d5-dd8a5a01ac31", "comment": "Malware payload (AgentTesla)", "value": "05b8cb28937fc74f2e28a7c530bcd522e665dfd5acf54410fd788c5a928c4aa1a6f40039b4f8ec22fcbf003e18b85a09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222743, "uuid": "c6f6907c-b73e-4e65-afec-3c4e63bf3738", "value": "T195616DBB6EDF1F92C061873863E57B5870A8D0BBE887846B6EE3149145913703D0B626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222743, "uuid": "c0aaab34-b907-43f3-9c9c-8cd39401768e", "value": "48:9/Tzt1kJb3CBVWAfa5WnR0i6iSZ67C+fMmwqEGa4477yHjCZV:tT5+x3AUWRI763fMsz47OHsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693222743, "uuid": "f466080e-b7a3-4862-b3bc-d901efeaccf1", "value": 3456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693222743, "uuid": "521441cb-38de-43d7-ac51-fea00d02440a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222743, "uuid": "ac531f94-2e16-4d58-ae8e-c401ac05eb62", "value": "5091748316604922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33e34de-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235397, "uuid": "f2d96059-1b92-4cb1-9521-1c057b208dac", "comment": "Malware payload (Mirai)", "value": "faae3cfcd352c350225a3f4df2e7d205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235397, "uuid": "89deeafc-606b-451a-89ed-9ef8e9e13235", "comment": "Malware payload (Mirai)", "value": "9cab61a287d392a57d8a78040eedb5259710bdfd0d53b86ffa9f963339b10eeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235397, "uuid": "39850d84-fcdf-4c4d-94f6-c3304b4af1a0", "comment": "Malware payload (Mirai)", "value": "7e8e0ad581b98d13d8d430c00f671b09a811dffc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235397, "uuid": "bab7a374-bb00-4ad1-a7eb-a4c9aecf8228", "comment": "Malware payload (Mirai)", "value": "a1721cfc52b36ad549e0ca29642dce6f7b0deff9035c9cbbe7208d2ef13111046de81cae02447791c2d55b068e01f662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235397, "uuid": "f848d067-cdff-4e26-b27b-db86aa331027", "value": "T13FC2D084F141CE45DBEA69F03D90DAD6BFE06F1E59628E8066A453D25F4D3A74302DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235397, "uuid": "c90092c7-c122-4a69-abf7-1402479eb245", "value": "768:vVdafO76jpmNJJKehmA7trpfIX9KeA7PX54uVcqgw09F:bam+AnKehPRa9a/54u+qgw09F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235397, "uuid": "f4a4debd-d525-455d-80cd-4aef5852a18f", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235397, "uuid": "1884cd22-eb76-4f34-bb95-d6947d55db08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235397, "uuid": "43a60fc2-e807-45c7-b567-2d2e39903ef3", "value": "faae3cfcd352c350225a3f4df2e7d205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bab6e7-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232148, "uuid": "dc706b27-13d6-46da-bebe-f969c8f983f8", "comment": "Malware payload (Mirai)", "value": "e776f639ec5492cfb6cb17ba9dd78fcd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232148, "uuid": "af33af51-4997-4829-9605-885640c36e01", "comment": "Malware payload (Mirai)", "value": "9d3e16ca17ad51b917d54b401e4781e98f1513d2575715941bdfa3b7cf776a78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232148, "uuid": "40471eae-5b88-4da9-a26c-a20defb19b22", "comment": "Malware payload (Mirai)", "value": "b9bec3eec9d1e49bc07313250a60bdd1fb36e82f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232148, "uuid": "abaafc0f-e6d4-4700-9c8f-e1cb9eb70632", "comment": "Malware payload (Mirai)", "value": "ca5b6c566223b16badf4cbad6da405c4783b64287d0f711020b3b7148226b2848e25239147dcaa15881eb9b342e82789", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232148, "uuid": "25b001ea-492f-4924-ab86-7230d10c2b80", "value": "T1DAF3995E6E228F6DF668873147F74925A75D33DA22E1D684D2ACC1102F2029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232148, "uuid": "c9e48be7-9728-4220-a422-b37b53b35025", "value": "3072:JynVVSZYn+ge7FW4mPb5MPy3F5lPypQ9J:JW/SrpW3z5dFDqy9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232148, "uuid": "1bb86f3e-dcb8-4dea-b238-97c9a9411224", "value": 165528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232148, "uuid": "b2564307-5036-46b5-a68b-e34d34733347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232148, "uuid": "f7834101-4a54-4844-8e05-177e68030798", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec21b176-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1693228513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228513, "uuid": "ace7563c-8180-42ae-abf9-122494ef1405", "comment": "Malware payload (DBatLoader)", "value": "cf2977d95ae76db19faf09407a1ada52", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228513, "uuid": "56b11eba-34f7-4289-b407-4e4f24a72dc8", "comment": "Malware payload (DBatLoader)", "value": "9d6a45652f2446d9e3993e20fb784e997598a12db7ba4e9c6b435d6f82d0c969", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228513, "uuid": "847cc2f2-d41d-483c-a149-a52bb2acf25d", "comment": "Malware payload (DBatLoader)", "value": "800f533b74cebca8bc267ca510ca355242da23bd", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228513, "uuid": "e4de2e00-ff40-433d-8eba-6dfa4d57096d", "comment": "Malware payload (DBatLoader)", "value": "91e2ca16000aff1bbe26122a5afd186c7be540ccb85a1474c62434068f231dc602c7a2a81fe1d18d56274376ced81143", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228513, "uuid": "943f0470-3089-4a63-a1e2-d546366fa408", "value": "T1B02533A33803B9E3668EC176DB11E231E5C3A1D49957C1290E3CBD76B62F15ADCB091D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228513, "uuid": "40449c31-177f-4db8-93be-62f960fd484f", "value": "24576:YVB9C+nI2H93jqU+nO2xppbFlCeanSFN5tefjJiGy9:O7Rnz3mB9z54o5kbjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228513, "uuid": "0557352b-8676-475c-9523-dc050f9180c8", "value": 1007221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228513, "uuid": "d7b35b1b-ccb5-4cfe-bf92-b07639b09f03", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228513, "uuid": "634ea585-0dce-44b7-83c1-3442f051c26f", "value": "Request for quotation.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45244e1-4588-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693216393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216393, "uuid": "26a52287-8cb7-4687-a016-30f80626e90d", "comment": "Malware payload", "value": "c39611c8ae86b00d0472f3caab53e544", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216393, "uuid": "44297b19-6537-4176-b56b-f275d70382c9", "comment": "Malware payload", "value": "9eb996315b6a6f82af5e3e8ed07b75c17b0b69d86afe2e2b438fad1092371634", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216393, "uuid": "7139e9c3-8383-4d17-ac6b-77c044c520e8", "comment": "Malware payload", "value": "e8c1a1f8cabd444b5186eb5a370ae0633b1875c2", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216393, "uuid": "acd79d21-c6b3-4d30-a64c-1524a94f51b0", "comment": "Malware payload", "value": "7ba6f4ce8072e144f880fc3a5cbc564d117c174b46b39409828e476dc84e8cdb3098ad0d28dfe5e5eb9ca361d48ca06e", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216393, "uuid": "268ee416-b2a1-42cf-b54d-d443b7c852a3", "value": "T16574237FC94987F5CE5FF6BCA540831B6FC6B558A4C809B4E9023E8AA0D701246BF14E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216393, "uuid": "d2be7fc5-70dd-4871-9e63-86c285e0b609", "value": "6144:7NEUN/QCMtbF0TSVPgGRafF4FU9eF9deaNArmLe1bfB/UgsKl0AOTeveGrMvczb:7buCMtOTIgRfYU90n9OrHN/sKPvhrpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693216393, "uuid": "5c1e257b-09a7-471d-9f78-51be9a1d344e", "value": 363335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693216393, "uuid": "1fb62a64-77d1-4b3a-8a01-e2f46fe87b7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216393, "uuid": "d0204bfa-a73c-41ba-8449-08d4941533b8", "value": "Shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cd1af1-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229905, "uuid": "5c974175-f9d5-40b9-ae71-649862a63eb4", "comment": "Malware payload", "value": "ab7088b05cc37309952a3d8be6b842f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229905, "uuid": "8c820b7f-67a7-4cfa-8c2d-1af02c0fee94", "comment": "Malware payload", "value": "9ed15e0daac5d6d7213a18cd910ae6e0ee79394cef624af35fcbe0b68b760979", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229905, "uuid": "f05835c9-42d3-459b-889a-df3ce5a3c936", "comment": "Malware payload", "value": "9a25b389aabda0589d5a5974192b2046a2bde833", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229905, "uuid": "2f148134-285d-46be-9b6e-e0ff7f9b902f", "comment": "Malware payload", "value": "2f46f3d937928879bfe1536d9ea10f620f0e58b9484b1ab28a1c1f4e04306ddf3d9a38e99b3d848df09449c531a5edee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229905, "uuid": "d957c778-9922-4d7b-ac33-444cbcc7b6ba", "value": "T11F737D45BAD1C871E67E0A315460C6A16B3EB9114EE19DAB3B8A053E4F313D0DF35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229905, "uuid": "39ce8678-7d11-4731-b24f-38872c3647b0", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229905, "uuid": "8457384e-1bbe-41a1-ac21-a214a6b3f943", "value": "1536:XNEi7fdKoQocShCBPFvh2X/ciZceSsWfcd57C/mz5M2Ec:dlQoQocNBPFvGek57geMLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229905, "uuid": "42d83728-38a2-408a-97b4-954a6fb80502", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229905, "uuid": "5e68fe2f-413d-4590-95d2-959199448e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229905, "uuid": "924aaa40-bf7a-4a6b-b895-68c89f1e6a82", "value": "SecuriteInfo.com.Trojan.Loader.1704.7011.119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc737d66-45ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693244781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244781, "uuid": "e241c7e8-f3d4-45f2-aaff-6b862267245a", "comment": "Malware payload", "value": "70bcd5627f85f175fe019356a7a6f6b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244781, "uuid": "b4f20e58-16c0-46bb-b3c0-70ee7479117e", "comment": "Malware payload", "value": "9ee8cf8faa14e0285f0476df803446d38020564b7ae1f90f529a6aa925415f1c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244781, "uuid": "45c04499-b4f1-4697-8ee4-943e19908f2e", "comment": "Malware payload", "value": "488e16de0100ef97b6647add42359b7fe797a8aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244781, "uuid": "dca34ebb-3edf-464e-88f6-9c8485370d79", "comment": "Malware payload", "value": "406c1a2d11e0d1d49bcbfb74a0f19d514c6f06eac965a1520596e5fbdcd0e7d9e62192fb9d299b69cd596417469d9028", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244781, "uuid": "3c994282-6301-49a2-9300-0647860bcc5d", "value": "T13D8208CB7413609086F72166292F5086A0FBA9272CDCCCA1F64CD6E09F64DD9626FF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244781, "uuid": "81751be1-b48d-49cd-9cf5-38c430661f17", "value": "384:gXqXYKEgCwkVlLxt4i5YNlrNnkLGgH8zfpMhVB8X8wpsrZ48g7e6ynKF:ghkfkVlLx9YNPg63i48g7e6ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693244781, "uuid": "06722c48-2c22-4906-8cd6-8fa32bfc97ca", "value": 19098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693244781, "uuid": "122f9926-3c5f-4860-8a6a-c6ab4bac0a9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244781, "uuid": "700679d5-9bd2-4fa3-aac1-e8721203b41d", "value": "validation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e1b584-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693183612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183612, "uuid": "7350acac-80e8-4707-a6af-87e2ffd5c7ea", "comment": "Malware payload (RedLineStealer)", "value": "06f82a4dd32d02246ffed8ec59917c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183612, "uuid": "61290355-92ec-4173-bc30-bf26cb01e24f", "comment": "Malware payload (RedLineStealer)", "value": "9f22afcd388a931d7671adb3357c63932b9a64ac83804f2837e685a20be403b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183612, "uuid": "334d46ee-e684-4a78-8810-ca83da9e43ab", "comment": "Malware payload (RedLineStealer)", "value": "17a02713aa05c2a5fd615fd2b4432712b38b2a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183612, "uuid": "8c9d1aad-1907-420a-a9da-c1320f65ff8b", "comment": "Malware payload (RedLineStealer)", "value": "6d6451ea0255ca6996f5f19374518bf8e61fa75816540235432d28822157de9f41585c0e66ad30e12cbe4459220613fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183612, "uuid": "342d8e94-1e9d-410a-9d21-a2b5cb208dfd", "value": "T1B6E41203B7D89232D9F26B7104F347930A37FC9584BC965A6685AC8E1CB2A90E571B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183612, "uuid": "55f1ed84-5a10-4f94-b035-37efaf8dc8ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183612, "uuid": "5a6ad454-b9ed-4747-af1c-4bdbd61f9d2d", "value": "12288:EMrBy90Cpr/NxJQQNuz9iS0kPSd/PfaHC11QARWkUjnaPoOp5iTS+1Rx8Ic:9yHpz71LtPkC11QAFUOPNP+iIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183612, "uuid": "d50a1bc1-9203-455a-861d-63c7de3acf52", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183612, "uuid": "846ae5f0-4c9b-45c7-be48-85891806ce70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183612, "uuid": "3b2f62e9-b251-4ba9-95f2-128295d679e9", "value": "06f82a4dd32d02246ffed8ec59917c88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f72834-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693223023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223023, "uuid": "482250ad-9dbe-4eb6-ac81-8761d579f310", "comment": "Malware payload", "value": "cad4838c620f367d4282a3d88c3cb322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223023, "uuid": "e62cfda8-8c02-4b54-8f45-65deac944c5a", "comment": "Malware payload", "value": "9f8d7d34695a41cbdefaec06a7178fb78242e7c8d05afefa3391f7639aef247f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223023, "uuid": "afef486d-0708-4271-84d9-18a39d7e236c", "comment": "Malware payload", "value": "3f6289d5a163dea4786701c0fb0a4e551bf355cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223023, "uuid": "9d412549-296a-4621-b0f9-cf6685c78222", "comment": "Malware payload", "value": "4563be2912d9cc48b0a1173df0bbb3078a3d0653165f02e145cbb2dd8693fe779c7779a0470278e2d2f94efed4957bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223023, "uuid": "336b70ac-7e09-4409-8962-6b412e1c6e3e", "value": "T17793A75A6E328FEDF169C33587B74A21A7AD33D922E1D684E26CD1001F6024E545FBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223023, "uuid": "d739ddcc-be77-42e1-a14d-27da1ab7bba7", "value": "1536:JpjsBoxGQjv+/lwOQwOKuOzOwaEuCmhx3IEoiYAlwlTFKeDnz2:yacmjYEfo5Tz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223023, "uuid": "4f8e460f-340c-4b4e-afcf-06814052a014", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223023, "uuid": "407f53f4-cf14-4071-8bea-3e7600eb32da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223023, "uuid": "2b2e626b-3338-43d9-8153-9fc99ec7541b", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.18124.20612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40320800-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693214051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214051, "uuid": "5fc5a996-b580-46dc-8f0f-41681edc33f5", "comment": "Malware payload (Stealc)", "value": "4d6e3333ee6373138d915cd95fff9f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214051, "uuid": "d54b74df-55a1-4118-8887-8b732305daee", "comment": "Malware payload (Stealc)", "value": "a05c09738fbbb96b5d5846737d8bbff39b6ff4bf4d0efa51e80d34b555d7ee97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214051, "uuid": "a9d63c84-0e4f-4262-8aa7-af0ba046b03c", "comment": "Malware payload (Stealc)", "value": "4f5ec81ea87d80e88df006d77800d3b83a37ae0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214051, "uuid": "4e473737-30e6-4ccf-aa7f-f57d52fa1ce5", "comment": "Malware payload (Stealc)", "value": "0b9e521d63834fd13abc907175c728ab15106d26f0083116aece748820e18521a2409eb0bf8dc3cf7493b81eb2360672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214051, "uuid": "d4e82b3c-6d4c-41ef-91db-62ea094d3ec9", "value": "T15254BF127594C832D5523535C827C6FC6A7BB8B6C9998A8737843F7E3E31293EB25312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214051, "uuid": "92b0102e-526e-4496-81b3-865830fe1877", "value": "1c820352c29bb515015085b5719cc68b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214051, "uuid": "473469af-8db7-4061-96da-39283d4f9f20", "value": "3072:l5A5/LpCcFKRXFnWlR/ZfyzhfeW65AT1WLm4bVcEK5UITZuBS:ItBFKnWlRRfyzhfebtLm4ZyyITI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214051, "uuid": "01aba102-cf8a-44d8-981e-91e08c644cda", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214051, "uuid": "ad569b82-9328-4c9b-b11c-35dfccd1f1df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214051, "uuid": "09e34c8e-df73-4a3b-8000-c4228afc0068", "value": "4d6e3333ee6373138d915cd95fff9f3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1f738b-4591-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693220243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220243, "uuid": "99c8e61a-bc83-4ca8-a509-76209bfe419d", "comment": "Malware payload (Loki)", "value": "e3bb8655fb3f61348d680a345c0dfea2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220243, "uuid": "0401f813-3034-4a48-855c-325f79d853b8", "comment": "Malware payload (Loki)", "value": "a1cfb19de0975362946604d5231482703443d8129f5cf81717cd5043bd971474", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220243, "uuid": "0a0bbc45-4d4b-4d2e-8dab-6a79c8acd3d6", "comment": "Malware payload (Loki)", "value": "60a2c9787f77c36630834b80a3a75f4e3edc01b6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220243, "uuid": "ad605000-21c4-4534-ac21-3835de0e5f3e", "comment": "Malware payload (Loki)", "value": "0194ab66326e39dcf025d4deafd24e9f3b39d94d48aba935604be680cc79f6389fc7a46b0a219c5231ad4ffb9ab0138a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220243, "uuid": "ef510dd9-da81-4f57-9f1c-c9b93748dfb9", "value": "T1B302BE039947C00727932BB49E4F2D0C77359A2EC4FE58D59080A76BE2EAE847882A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220243, "uuid": "9c49ec00-0bae-46ea-8ec6-b44656462978", "value": "192:9n+haz5xd1T7LqCv8XYxk9SxI+WEqGIDxeY+OwwK9vlEaA:9n+8BXYY69SfqGIDxG9vl5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220243, "uuid": "86724619-db7a-40d7-9599-53e2b88ab121", "value": 8785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220243, "uuid": "25f9089c-1f3e-4ad2-be24-92f4f590dd60", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220243, "uuid": "9c12326e-b2a4-48ea-af4f-9945fc1376c2", "value": "USD Payment Confirmation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4894dca-4558-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693195858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693195858, "uuid": "29e4b2ab-3583-4b37-b18f-dd2d48f022f3", "comment": "Malware payload (Mirai)", "value": "942b4a2d2771e938770f38c74d29f2c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693195858, "uuid": "de68ff5b-e370-4ef7-bcab-5f664eb1f7cf", "comment": "Malware payload (Mirai)", "value": "a2b6cbaa81f35bed557019b562965c85cc8352008b3f7615418a4dacdf11fd38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693195858, "uuid": "d47531a9-62f1-4442-9d92-aa3af2146323", "comment": "Malware payload (Mirai)", "value": "c70cf0e38fe4acb11304801a79eece4d792fd61a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693195858, "uuid": "2ffcecb1-389b-4d05-bb21-7812ddc81a92", "comment": "Malware payload (Mirai)", "value": "7c1bb540f18ab93f93722c0460f66c85b510a2df43116e531da2a874d55b9b728d6e7f448d0e1427374460dfc711b197", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693195858, "uuid": "ef087955-4c29-4ce5-9dd4-d9ae9573fa1b", "value": "T161F2E09D610255FAE877C9379FD643423AD22B73C609CC81EE90FAE579810F2B5938D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693195858, "uuid": "7b93df65-1eb8-48a9-9b79-632ae6ff66c5", "value": "768:o+sphJlS8IUoTK3oYsS8mt8IaOYr6TfbvQl8YbDk0JgGlzDpUYs1AY:orXivu4YsSiIagjs2YbDksVqYUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693195858, "uuid": "270c3747-2b47-4054-8ca1-f01f1259e45b", "value": 35100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693195858, "uuid": "5b0e8d43-e139-4d90-8ecf-86205ea09930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693195858, "uuid": "30de0cce-613a-496e-9a3b-5b9388c6a537", "value": "942b4a2d2771e938770f38c74d29f2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b98bec-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212846, "uuid": "a1ee8a97-3604-4540-b3ea-c2faf793ff15", "comment": "Malware payload (AgentTesla)", "value": "964afd092d10290fd808713e07b5f832", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212846, "uuid": "91be9525-d991-4dee-a0ad-61e6991414b8", "comment": "Malware payload (AgentTesla)", "value": "a3e56a01d2e607d3c5e05fab78279f46fd2066cbe4e598b33c2de6e8cd58ff53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212846, "uuid": "34d6c0e9-9e1c-4e27-9700-b620ba21ee24", "comment": "Malware payload (AgentTesla)", "value": "eedf8ccc846b080b014bd0fc5181b945cbbba20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212846, "uuid": "98b90fb9-9616-40a5-8e9b-11932c1e6860", "comment": "Malware payload (AgentTesla)", "value": "f82edc55f30c1e84bf9c3353886e2686febc609dbac9f1a7dfae6c7b94070b47094e090b876bc0c3230f8e2f36387f39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212846, "uuid": "d6e406bf-19be-4299-a5d2-d2e08bee9b93", "value": "T1DAE423C740520D2793EC8191ADD819B30884704346E739CFA8DBBDE601677BA6EADC7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212846, "uuid": "5eb68df6-0434-47c1-b789-e58f395ac673", "value": "12288:1WvBDrJ8RBNQI2lOy3sJwsinh+JoTrCPBF/X66diZ9RDLTkikvGPhD:1W5UQ6sutYh+6CPBdX6WiJLpVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212846, "uuid": "874b57fb-209c-467a-882e-f0cb78b67417", "value": 722254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212846, "uuid": "ef1564b3-4b45-4d59-b4bb-aa30eee18cfe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212846, "uuid": "30a0f3c2-a53a-4786-a3a8-daf0452e1c94", "value": "New PO 17201.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4e2f13-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212707, "uuid": "55669b8c-95c3-4867-9ad0-a9be835575ac", "comment": "Malware payload (AgentTesla)", "value": "4c60966405a92acf9fbb4b2295e32d1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212707, "uuid": "e22f385b-3634-459a-b4ad-d36c4973b85f", "comment": "Malware payload (AgentTesla)", "value": "a6c1f1be97ef68cb5dd57644bd2eeb3d3e0345a3cbc70e7516b9387a77cba0f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212707, "uuid": "9edc4e2f-8ef3-4d7a-be21-3ff9eb7fcd8f", "comment": "Malware payload (AgentTesla)", "value": "89fc363a43f8d45cc9dfe15ffa50dec05f3408a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212707, "uuid": "e8608351-2626-4b7f-9d6d-c32489b4d496", "comment": "Malware payload (AgentTesla)", "value": "3f3205329a59162674005617a59f4b1880319c08d3242ec742abab4913e2dde54d8a1d3b58684cfbc6ed929ea58b8bf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212707, "uuid": "7314377d-920a-47b7-924c-fd7869be63db", "value": "T113F4338ECD31076EC0C58DBE33A6DA47C80A1F5C6979E43AEDCCA24C299D963175689C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212707, "uuid": "35574a92-e33e-4a57-ab70-edc4243f8b16", "value": "12288:T9LNlmPyi/Otm0b+PhDY+CDrodnxo4rc9xv4O2kBBS5nqWKEK8xUhp8s:xLNLtC5sDro8GYxAOFBS5rzVxUIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212707, "uuid": "14fec77a-de93-429b-add1-49458f2e930c", "value": 755629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212707, "uuid": "c8d50ea7-c679-40a8-8674-37a5e85925d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212707, "uuid": "7ab452a6-25ea-4548-9571-28c15d8625bc", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adee428e-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209511, "uuid": "0e79cb48-e496-4315-9ee2-cccd5e497618", "comment": "Malware payload (Mirai)", "value": "c316aea9e4d4c30c70eb56db457b1b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209511, "uuid": "be53997e-2d94-4e28-973b-9bd9b3e81847", "comment": "Malware payload (Mirai)", "value": "a7acb733f26a38af583dbae23f2517c593346b57d88887d6a6ab7ad3f2c0fd66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209511, "uuid": "b1edbfa1-5d7f-4ad2-871c-fa4c055434ae", "comment": "Malware payload (Mirai)", "value": "a6bbbb1ef13022ef012f5370bea4bb151a396263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209511, "uuid": "a94c986e-8698-4db5-bc8d-9b0feb17ee80", "comment": "Malware payload (Mirai)", "value": "44ca5114f8547241238f7aec89dddc724248332f0fd124a80a840c09831ad464085dd70a48538d260752705078871b85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209511, "uuid": "517b7946-9a17-4978-b9c4-fa1dc476af22", "value": "T147232996BC91DA0ACAD023B6BD6F64EE330163DAC2DE3247DC145F2436CA90F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209511, "uuid": "e7366169-5141-4076-a57f-55ea3a62a028", "value": "768:1TOD91Ug/ghNHSSxyhI7QgHZqx4F+ErnZJffui9BU5SpwpYWaBESZ3VeeB16Y03y:wKgYjHSS0ucxUrn7b2Spwq/uKqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209511, "uuid": "3b21ed61-6aef-400d-9b0c-d103a228600a", "value": 48260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209511, "uuid": "8bdb214b-7a50-4439-9b43-06258b94899b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209511, "uuid": "4f1f5a2c-aff6-45d9-8c40-436fc9adbdfe", "value": "c316aea9e4d4c30c70eb56db457b1b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2639e3fe-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212719, "uuid": "8d17620d-9277-4717-8c71-898ac2580337", "comment": "Malware payload (AgentTesla)", "value": "b7955d58cb50a78cde7642dd788eab19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212719, "uuid": "23c451b0-7456-456e-8e33-d6be14725ef8", "comment": "Malware payload (AgentTesla)", "value": "a7c605ebe5d96689e6e8e4a647f6db4c9d59ea1b1641dce7fe2bcefc06f12b2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212719, "uuid": "0c230ce7-a993-4432-8f72-5027f233c702", "comment": "Malware payload (AgentTesla)", "value": "b5e368ac25c638947f8632a5728c17ef5a8a3e0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212719, "uuid": "472cbdc3-07c8-445c-ba2b-3cbc68d8e274", "comment": "Malware payload (AgentTesla)", "value": "0a09259a434e76de7adefb288d6b734dc227f86796daeff2e8dbec3df93225f0c05f3879c2d7db489725188a790a95ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212719, "uuid": "fe22dcef-8d9c-4da9-95e4-750ca5e16616", "value": "T12D756D527AB96961EA09CB35C1DF14015BEF9D8127A3C72F294A3A7B29333BD8703147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212719, "uuid": "6781a228-d960-4916-8959-27159ce22476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212719, "uuid": "017721a9-f5e7-4c2c-8fca-7779e7e589c5", "value": "24576:ksKdNOst+khMahsyjMx7ctcbsR8+0lRt84zd7J4fn:KhMahY7cqI0bt84zd1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212719, "uuid": "04d4040d-385a-436f-bdc2-abf54c9153f7", "value": 1563648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212719, "uuid": "4a0481ef-e340-4e85-bedc-c3dcf8ec9cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212719, "uuid": "0d8fd151-58e7-4ea4-bf25-1abb438dae29", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48177c4-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183725, "uuid": "5673d8b4-722c-4980-8e0a-2c5f148804a6", "comment": "Malware payload (Mirai)", "value": "fa1c1fe21e447075eadbacebcfc0404b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183725, "uuid": "4b89a90c-685a-4b72-85bf-5a703a27b6c3", "comment": "Malware payload (Mirai)", "value": "a9869b4b90ddeacc43d1650e0118cf5e1e5e485703c6f43966fc29e3b9694922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183725, "uuid": "63930d9e-338d-44a6-9937-653617f6f310", "comment": "Malware payload (Mirai)", "value": "cc3d407849ea1cfb4c6c2fa80b83004496436cf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183725, "uuid": "9d015879-feb8-44ee-a4f0-a592dc63c344", "comment": "Malware payload (Mirai)", "value": "fd06905254f552a5e55e240bf8aa90b621b631d0bc3de53cb1e14e73df8b11764b0d6370b2cbf8de082df6d5b1a5716a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183725, "uuid": "95793453-85a6-484f-8ed8-3ff8ed65d0d3", "value": "T1C9539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183725, "uuid": "65b5d7bc-581a-442a-8933-209270a1eeb3", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183725, "uuid": "e9e963d1-77c0-4482-83d8-54f3c5d31a67", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183725, "uuid": "56dc158a-8078-4111-ae53-6915680d3692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183725, "uuid": "d06cb5e8-038c-470b-9b45-46e451510f84", "value": "fa1c1fe21e447075eadbacebcfc0404b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c977b697-4564-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693200967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200967, "uuid": "8bdb11e3-e32b-48c2-8761-717a7b35d2d2", "comment": "Malware payload (AgentTesla)", "value": "8a1f3bd39aaf55d7a31ad4e86ca2a7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200967, "uuid": "8cb6b92e-b1fe-40cc-8c3a-798cc31ac486", "comment": "Malware payload (AgentTesla)", "value": "a9b4d76d4ce03f4f076da2b44e771ce841a80a50363d3328a5fca8ee0ceaf7c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200967, "uuid": "d7ea411b-ce38-465b-b58d-e2bc8364835b", "comment": "Malware payload (AgentTesla)", "value": "4c26a13700d7160d24696824f7f299435dbc5c1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693200967, "uuid": "e62edf3b-def0-4fe6-8737-3251af8e199e", "comment": "Malware payload (AgentTesla)", "value": "af65c7005419628e3b4c7a6015b913a9b60ac12ddaad94ed8adfb155de210f8a4ce923ca99ef1de38bbb044e876e36b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200967, "uuid": "9b7b94be-6c6c-47a3-9950-8f2957a01362", "value": "T11645CFAE7BE8855BF06F1E7BF0B5071A17F0A8573232B70B455056581D83B83AD09BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200967, "uuid": "2afb8df8-f968-448e-a16b-6dc65c25c823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200967, "uuid": "6f52c959-3537-4187-a2aa-b2ad304da691", "value": "24576:0S6t+VbmZMQZW/fbHuFNrJaGqaSuHWck1oLfzBxsWK6iyXSH7A3Mj3jUY:0oUWb2NrE5ckIvfrLSbAcj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693200967, "uuid": "a7de81ef-17e7-4c28-b2ea-4fedfdef5ca0", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693200967, "uuid": "35dd7d81-174a-4988-ae20-8e460ce7ede4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693200967, "uuid": "5a7b0788-b593-4651-adf9-b5c5e5f7c6a5", "value": "SecuriteInfo.com.Win32.PWSX-gen.19556.9419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df23346c-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235363, "uuid": "429a4a11-9da7-444e-a9d9-39b1b7b2e6dc", "comment": "Malware payload (Mirai)", "value": "6505f9071a674734922b62cbdd8bd4ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235363, "uuid": "5355ff4d-6714-4b9b-a2d4-e4fc0db30de6", "comment": "Malware payload (Mirai)", "value": "ab1168cfd9ede16fc2e5cb4c5c358a1bb5ecea1b301f56963139a13a9b6fb26c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235363, "uuid": "6727f28e-ad62-4d48-bcec-4cc4d1eafc69", "comment": "Malware payload (Mirai)", "value": "7a4597f6645a8f9eade4a7060f41cfe9a65dccbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235363, "uuid": "4cb1fd47-d276-40e1-bcc0-94c67e6775f6", "comment": "Malware payload (Mirai)", "value": "3339665b1ca51eb068cc106ace79716663735363dee2ad5bbf27c89e34ca2902ec46ed9463dfeff655125e52a1601d7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235363, "uuid": "7df0fbf9-dda1-4977-b11b-0ea3686aa0b4", "value": "T195735D24A9792E26C0D4A17B61FB8321F2E6230E25B0D65D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235363, "uuid": "9425546d-0bab-4624-85e4-dec49d4aebbc", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8c:YwfdNu4cmZvFqI3w7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235363, "uuid": "ee461410-2d67-4ca9-883c-bbf294b8e2cd", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235363, "uuid": "12ffb8ed-3c9c-4688-9c2b-fc8fb2db9e88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235363, "uuid": "ffccb02c-76b1-40a4-a99f-f9922a39fa0d", "value": "6505f9071a674734922b62cbdd8bd4ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368c7c1d-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693215323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215323, "uuid": "f76994a4-a355-4f58-bb6e-bf442bfbc299", "comment": "Malware payload (Fabookie)", "value": "a6db8d26d0cba540ab3cf8806048c55a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215323, "uuid": "2866b69a-97d0-487d-85cc-de9a6f66d13d", "comment": "Malware payload (Fabookie)", "value": "ab985e1fa44f52ab1d3c776bfc2343af6660480af1fac4d1eb5a4503b7ac0176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215323, "uuid": "d074ecab-1421-4b1e-8eb6-6b29692bc5ea", "comment": "Malware payload (Fabookie)", "value": "7ee541e838678d7088f559acc3284af2ef9f21d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215323, "uuid": "ea4743c9-db1a-481c-bb65-81d91b6bb548", "comment": "Malware payload (Fabookie)", "value": "ed77ba7ebf5b78347d8cac5cad62c5786f24a0189e324ec458670aab206a1ae5f6d2b0290428b09acfcdc8a8fcafc1a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215323, "uuid": "1d91462a-d0a1-430c-96a4-076d5cb52f88", "value": "T1F4949ED2E25040E5D477C2B982734B62E7F27C285F214ADF4659B6292F337D28936A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215323, "uuid": "bd53d565-6f06-4b1c-962b-21f1492c902a", "value": "d1884757532ce7b0014241f40262c929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215323, "uuid": "179e598e-50bc-4f44-a6cc-8e2646f91776", "value": "6144:ul073J3gYxsK4ibO9rADWC4t0+eoJAbB3T+cbJp:z3JwYiKdqEs0+5cCIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215323, "uuid": "fe8e43ad-5b4c-40ae-9439-b8ea3be6f288", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215323, "uuid": "a6f53af1-2f95-41b4-907d-c352a6ae7aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215323, "uuid": "17b8c5f3-7c39-457f-9fb1-8946831604d4", "value": "a6db8d26d0cba540ab3cf8806048c55a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ecc75b-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693228981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228981, "uuid": "4fde584a-a371-476f-8c63-692d4937c092", "comment": "Malware payload (Formbook)", "value": "cab00c7d38e22b577abd3fb0679aa231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228981, "uuid": "635549f4-327e-4394-9a9b-cf0461df9a33", "comment": "Malware payload (Formbook)", "value": "ac254c8f30ac538efa1c6774d3b7e6a1b379af081c6cb15d36440e4913bc41c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228981, "uuid": "a321d56a-5ad1-4912-97be-f050c8ee783c", "comment": "Malware payload (Formbook)", "value": "6af98a27937989d4a10e2390c99552c5cb9a2695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228981, "uuid": "2050fe28-c2c4-47cc-9c4c-7d54446d93b3", "comment": "Malware payload (Formbook)", "value": "88c5aba63e53ca35d33d073059e9f273c5db5a6a3358bc292dddccc39970168c8c32a1c3deeff6356675562ef42a13b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228981, "uuid": "b61b42b0-ae8a-4822-8620-a5c83b0d1055", "value": "T197D4125022758E1EC8F54BF65AF0857783B913A4A03AFE262DEED1C9492B711C510FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228981, "uuid": "75e551a5-c0ea-431c-980b-847283f76930", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228981, "uuid": "9c67bd4a-f937-4d49-8e75-204dc6474ae9", "value": "12288:Byd04uf1RZga7CcluTo/OpkccX9ZR/FjRGCg/dq8sf70iHuBJ:sd+fqa7CcljOmccX9lRfglq8W70iOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228981, "uuid": "aa4a5a98-34bc-4a02-8f64-432c32660bae", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228981, "uuid": "ee5688ec-b0ea-4e31-b39a-d26d5d0baf40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228981, "uuid": "d75dfdfa-c1fb-4e35-a075-bb67bb796a28", "value": "LPO-T2662_TEC00937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eae7405-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212841, "uuid": "99b9a970-76a1-42b0-82d6-cf6346f8ec46", "comment": "Malware payload (AgentTesla)", "value": "d0521b06b473492250a94279f1179a2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212841, "uuid": "7355f040-2e81-4dc3-adf9-784d645bc295", "comment": "Malware payload (AgentTesla)", "value": "ac826a5d18b94967786544d631f253b7e9a8c18d5784d94fd5f73d34db8067cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212841, "uuid": "93cb0201-4f4e-4e39-87cd-7c74b33f341f", "comment": "Malware payload (AgentTesla)", "value": "78e5f17c4ee0c8a5bf845daf90e7ad52cae31f52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212841, "uuid": "1f77c65e-4952-4aab-a6a2-843d8227fb63", "comment": "Malware payload (AgentTesla)", "value": "fd28d7b5d289c88de662317afa9c6869662eb67938517fef4ec2e2669355f0a035153fe83ebacec5068f4679e56ed738", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212841, "uuid": "71177974-8ee9-457f-8dba-9e764c223e36", "value": "T176F433EA981A448CC94523732BEDDB7E162DD3C284871726371098CCB7D1E62E5EDC5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212841, "uuid": "2f90bf3e-4844-4335-a95f-721d77cb3da9", "value": "12288:8Fglfj6u7m/nokcPlcCYIcYhVU0nP5rqDhNIeNun8VI2sCMc+swp7I1zKhatHwZY:VN6B/nob5SYh/PUDfU6Rs7c+scatQZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212841, "uuid": "af6d5419-1d6f-49fb-ad4f-1d005f69d685", "value": 731780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212841, "uuid": "a39c3c4b-adda-4f8e-ba94-d0f76418c8f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212841, "uuid": "ba25ca54-3255-44af-bdc5-a177ce1d4819", "value": "new order green valley.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ec432c-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220832, "uuid": "3c7554a5-7851-4174-9ae0-0b5f4676b128", "comment": "Malware payload (Mirai)", "value": "be793fbe040105eadcb423b0210ef8e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220832, "uuid": "2fd31170-9c0a-4f01-a263-a584f7fa924a", "comment": "Malware payload (Mirai)", "value": "ad261cc2050df3cfe946bf6751e6012c2c5b0f1d8063f4f369dacd2bd9dfc258", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220832, "uuid": "843b9516-53f4-49ea-89c5-3a3c1f229234", "comment": "Malware payload (Mirai)", "value": "fa16fdae21da06b01138e01fa66662ac989febea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220832, "uuid": "f2229a23-8803-491c-9018-bef519d3dcdf", "comment": "Malware payload (Mirai)", "value": "7add7224b8199660f598d65b6579bb0343dbc5183665af830cefb162e0ed8b5189e52c0d695f13894c01e54704dce035", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220832, "uuid": "7661673f-fd57-485d-956a-8bb24ac766b5", "value": "T11AD2D1ADE4B502C5FD4E1C7D848C3BA10E5AA581231BDB9673218C4D6726C9BF17E4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220832, "uuid": "f434e48c-500c-4a89-bdb2-c902875c90bf", "value": "384:h8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjaXwARWGVCz0Nvv:uMYHb62x4ahQ3CfdwLjdwAWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220832, "uuid": "8ed9e7f4-d603-41f0-84c7-cdbd053242ba", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220832, "uuid": "49d0c11d-12aa-4a1f-98c3-ab5456d3052d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220832, "uuid": "e3bbb1bb-8fa2-4a04-87c2-450aa6dbb02e", "value": "be793fbe040105eadcb423b0210ef8e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaeeeef-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228890, "uuid": "e2f9ddd7-10f2-4f5b-9c8d-71a771d70f25", "comment": "Malware payload (AgentTesla)", "value": "6866e3bbb3ecdd6ffc26d7470606dfc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228890, "uuid": "14e00c66-b944-4566-9444-80927f76abf8", "comment": "Malware payload (AgentTesla)", "value": "ad42a558505302832160bdc412f6918d816e242fac0e6c78d009b52fee9fa7e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228890, "uuid": "c277e7fa-ec07-4724-9eec-dc869da7a386", "comment": "Malware payload (AgentTesla)", "value": "fe4b4aa7f6b9e1015e7110a3adee723e5afeea33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228890, "uuid": "cfc0c74e-67c9-4881-8536-6879bb714676", "comment": "Malware payload (AgentTesla)", "value": "916dde439e47766050040f3c17a86e299722a4e2dcf3db45d2357db0256520ca60551b55d4ac3ef5b1e966d632494dd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228890, "uuid": "9c25563c-ba6e-4539-9eb7-adc1e75e10bf", "value": "T1CED423BFA03CD11A9807442BA53F2F192D33243BE91857CD18389F68696DC119B738F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228890, "uuid": "56171b07-5ad8-4a63-b4ae-a7a5563c35cb", "value": "12288:SHvOiqw2Zwt37nafQCo9VlW+53CdgpKgbNIFog6ywraz1hWM/V0DQFbQvm:mvOXw2yihIzWoYGKgqFog6ywr+N0UFku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228890, "uuid": "038b94a1-4455-402f-b47b-592e42ffbdd7", "value": 599027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228890, "uuid": "c19484ff-d7b6-46ec-9e2c-500796d2bd99", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228890, "uuid": "3e58188b-dd91-4a3d-8154-e76ab69241dd", "value": "REMITTANCE DEPOSIT.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f286610c-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693229383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229383, "uuid": "8fc8b6ee-6e78-4a31-b161-9fe66a644d33", "comment": "Malware payload (GuLoader)", "value": "b3946e58fe9d9fccea2e69d50ce38c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229383, "uuid": "6ea67b5b-432f-4d3c-91bc-1d4e9ab47b47", "comment": "Malware payload (GuLoader)", "value": "ae7c9d1f1141ffe4337850314221767e268442255cde1edae03223836766206b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229383, "uuid": "d4a3fdbb-0db1-4d0f-a72b-1166630e721f", "comment": "Malware payload (GuLoader)", "value": "bb9ba6b860813377cb9f9e3d4e599aabbb7f390e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229383, "uuid": "bbe9c4f0-775f-4b51-b3ae-c1b67c7328c9", "comment": "Malware payload (GuLoader)", "value": "b84470493cf483308bad96b14bea6c7cb3061069b222e0f699554630827581474d6b6a11e4bc9ff7c2c7524964951ec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229383, "uuid": "e03f6a86-1299-4ecf-b55b-49903f76a6c3", "value": "T11FB4222067A4CA4BCEA712B7E475CAF49538CE09D932474B0F51BFAB7E323D28650381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229383, "uuid": "f57b1f05-f060-443b-9e13-ad5aa59ffda1", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229383, "uuid": "9ab904a6-e410-42e0-aae9-b05f8fd6872d", "value": "12288:OqYRUZ2Ro17RhWFcjccbl+xY5n3MF9Fslr51obRH+:ORUZ2q1HWF+jNMfGlgH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229383, "uuid": "1edc9b82-ba8d-4964-a470-c97730bbde88", "value": 518791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229383, "uuid": "4a52a9e3-923e-4ff9-84a1-078a3b36b1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229383, "uuid": "2653e6cd-f94d-4a1e-804e-45ceb751e30f", "value": "RFQ20230828_Commercial List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5efb207-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235401, "uuid": "d889f4c3-a10c-497c-a73d-8cc153e6ad94", "comment": "Malware payload (Mirai)", "value": "0538c1a557ad4c44477f3c8f5488c52d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235401, "uuid": "8aa15c5e-36be-4a4f-9442-07c78bf6368b", "comment": "Malware payload (Mirai)", "value": "af225efeb0e90e0df88d9d0cc41aa33a006eea79e68c48d2533e708a7ff3bdd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235401, "uuid": "2283ddde-a97e-424f-a5fc-cd69b02fc301", "comment": "Malware payload (Mirai)", "value": "f793f4165babc75bae0915a3c63d05a22e2ae5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235401, "uuid": "b43c1a44-98a2-4640-8cb1-a52e85725d9a", "comment": "Malware payload (Mirai)", "value": "0c3ed9465c3df7df0461abb244e783e707e10cbcf9273f37bbfa9f91f6ee21870ecc231359ba3a9a807d374cbcc245f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235401, "uuid": "e95404d1-d82f-4333-adde-4dfabd11ba81", "value": "T10F539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235401, "uuid": "f571492c-d2d9-47b5-b3f1-5fd333f40be8", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235401, "uuid": "d9861ce2-bc9e-4f1b-a253-f9e94640d0d2", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235401, "uuid": "c0782100-2576-4af0-9b78-5ecd97c94ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235401, "uuid": "6a5b7db9-9a58-47e3-9824-ba1454b5b04c", "value": "0538c1a557ad4c44477f3c8f5488c52d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4816a00-45cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693245599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693245599, "uuid": "07903f7e-ecf4-44c7-9bd5-fdc33433af3a", "comment": "Malware payload (GuLoader)", "value": "ebb2fbf1ada99dae67f8ef3a26b0a185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693245599, "uuid": "1a48da59-6239-4ec5-9e08-37283155c293", "comment": "Malware payload (GuLoader)", "value": "af32fd03c68a4ef6768979d866dbda9d1c6fa4d52ef35b548b3e1084f263c886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693245599, "uuid": "24606ce6-b736-4125-83fa-a47fcd025a04", "comment": "Malware payload (GuLoader)", "value": "8e6322d93dc00d956c8487cffd128032ab0fa77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693245599, "uuid": "294402fe-0e1f-44d6-8c33-88890f4bd0c5", "comment": "Malware payload (GuLoader)", "value": "98655f2459bdbd92a598998c507e215069f036ccc7a6192874fec5ec44a7de06de2c5c9093e9ff877c0a3ecdad4c10f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693245599, "uuid": "d6fad2f4-0c3e-4cd9-a238-95b4907fa3c1", "value": "T13194F1A293C4A1BEDC1A0F3020694A5749A7FD398BB691BE52C13F37713B1A4D13A5C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693245599, "uuid": "9f596611-4825-4636-b970-1cc6d0158157", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693245599, "uuid": "a210dcb2-8318-410c-a43e-146a82bb59ff", "value": "6144:AhRTwGGGGGUaGGxGDGkGG/aoWxDW4hCF2yoBYC1pd/5VdpiVGpCl90DTmpUdjptB:miWxLZ9vYl9Sjp7BEG73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693245599, "uuid": "18f821e2-780b-431a-805a-c4b35841445c", "value": 419784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693245599, "uuid": "ee5b9157-fa9c-4973-85d2-e2613461c312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693245599, "uuid": "417b9a6f-1695-422c-a547-f2dba7562057", "value": "BOQ- AE200033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741507c4-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693214138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214138, "uuid": "d8c3e4d2-e7d6-41fa-ae67-6fded4670e5a", "comment": "Malware payload (RedLineStealer)", "value": "65f91b60dfc9e276076ef187fe4cec2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214138, "uuid": "b313cbaa-17a9-4f1d-ad29-1d74f262eed0", "comment": "Malware payload (RedLineStealer)", "value": "b1b3a02d6c950c9d8ba038932d8bcfca54caa9d8eec3e09db2a01e7a2cd72fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214138, "uuid": "1ad06b39-39ee-46eb-a588-7320a874d985", "comment": "Malware payload (RedLineStealer)", "value": "23308e45878371d730224ccefe2bc9befac1148d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214138, "uuid": "c8201c54-5a83-4a37-b4a0-4b6fe4c2cb47", "comment": "Malware payload (RedLineStealer)", "value": "d24e6f924fd28f67c27dfd55af566263315057af725bf83674662ae38ddce3b4ff9daacfa863b1b738128436e1025819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214138, "uuid": "eb008615-3185-462f-9cdc-b44d2ccdcf10", "value": "T107652313E7E59473DC6A2BB058F615C32B353CA22968C26722E64D6E8C736C4E670377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214138, "uuid": "07f4ad3e-9148-44e9-aac8-a50ca636c64a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214138, "uuid": "886c7c58-7454-4bc5-805c-01a49e2c3613", "value": "24576:4yiLxwK3WVHf8V8kWQw8K9uyL/NqB7Sozn57YNkvDovzBU610fk22ACa/q5Kp50R:/swJ7kjbK9uyLXEn57MkozNN21V/WKpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214138, "uuid": "b65264de-b553-4092-9ddd-1a70fc2270b4", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214138, "uuid": "7b76635a-9aba-46c0-8792-9b51a29e50ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214138, "uuid": "b2ab3652-accd-4ba8-b3e0-ec06aa8b2c88", "value": "65f91b60dfc9e276076ef187fe4cec2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778c1d9f-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693214144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214144, "uuid": "0b63a000-0829-44c9-b96b-966fba17b909", "comment": "Malware payload", "value": "a55887313e9db41f20dda0ece62a9cc6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214144, "uuid": "590fd507-4bcd-473b-ad3e-ebf30de01024", "comment": "Malware payload", "value": "b2942623f7094de47cf7b450eae9398c6ff7ce0959845367db4c76275558aaa0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214144, "uuid": "8b3bd3fb-56d6-4f2f-8f36-2be87acbbd7d", "comment": "Malware payload", "value": "edab737f31465fe10912108c076c560691761c28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214144, "uuid": "304c611f-3971-4dfc-823b-c2867bfe1010", "comment": "Malware payload", "value": "c9889613fc3fe4295ef482cb63efca603fd7e9491f6a1a7a71ccc65897f77a01a17e02123b319893b781dd37da312119", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214144, "uuid": "c7e56020-4ea2-4fc2-acc7-6afd11c958c5", "value": "T1481633F5682353FBF7CBA3B22F62E4E97650D6BF882555F61C3898D239613635C80290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214144, "uuid": "eb49b78e-3e30-44da-9a84-22be7abce86c", "value": "98304:emB1kJ62BWOtIR7AzNS3mVmh/sxWruL0UUXoiEjCQYSRyEKu:ekKI2BFBS3m0h/P/S2QYwyEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214144, "uuid": "3e49d93f-0394-4400-93ef-7fb73a082194", "value": 4175262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214144, "uuid": "cd8414c0-8d17-4aa1-97a1-ad55d4780fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214144, "uuid": "3ab67899-8a22-4f7f-8c50-89be50b2205b", "value": "a55887313e9db41f20dda0ece62a9cc6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aae9b9-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693233473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233473, "uuid": "8473740e-d5bb-43a6-be90-7019c750b849", "comment": "Malware payload (Formbook)", "value": "c1d14a0b29a7f3829d1361363ec2e9b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233473, "uuid": "405f8048-5721-4e11-b083-ae2342e47c4c", "comment": "Malware payload (Formbook)", "value": "b2d76e91d736201b7e8fb9780594693cfc3106285a4886e9b40007fdd7e56359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233473, "uuid": "0fc3e024-e434-4576-ad31-e45e2e2b5b89", "comment": "Malware payload (Formbook)", "value": "11aa2f0448e47835ec84f975c13b9bdb762e7ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233473, "uuid": "1f66179d-ae1e-48cf-90f8-c2f06f26fc65", "comment": "Malware payload (Formbook)", "value": "407c603d600549b7fd184f228593099fcbdb4642e7b2d6e46f0cedbe38bad9502bd13d9c845db00bf02e507ee939dff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233473, "uuid": "2f237512-6b23-4bb1-869a-173b369a8303", "value": "T1A4641202E3A1D537E9B326B26D36A72B3EDDDB540A71C75B1B802E98B513111EE0E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233473, "uuid": "00627484-63be-46ef-a6cd-c4e1533e0938", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233473, "uuid": "9e391846-ed74-40eb-8a75-f505250c078c", "value": "6144:zYa6/oSLCCe6xEoeELdWc9K4TDRnqoW/U6k33K9uuo:zYZre6xEohLNJTDRniG3XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233473, "uuid": "0fd5e657-fc45-4dea-857f-b5cae9cd969e", "value": 321458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233473, "uuid": "3f534a64-4bda-497f-95ba-ee13cb548574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233473, "uuid": "f4711ebb-f77e-40fa-b967-2b3f59a3a1a2", "value": "PO23043_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320046b5-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266426, "uuid": "12ab316b-badc-4d4b-b333-61fc641976a6", "comment": "Malware payload (Mirai)", "value": "b22e9e75cc6e7f84407fb0cc10f1c9e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266426, "uuid": "7aa75a50-38fb-427c-9126-0241132aac25", "comment": "Malware payload (Mirai)", "value": "b3954dfea4349bd4998ef13755f48b1d474bdb8550269b5e5fcdd37074a8ee0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266426, "uuid": "0b83d293-3b62-4c8f-8e7a-723dcb4acd35", "comment": "Malware payload (Mirai)", "value": "54891baf11bb6b4535b217d750f7dc5f217e7748", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266426, "uuid": "f03406ba-4308-477d-955f-8ac3911988e6", "comment": "Malware payload (Mirai)", "value": "cce00f9bc19a745e8c2b7e77364a289d4839cefaf5ba46fe0cd007846955a5e52866d3adc602cbba00474d142c39d569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266426, "uuid": "000060ed-e5b7-4085-9246-18586da15d5e", "value": "T1E5C2F1246A17B894D6F4483CA97E8DC6F2659BB4D9F33B236A190DB8D1C0C8137B7352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266426, "uuid": "8fc081a1-ef96-4ac8-b390-d0dc4e79eef2", "value": "768:U1BDTXAjGLRDJ/9P+bl0pSxbnC+nA8oJM980s3UoznN:C7XhHobCY7oJMKRzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266426, "uuid": "7551e482-48a3-4a5c-aaf3-a8a050e8534e", "value": 27616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266426, "uuid": "0ecadf23-700c-440d-b544-6149b9ca5d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266426, "uuid": "5d4c3470-f893-4301-912b-20ac2cd6c15b", "value": "b22e9e75cc6e7f84407fb0cc10f1c9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b154f2fa-45da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693251607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251607, "uuid": "0b4e1df0-fbec-4723-a458-56bf95f7120f", "comment": "Malware payload (AgentTesla)", "value": "c65d60115972fbae6f1543eafd9e639a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251607, "uuid": "169c3507-9b63-4555-9c09-f99f6acf1bff", "comment": "Malware payload (AgentTesla)", "value": "b3d24b07e0511eebf55c52c8d7d6f5a1b5d8ed9bbc063864d10e3bf99ed43279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251607, "uuid": "6eea412d-b1c6-4dea-bc38-f0749304ef42", "comment": "Malware payload (AgentTesla)", "value": "23863f8a2ebf023b150548a9284c180cba383598", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693251607, "uuid": "0ecadb98-0b11-4de6-8e06-904abc380249", "comment": "Malware payload (AgentTesla)", "value": "c188de9d1cd9e2788c19d609fa3259dfabccedf6135f4bf0f83949310728c08c031fb07964272b344c2b1ef9be9b4d14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251607, "uuid": "fa6ee683-b7a8-4f0c-b076-46947013b2fa", "value": "T1DC340E177E48EB15E6583D37C3DF6D2823F1A0C70673920BAF48AEA529412536D6E32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251607, "uuid": "fda37737-8712-45b9-a8dc-d35ddd918b05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251607, "uuid": "7f9147b7-27d4-4917-afca-647ce5c9bae1", "value": "3072:kDRsdHyzkut0KABYwyUuOcNFcpyFuMXLRc5LoEsH:vfqABnyLO8Wip7RzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693251607, "uuid": "d0682909-39b8-475a-b4eb-7a2237c3e546", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693251607, "uuid": "6d6d6428-7245-4c05-a4c6-ef5b680c628d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693251607, "uuid": "1d5e2ffa-0e61-4a9d-9691-56c6a2ea2f84", "value": "16932516069d25cd3cdaaca87b988e5e3e104e5345a3a1ce7f31949f946b7edb600974bcc9130.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c630c197-457e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693212128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212128, "uuid": "56927633-b504-4c24-a5c6-b34c246ac78f", "comment": "Malware payload", "value": "2fa1f6aa05985845ef2cdebc49b667d5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212128, "uuid": "7a763aa3-2e48-4654-a150-70c27281d0fa", "comment": "Malware payload", "value": "b4eb0cb5fc323e79086181dd8d345038e9382ecf71a35a95236982154987eb10", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212128, "uuid": "543a302d-9cff-4558-959a-6aef3a0abca7", "comment": "Malware payload", "value": "28369139145b8dcd6146e76a89bd7671f3699345", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212128, "uuid": "d44e569f-1eb5-4b88-aa85-74339a38a67a", "comment": "Malware payload", "value": "5492453f43d6ae58b6c6457b9dfafb324536831970ad50ef949f9746a748fba9c4733cd3ffeed10388561d4b5f8d893c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212128, "uuid": "5b0bd8f3-a863-4d33-8c6b-15ebabc68987", "value": "T1E563702EE70F09199F55A77B435B4E4906BCB62EB38540B1396C933837EDC2E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212128, "uuid": "0c96c964-cf60-4fc7-aab9-5d59c089ca0e", "value": "1536:rwAlRS0W/mxK0+A3WYbRNeh5D5LYS1FS5dkbXTaZV7bm7hTXmEIo8JXVqY5i0iaq:rwAlAR/mx+A3WYmh5tLYS1FYKXTaZVPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212128, "uuid": "b98cff20-09f2-4fc8-97b4-5f4c7353cac9", "value": 69327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212128, "uuid": "a623f9c4-c5e2-421e-8bf5-f2a483569463", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212128, "uuid": "1e0e9fc1-e900-4e7d-ad35-1ca5f3090005", "value": "BANK MT103-20230828.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923a724f-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183694, "uuid": "202f974a-f45e-411a-93ea-9df5ccb86921", "comment": "Malware payload (Mirai)", "value": "1b5a5179c272ca4c7842146f81f88b3a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183694, "uuid": "1598e074-d4a7-420a-9366-557ccad584bb", "comment": "Malware payload (Mirai)", "value": "b5c483ede7e0602cca33e6ad6f511da4c1c858b599d81773d027bd4ec55010f5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183694, "uuid": "3ba29e84-c4a3-4638-a7e0-59cf2d9523d4", "comment": "Malware payload (Mirai)", "value": "f247ef9ac12d14b03d06b8eca0867f66bfb4141e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183694, "uuid": "abad9e8b-8fa9-4c16-bc0e-f46790a34294", "comment": "Malware payload (Mirai)", "value": "13b6e9680a7081fd09ce347e31fa05bac0a705ac7562b2f8146055958e559c33a51ee579d2dd279b17d2bc2ce0981021", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183694, "uuid": "7c4b3e6b-47a5-4722-a06b-e3d17c814eed", "value": "T1D7D2E0E3E1F7A2F5D4F378B1382AED80F59531678614035A41AFAE95DEAB34C5130E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183694, "uuid": "52a71666-b7b3-4787-9fbd-16300ab658cd", "value": "768:NYSoXdJZgicCHD+C98MP7L1YVPb2X1Sx0sp:NYJdJZuCj+CiE7L1APbagtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183694, "uuid": "9d34f959-e2e4-4602-9d65-765277c4d7d3", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183694, "uuid": "32f250c5-1261-4b8a-93fc-2e8cd2979e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183694, "uuid": "198626a8-cbf1-4db3-8765-e75f888c278f", "value": "1b5a5179c272ca4c7842146f81f88b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3d0f06-459c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693224945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224945, "uuid": "d71ebd19-8974-46e3-b0f1-adbf333951fd", "comment": "Malware payload", "value": "0da808ba5a17c58b80355ec970376d01", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224945, "uuid": "c577056f-1ef3-48d4-9783-a1d8c6ee5d88", "comment": "Malware payload", "value": "b6e7e6d9b7940e499995aadaffa6e6e9969d1b0ca1d512a863f1bb3b2ca0d274", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224945, "uuid": "b1f17ce1-2d63-40c5-9254-7b989a175699", "comment": "Malware payload", "value": "32865907766f5059a2f6b94ca5e0143a844df13d", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224945, "uuid": "8632a6ae-d19e-475d-9c81-eef6463e7eaa", "comment": "Malware payload", "value": "bbfc10bb58d2b9df123b0b9121eaac0a3107e74596a484c2efc6027e7e9d6507070e8bcc2254ea5bcf862f5403502cec", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224945, "uuid": "d6d5dd9e-7ee7-4874-b0d8-0970276d9d56", "value": "T113D2E1D7B7CB5BFD80BF9C38A264A4880C65370131A736CD269180DAF27952DB3CAB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224945, "uuid": "4369bfda-f090-41d2-806a-23f3d0d9df47", "value": "384:oULYXQ+bi1tPUR95x0MLGvcBIdYFOpRN3FenXGvvWB9MtTIxrnWwAXTVh4kPEBSm:/Eh0kioGUeqeVkcftTYnaXM/ruA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693224945, "uuid": "1058402e-a505-401c-ba22-a73c91d80f5f", "value": 28567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693224945, "uuid": "3d2ea348-8bba-4689-bd3a-2f042d3cbeec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224945, "uuid": "733e3dad-96e3-4f25-9513-11649d2907d7", "value": "S_D_233445566767.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d708169e-45a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693228048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228048, "uuid": "4fb993b3-806f-4f29-8312-716439d5bae6", "comment": "Malware payload (Formbook)", "value": "1afad6774b537dde1e9aae03499b72b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228048, "uuid": "d24258b7-02f7-421a-88b6-1b4d46d45483", "comment": "Malware payload (Formbook)", "value": "b799dc2f99d7cf59b9379f6ac7b32fe0852d2eab2386d20799c3085d38a576a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228048, "uuid": "0e084754-8075-4b2f-a3e6-cbffbaeeb3ed", "comment": "Malware payload (Formbook)", "value": "ff14299180b3ea21a88fc7e76f1e0cf27b82f5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228048, "uuid": "0dcba1de-9db9-42e4-9901-3ce08bf05ccb", "comment": "Malware payload (Formbook)", "value": "9d1040dfb3a6460fffe0948e9e6c153ccc8fcf05684966c3f5ddc76def0e7844d8dc089b00432fe6acecb8be32acb333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228048, "uuid": "4a4b7d4d-b8a3-4cf6-a959-0d3ac9a49ad9", "value": "T1BB4412687AF0D5F7F0631B313FB867647AA5AE0704394E0F53614A28BE31782D1AD3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228048, "uuid": "836b6116-e650-48e7-bbeb-9a1a44238a9e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228048, "uuid": "4cfbb629-6c72-48b3-8526-8ce88a0891b2", "value": "6144:PYa63fd+0iNU3A+QJH4TBw+JK2Ltg1lHt3wbLmNfZD:PYNfd+0wmBw+rLtg1JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228048, "uuid": "28dc3d10-8311-42c6-9107-7817aa8a935b", "value": 273674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228048, "uuid": "080b869e-5ca2-406a-8be5-d441f023aa3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228048, "uuid": "7ae7f2d3-d13d-4037-a69d-02520e5078d4", "value": "Doc#230823TRF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c363b7-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215297, "uuid": "434e876d-2b46-4cc3-bd4e-a156073d5948", "comment": "Malware payload", "value": "9a763983062d63c74ca33a0c5a8d5d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215297, "uuid": "de533f55-818b-4643-9ab7-e1366b3510ed", "comment": "Malware payload", "value": "b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215297, "uuid": "10bf3659-23e6-4cd4-b7b3-e10034f12f89", "comment": "Malware payload", "value": "82a82e2e70dafb8506758a9df611da8b6446468b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215297, "uuid": "62449bf4-b5d6-42d7-b76b-d09f58661989", "comment": "Malware payload", "value": "03d3bc6453dcb3ec033b82655f9535de6fc70a2e45d2b41dabb55631bf01496e5453de64625deb4c4151269efd7202a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215297, "uuid": "3dfac681-6b4f-4a16-bec6-ef99199628da", "value": "T12306333761061097D0E1D8B74A23FD81F3B656BA8BC3AC78B7D968C634354F8E292D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215297, "uuid": "d204c6b1-4d94-49ac-a7b8-191bab3fdf7d", "value": "98304:gYOpjnaDe7pEGzyiQDOuknu4TNPu5zGxQ:gbJEeOGZPuknu4TNAzGxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215297, "uuid": "d85cabd2-8c88-4d1f-b7c6-7dbdcfdc3f63", "value": 3743136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215297, "uuid": "361dac64-4098-4aea-905a-a1f7920dcc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215297, "uuid": "5e1387c2-232f-434f-b06a-e02bd6f60f7e", "value": "9a763983062d63c74ca33a0c5a8d5d91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31928f56-458f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693219180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219180, "uuid": "b0f067a4-13b9-4213-96da-2eb6b5a72180", "comment": "Malware payload (AgentTesla)", "value": "983fe31e4009a58e227ff68edc6875ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219180, "uuid": "8df38f4f-3a1b-4445-8395-e3095974a59c", "comment": "Malware payload (AgentTesla)", "value": "b9533abe6799bd22d4db9ee9c107262caeb7d5b2c939912bc2c764fa3def549e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219180, "uuid": "9bb2aaf9-5bb7-4360-8eba-87b42a6eea21", "comment": "Malware payload (AgentTesla)", "value": "60a3b917d21268457173cd614885a343b54f9359", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219180, "uuid": "fc46ba43-79db-46ee-b58b-90900b77de09", "comment": "Malware payload (AgentTesla)", "value": "dd39c50a2b10d984ac178769a9136572fb624a81e07e96b70152ba7f7356dc61dbf2901aeea6da70e3c1fb1f8aff148c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219180, "uuid": "09b2389b-5801-4d63-ae86-752b5080b320", "value": "T1BC35BF6711A74A1EE45EC1F6AC40C509AFF4B38D75D7E34E0C519AA38AC2BC1784EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219180, "uuid": "20f65e87-eb0c-43b7-914c-82119606d556", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219180, "uuid": "d01a1802-505f-49c7-83d6-dc6f3b070635", "value": "24576:MSyYX4iaZFvoV+Gw80TMUJddB+yoIUJmMAPmxNzl03sTsG1:kRia/vokz80TRvoIUJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693219180, "uuid": "471ac3cc-1bbc-42b9-b284-7a31cb4041fe", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693219180, "uuid": "67e16f2f-1c82-45d0-9fe5-00f43f81c800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219180, "uuid": "949b3031-77b0-44d9-9aeb-2ee09afbdae6", "value": "SecuriteInfo.com.Win32.PWSX-gen.580.19008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f4ab31-45a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693228041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228041, "uuid": "401a5c37-9fb4-469f-b8bd-c70aedfaa77c", "comment": "Malware payload (Formbook)", "value": "f2b021e82dda20584a6a39c0bc64f61c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228041, "uuid": "22f9b9a9-5939-4318-9479-8ad15f58d04e", "comment": "Malware payload (Formbook)", "value": "b9936bf91a41df2ac9731932cc6fd89937991bf8b5f3a057db1cc61902eba9b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228041, "uuid": "98faef49-4cd5-468d-99a4-37bfd058ce35", "comment": "Malware payload (Formbook)", "value": "73f0c5a0421cce448f6a3256f1ee2bf280d67dd9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228041, "uuid": "f5e5f5ad-bbe1-4fe0-bde4-4e075728c1eb", "comment": "Malware payload (Formbook)", "value": "ea01b6b621541a79bf7eea9fe39ec7612629ceb081ab855c713d7cf0739e568f0784d2dc44032980ed85086c8102bec5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228041, "uuid": "d8644905-2486-4958-aca9-4d79bafb7ca6", "value": "T1144423BC6C7A2AF671162B7D7BA8776065213F0F15274C4AD3AB5C20DE20E4AD0FC199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228041, "uuid": "2ca28e10-fb31-421b-ba1b-937a0a53cc52", "value": "6144:9Hgpoque360ihU3A+Q/HSTBw+JE2Ltg17Ht3wbSmNfZF:9gue360OwBw+1Ltg1uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228041, "uuid": "83653ccd-a5ea-4b5c-8a9a-010f079173ad", "value": 259634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228041, "uuid": "91af0d31-1ef3-4a98-8c39-f36dd8df9b4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228041, "uuid": "ab8b6363-4856-4463-94c8-0e3542cf5edb", "value": "Doc#230823TRF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b4ac54-4594-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693221551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221551, "uuid": "8ba49435-2079-4709-a173-26780d32debe", "comment": "Malware payload (AgentTesla)", "value": "f86305e5c746b158c7f248ef34e953da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221551, "uuid": "b2f43c4a-e49e-4b82-a8c1-f41bd843e4f1", "comment": "Malware payload (AgentTesla)", "value": "ba622fd7d8cbe31e6e0015cd59bee84d15d0756d6a765e5d2725bdc210627f6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221551, "uuid": "570f7138-40c8-49b5-8d55-434226b26644", "comment": "Malware payload (AgentTesla)", "value": "bf91723e19ca7822f3ff646e9e1571fff85708f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221551, "uuid": "7fc05da7-a134-4769-a8b5-258281e5bab5", "comment": "Malware payload (AgentTesla)", "value": "6ab15015eb6d9938628d95eb9aa2980174ea360314f96d3e3aeb270ffa8b34d6dcba5c6781a98cebb11f26e58e793527", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221551, "uuid": "c93ba5b2-7f02-47d0-9c4d-b9922e329579", "value": "T159B4020ABB2BFFD9C53D57781822884463F4D60FB221EB6FBFD115D12A91A148724B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221551, "uuid": "67bef9bb-9d3b-4c05-b765-049e25f2230e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221551, "uuid": "a758348e-b240-4a4a-bef8-9fa25ce33f11", "value": "12288:gmlCM+xLNSMh69iBmw5jVSeNCTFgJCrrMzCh1XAhlW9Mm6+70pKXQl2FN:gbbpht2eQYCrrDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693221551, "uuid": "76fddeed-5bd8-4552-860e-c100bc114e87", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693221551, "uuid": "b51f9cdb-7c51-49c1-839b-5b35a95ad459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221551, "uuid": "6b65f75d-4fea-4bd6-be12-b3b73768ecc8", "value": "IMPORT SHIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f157f751-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228951, "uuid": "32319ec5-5e9f-4a05-8454-5e74e7f62fda", "comment": "Malware payload (AgentTesla)", "value": "85ec01661cbad3e989b8ec95d425f6c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228951, "uuid": "d9ef9e9b-f917-4cb4-9c0a-4209845c7647", "comment": "Malware payload (AgentTesla)", "value": "ba9c3c57c56e26ca165acc549d8bd48a47278f550ea2bcea4dbf6d0441be1e57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228951, "uuid": "2a3ca1e9-eacd-494c-9cd9-68bb729fe99b", "comment": "Malware payload (AgentTesla)", "value": "dd8bfbee7d62aa29bf93817649c0f84bae48e8b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228951, "uuid": "a2fc5793-e4ae-4c5e-a411-23749c8dff27", "comment": "Malware payload (AgentTesla)", "value": "ae942e01d2dbf554f7b370d912c8d85444e4737eb459a25e9939f63463283be941c7c4b364d2eab8b3ad0923f4bfda78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228951, "uuid": "08046463-80c9-4726-9b36-bf286240977c", "value": "T1AAA3120D9AC18F0104D0E5D49C8A9241EF637DF6B327867D2E9C5E0ACC6B688961EC9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228951, "uuid": "060eca15-63be-41ef-9d05-b174465d65dd", "value": "3072:yAJ7bsqMdHDfxodlYlk05YNst6UExjREZj:37bAH0Wk4t4Ex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228951, "uuid": "a929de82-9ea4-4c30-ad09-607540fc8f62", "value": 103927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228951, "uuid": "cb2e50d0-b924-4cec-8047-df0420430aef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228951, "uuid": "dcf0acdd-8d07-42da-a734-0fc3a015ced9", "value": "B 59555 PO 652715.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7752f2-458e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1693218986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218986, "uuid": "8923f089-d14f-4e7b-b73c-35736d04f7b9", "comment": "Malware payload (Neshta)", "value": "2c2f31b9754140aaf4cdcc88d3806851", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218986, "uuid": "68501f4b-4430-4348-aa4d-7ad5930b8151", "comment": "Malware payload (Neshta)", "value": "bb6346421d32ed13fa7e0162f239c3786afa9ac9c06193f8f0a6d73c7709d459", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218986, "uuid": "9cc646ed-b74b-4647-b58c-da6bba4a345e", "comment": "Malware payload (Neshta)", "value": "491e8fce49fe848eb3e98d23bf31ad34e6a1990d", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693218986, "uuid": "5b60d636-d1cf-441e-956a-4d6954ae02d8", "comment": "Malware payload (Neshta)", "value": "b14bfceacac43183cf8fe440a5e0dd58e1e118e961021704e80f8f5b16a88e8c24e9a91103f5e234680cddbfe3aff7b9", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218986, "uuid": "0e09b9df-cc2d-4270-942c-e553b1ffe359", "value": "T1DC2533A48FA37D838F929775A36ACA14C769160DB5BD325A7307AF00DB7B530E4C4863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218986, "uuid": "b357491f-9527-491c-87b6-ab31af4e06bf", "value": "24576:sy+/G1vcKh0zPhqv8ZhdyVjNBkMwNQtKJ:r+ukkvqdyVmQta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693218986, "uuid": "577f37ee-f18b-45b9-86c0-9c992b4fe0a0", "value": 968762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693218986, "uuid": "9ade77c7-170f-427f-930c-0888246bfb90", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693218986, "uuid": "3ddd36f3-1163-4c20-b8f0-62b84dfab6f5", "value": "UPDATED SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8192d80d-45ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693231770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231770, "uuid": "0640a6da-f331-422b-aba6-d366c7dc7e20", "comment": "Malware payload (AgentTesla)", "value": "5e705fe91f56eab4d1df1e0517724310", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231770, "uuid": "aa47dc64-5434-47d5-b014-dd834646d319", "comment": "Malware payload (AgentTesla)", "value": "bb8d35a8553ccd23f5261bed1353f301f6483fb67a5198fded1fc1022a21481e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231770, "uuid": "1a4b84c9-592d-4e85-8c40-2f071a3952ce", "comment": "Malware payload (AgentTesla)", "value": "fddd692e5eb16fe82e2a49512d0ac24cdbb79f76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693231770, "uuid": "1b6f994f-9b46-4eeb-a50c-19e7ede72733", "comment": "Malware payload (AgentTesla)", "value": "6b9907aadc354e5c34758fdf6935b4c1827e932ff11ddf844d37eb384c5183b90eae0174cd407a7cb22342ee82445f95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231770, "uuid": "90c45760-9c7d-4984-bdac-434fb12d30d6", "value": "T117E40113BE02EBB9D03F87FA3C25D5415266EE1E6860E7A89C9636E19C31743847DB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231770, "uuid": "4bf4ca65-086c-4597-9a04-c745f703888f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231770, "uuid": "0f7117ef-8277-4e87-a507-af6a09943f2b", "value": "12288:DzWJp09T11qbXWtbu2OQyYySzYDeomQs3MsZ+Ii2lkGzHsW0FRXMTLgo/f81pfrt:DzF9hwbEbu2OQyLXeomQkjZeE7sW0FRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693231770, "uuid": "6f6a7797-8bc5-4220-9855-3bd03c16753d", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693231770, "uuid": "8bce9529-72ad-4548-8d85-c27e5a4dc569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693231770, "uuid": "e54d38ee-61bf-48e2-9c76-11602d1cb494", "value": "Q-4534-1_ EMS IDC .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc54d76-459c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693224919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224919, "uuid": "e1a0b34d-5721-4a0d-8293-f353e7d55f31", "comment": "Malware payload (Formbook)", "value": "e371bea4d24d3f5aafe429eeaf456190", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224919, "uuid": "69894ebe-8344-47e2-9975-3cb547234746", "comment": "Malware payload (Formbook)", "value": "bce2648e414bd48813ef7da8a379d44dac02bf98272cf893404850df54cad5d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224919, "uuid": "0b543eed-b937-49ea-9b2d-e66995d2407c", "comment": "Malware payload (Formbook)", "value": "3e5408d2d74049a3b981ee670d2d574d6810a1d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693224919, "uuid": "89a89816-44f4-42db-86e7-47f519c51342", "comment": "Malware payload (Formbook)", "value": "96e881560039a15e792733991257a1d09cbd2301d0d7d517a80d1530859c4443390a86615d921f8aee56ab16a107a68a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224919, "uuid": "5a4df764-74b9-4512-bae9-393a3bb65ce9", "value": "T1154423E40479E74CEBFCD2F25BD50FD5B2850549AC59EA242708BE2DBC3788DD0A249E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224919, "uuid": "292f7129-2263-4a56-8106-fea1af9a3495", "value": "6144:3NL0z9x45+UXg/ACblAVnZLySPXnWFs6r6U5skLN4fYyHl+tHO:dL0z9JvOLLRXWFs+6aN9NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693224919, "uuid": "77c8ab3f-f260-4e15-b2c0-bbe80d3d0487", "value": 259739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693224919, "uuid": "1c7fd9ff-047b-4880-a9ff-288e3fa05507", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693224919, "uuid": "085349d6-b2f0-4622-9064-0a24a45f9335", "value": "Doc#230822TRF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3d303e-4585-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693215041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215041, "uuid": "5fd95629-c5d8-48da-8179-ecf1f231b63b", "comment": "Malware payload (AgentTesla)", "value": "63135a2c2574a840e9a78353f0dd17b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215041, "uuid": "2c5c1297-cfc4-4bc0-bfd1-d76b140a4cf6", "comment": "Malware payload (AgentTesla)", "value": "bd287c877d05a79d58188aa156b9a038a0235095ab277f1103337ac45811a8be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215041, "uuid": "65fa7dce-b3d3-470a-a1c9-68d1b58b46c5", "comment": "Malware payload (AgentTesla)", "value": "b84aaaa277062056c1124e7f8fcc2636a977bb5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215041, "uuid": "30aa0329-c0f7-4ad1-83a3-aa351fa91cd8", "comment": "Malware payload (AgentTesla)", "value": "966d0428dd7cdda95e44f152835498a2fd281d7f4542fb4a68145a45fe19becf6e881a9c3cce16ec66124bfdf00f14ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215041, "uuid": "4e519e96-b183-44a9-84d7-4db8e51ae68c", "value": "T1D6B4231C52AFA99DDE78023D49F55229F1255FF94CB8E8006C48B849F50C9737EB3EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215041, "uuid": "9e7afb36-a906-4eef-bf85-9b511b4f3a65", "value": "12288:Wxc8x5qC9uHXMGaDFHu3GhxT6a7VCvTX9atmPvHsu0bF4Z2umn:Wxv5eau8pCrCmPvMu0buZ2u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215041, "uuid": "3a01b935-5387-4398-aa10-b0489093f8b1", "value": 496402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215041, "uuid": "0a24931b-7056-4c85-a8a2-99a2c8855f4c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215041, "uuid": "1894feeb-39b2-4378-b12c-d0438e9cc6f9", "value": "SHIPMENT DOCS 2X20.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf37cc0-45c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693244377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244377, "uuid": "5d43b16a-b569-4762-9282-2ca9744234ed", "comment": "Malware payload", "value": "5eb79b8d03aea9748144b19197617bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244377, "uuid": "56ba81ea-200a-4f14-9717-1bdea82c40e7", "comment": "Malware payload", "value": "bd3f8f2dc698599fe926c72f7711eafe68d89911bd447fa84cd2437545417c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244377, "uuid": "c836909c-0c06-4401-a26a-6c5211ecee89", "comment": "Malware payload", "value": "6f9c5bcb01bfba4ec41b9c4e7f5c43c4ced31aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244377, "uuid": "536a0a3e-09a3-4c09-b8c1-0c568927a331", "comment": "Malware payload", "value": "1fd3d188fc1facb3963273c594e0fd32745ea4825952aa8afbea7ba12f1f65389d6c151e195b9b669a5bc549a3ff5ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244377, "uuid": "a84b3f6d-86f7-4b9b-99af-dbe6042b6615", "value": "T198447C1075E3C436D572053209B8D7B6467EBA310B649EEB93C55B3ECE341D2A732E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244377, "uuid": "87e455a6-b2ac-42fb-87ad-9a07197bb5a0", "value": "1ee16709cceb1eb1198d796751935b3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244377, "uuid": "30aa62de-a78a-43e8-93a0-3420b7d84d69", "value": "6144:TO1a7HaJ/IG4YXSHJXS2IZizNrwJuP6AyXAOIbg:TEaDCXSdS2IZiFPIAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693244377, "uuid": "5aef7cdc-95df-4866-ad42-5d472dbc55cf", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693244377, "uuid": "830d70c9-4d8e-46e2-a5bb-e59e3d149720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244377, "uuid": "108ee9f3-87c6-4d93-bfb9-d238d805ee89", "value": "icetea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ef17b9-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183729, "uuid": "eea26e31-4add-4234-8835-3e9a3871363e", "comment": "Malware payload (Mirai)", "value": "cad0000d8ff0335882f7f9b6e2c4f6db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183729, "uuid": "cd6cc246-7f7c-47b9-ad46-a0e966cafc46", "comment": "Malware payload (Mirai)", "value": "bd50f68cf4a6b19f5ea8d41a30ec8c6ed3717927f514ac4c1e52fe4705e72829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183729, "uuid": "bbb41889-9b0f-4ebe-b13d-46577144c261", "comment": "Malware payload (Mirai)", "value": "13bae3e8b8ed1c324c7f9660a29b1752605046e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183729, "uuid": "edc5a97a-f168-4618-91a3-5b4dc9e0bc90", "comment": "Malware payload (Mirai)", "value": "fe325076c43ffb6f048bb661cf20a6291a0ee23b8dc91599fcacbdf3e901de7e12708fff70d6a9ec2e35835ea3ecd878", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183729, "uuid": "3197c86e-20de-4ade-9ab4-81c5ed009789", "value": "T195E201A7D372A052DD786BB2F5AD85CA2ABD4FACD27B70A3051517182D9B0435F3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183729, "uuid": "68ec6f05-671c-434f-a450-55ebf8f5e2a7", "value": "768:8oiWiO031vpAPbrVWZK3XVGxm9XqI9q3UEL5Iv:8orm1vpALgUJqxLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183729, "uuid": "a0312b9b-ca9e-4c43-a0c7-03de88edbb73", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183729, "uuid": "b520bba8-f114-46af-9c1e-c2ce0e35b58b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183729, "uuid": "039a9917-0060-4537-b1e6-9496f83c2165", "value": "cad0000d8ff0335882f7f9b6e2c4f6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16223448-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693233308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233308, "uuid": "931c3819-455d-4376-a2d2-10e8779f4806", "comment": "Malware payload (AgentTesla)", "value": "7766aa5317b565289ed368aa77a51a8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233308, "uuid": "b6e58e23-7c2a-49c7-8725-dc7822f87af3", "comment": "Malware payload (AgentTesla)", "value": "bdd1de41cc8e6f50d19ff4bd6fef1bc61a978665c9bc8532acf8876dbe300879", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233308, "uuid": "b3e110a0-c2f8-4e65-901d-149c88488c18", "comment": "Malware payload (AgentTesla)", "value": "7c262c4197ef20f7708091811ac94afd7ade2478", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233308, "uuid": "a2370805-8616-4271-93a7-c19d4e4a6513", "comment": "Malware payload (AgentTesla)", "value": "f34aecff32eec2540f1e99dd3d0fdfce2a3c4239219ed7801c612ec2d32a5ff15aa95342a4d45c4cbfc040413c7b8ef0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233308, "uuid": "dacc021d-cccd-4b67-8d05-a2fc1b944688", "value": "T195C4483C1CBC5E22C074D6A68FD5D021F154C5EB32A28F3A67C79AA5470E90229DBE7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233308, "uuid": "21fe3b74-d75b-4d4b-8677-04112373ffa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233308, "uuid": "336a9706-5152-4b30-817c-694b39380694", "value": "12288:vmizQY/CknGwBfNXYWSTqr/CGPLqDWsqnNWbl:vzQY/CknxOqTDKqNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233308, "uuid": "62abee62-3442-4074-aee3-b27a6d540ba7", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233308, "uuid": "5a9b76b1-156b-4ecb-93e5-aeba53521d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233308, "uuid": "d676328a-548e-4688-a43f-548d3180abcd", "value": "SecuriteInfo.com.Trojan.Siggen21.4469.8978.3773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e457646-4560-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693199123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693199123, "uuid": "6ce339fb-a5c7-46ac-b29d-5e8bd9655793", "comment": "Malware payload (Loki)", "value": "ea368e5394db4f89769bc09aba0f26d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693199123, "uuid": "34d59186-4c93-45e9-a1ec-f9376ad7d2f2", "comment": "Malware payload (Loki)", "value": "bf6e98c839e903874bf78b089e4936b4294747664464be6be434dbb54ef85c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693199123, "uuid": "753ee0ca-fef6-4460-a0f8-8ab73de084a9", "comment": "Malware payload (Loki)", "value": "c9ce657c80643c480edc785183ca171b73920112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693199123, "uuid": "778f4dab-336d-4ca4-a833-820b18fbe42f", "comment": "Malware payload (Loki)", "value": "b9f3cc707bfb355c6515af154d00b2c06b48d247e8afa7685ed503ba647d70d8bd7f99c05b2dfc1430ab735f60a5a0ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693199123, "uuid": "78a532da-3f21-4096-bde3-dc076874c9e4", "value": "T168B4F163FA05AFBFC53B41F93C15A40009B2AD1EAC50D7D9A896B6B25CF2363503961F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693199123, "uuid": "c2ff59d3-ee76-482d-87fd-9cb9d3e30a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693199123, "uuid": "8fb9ecb1-efe0-4f26-82e7-b2e87a31aac6", "value": "12288:nXWJp097DNnFV5kh4pmv06KygE3f5UAu6KTiEJ:XF9fNnK4EvPtRUAui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693199123, "uuid": "7649abcc-5f19-4eb9-9311-6e09cb00d0f1", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693199123, "uuid": "0f5a63ae-e4fb-4f53-8e07-9b22876fe6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693199123, "uuid": "83598300-dc6e-46e6-b640-015d00246d3e", "value": "FRH-G-MR-23-V-0375-docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8516e85-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215568, "uuid": "d90cfced-0197-41b7-951f-c0f2c0edb5cf", "comment": "Malware payload", "value": "0d96d7b0ce9460f00cb5d86a4adc492a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215568, "uuid": "5f5a4cc0-6ad3-4fb8-a770-c76ecc42fa13", "comment": "Malware payload", "value": "bfc6cb663772226a7c71a8e8337a40986ddb6d03e75b91087c82d72417fd3886", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215568, "uuid": "4c708613-728a-4fc3-82f4-d3c3bf937852", "comment": "Malware payload", "value": "e2f7a8ba38450edd0fe857e9d0ca16389891f58d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215568, "uuid": "32a2aa46-1be5-492d-bfb5-20149caa5e79", "comment": "Malware payload", "value": "127ac40dfd0f40eddda41cae55a6b2c935f043c4c8686b25130e63eb52d15f340d11bd1805cbd579643b865bfd911462", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215568, "uuid": "4ccdecfe-1964-478c-8a85-dad3c4f643f2", "value": "T1A553826EE30F0919DF52967B835B4E4905BCB63DB38540A139AC973837EDC2E462297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215568, "uuid": "0460b872-0937-437c-a22a-0da41dae5bfd", "value": "1536:6wAlRDoTG5jjTT+SN5YXKZubS+/ZaP1NEiyu/8UXMcHeNJ8of6V5UYfoxd7z8CVm:6wAlhoTG1TT+SN5/ubS+/Zo1NEiyAMc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215568, "uuid": "51aec89b-cf7d-47d3-85b2-2acc28da3cfc", "value": 64107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215568, "uuid": "ab0ea909-4341-4527-b772-1eef5b2ec71b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215568, "uuid": "508e0d56-d071-4d8e-acf9-c745596bd37d", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.23032.28871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7161d4d3-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693214134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214134, "uuid": "7b6089ca-1347-491e-9f7f-16344de8ab46", "comment": "Malware payload", "value": "aceea8ddca8dc2c7ab53f88d699ffe94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214134, "uuid": "e9ded8a5-f9c1-480f-9618-822ca673678e", "comment": "Malware payload", "value": "bfcbd45b8f112f3cace30600c0c71f30ea3a4150a0970ed6a576d56d09c0e17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214134, "uuid": "46450a0f-dfbf-4cd6-bec8-dc25bd02d960", "comment": "Malware payload", "value": "b378f964950fca675f4236223456df9f936ff65b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214134, "uuid": "471400c0-d737-4885-853d-082d11f3c336", "comment": "Malware payload", "value": "1b5ac89425dd6d210075aea97c4c24b8c241a4efd5467115e5e3581a04e8c5d5778871756eeb558432c03d11b1ab7343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214134, "uuid": "77d9a262-f29d-43b1-8ab4-bb155e01b221", "value": "T10AF412113592C433E5A60039CD28F5F5967ABCB7494A9D8777883B7E2E313A29F52F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214134, "uuid": "21a2ad0f-d13f-489a-a8aa-0e0981b09139", "value": "87fdd43a98ad22fdc8354b88ec64b2f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214134, "uuid": "c38bfed3-2f6d-43f4-aa6d-58443920d9df", "value": "24576:lS3IzZ7LxPHtvmURllFkKhErOfNsOIw/:M3O1dl+wllFkKhtFszy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214134, "uuid": "f7d55280-a8d0-4f33-bfed-30d5900345c9", "value": 788966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214134, "uuid": "6daabb35-d442-463d-a883-9578209146c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214134, "uuid": "32ae67c7-ae15-4409-8820-1b9075db1f2e", "value": "aceea8ddca8dc2c7ab53f88d699ffe94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2aedf2e-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215558, "uuid": "868356a3-c5cf-4210-84fc-5b1cc543fc95", "comment": "Malware payload", "value": "05b75e64d5283e41dbacbdf2462bf4fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215558, "uuid": "7aea81dc-1a28-44d7-956f-c66deb55d645", "comment": "Malware payload", "value": "bfdb291b7b7f3b011cbc5ef12aa1d38dfcd9614a15cc5c21e2cad4f81f9540d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215558, "uuid": "6908343a-abc5-4ada-9247-9a3ff16a0b6c", "comment": "Malware payload", "value": "b495c87753dd3ad3a762328693ff3b34dc6bfe2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215558, "uuid": "d73cc798-1e20-4c98-ad40-92ee947bcdb0", "comment": "Malware payload", "value": "070887d7b57dcb1d0c25c3c80c1cdad0e8dbe8d11db05b0adeabaad0f3e8913f05ea4482b5bd7f8b2d3cb16751228415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215558, "uuid": "131a3485-f85c-4be3-869e-f17dbfb9c4ed", "value": "T179046C1174D18033E873153209F4DAB4AE3EB9604BA65DFF67D80B3E4F706D1AA319A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215558, "uuid": "4dcbe7aa-c2fc-4962-b43c-7262728674bd", "value": "f7aca7eae1bc8ea85a83c7d86feaa68c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215558, "uuid": "62609183-3275-4395-9d20-baaadf1919f5", "value": "3072:GZcjZd9MOyUfDRJJwKDGUOeX9r50dcAfGOAg0FujxmgS8c:RjbiOprRbwKDDNrWAOM8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215558, "uuid": "f0df9539-e315-4885-abc9-760a71678c43", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215558, "uuid": "ef4a06fb-1887-410a-abe9-b7e7457d2f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215558, "uuid": "49e17bed-64ba-4ca2-b3aa-0d58c78437e9", "value": "SecuriteInfo.com.Win32.PWSX-gen.1093.499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec4bcd5-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235040, "uuid": "5c4089e8-16b5-44c9-8ef1-031023e01bfb", "comment": "Malware payload (Mirai)", "value": "279c47e43f8e0b9b937ef12df421c5df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235040, "uuid": "9a5e2f4d-0cd9-44e7-9796-a65f540bcda3", "comment": "Malware payload (Mirai)", "value": "c0a89c8259f0b48578d537c3c1481d498fb22cb3af897b607521928c35aa26a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235040, "uuid": "3b2c7ee5-deb5-4c73-ba4e-2df98c2f9d2d", "comment": "Malware payload (Mirai)", "value": "6065372984cafe7d60298364673463234a2001b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235040, "uuid": "0f1bdf0c-cba5-49de-abc6-2c7f38a80cee", "comment": "Malware payload (Mirai)", "value": "21c91a42234e002ee60964f6a3ce0c74d6791585fbe671114ee6cda3752a7600be26c855bb9cdc1e95f48ca253520b34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235040, "uuid": "4bbb2687-9f47-449a-a033-7c3382d64291", "value": "T1EA539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235040, "uuid": "8abcc8bd-257c-45d6-aa12-86cea732ce43", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235040, "uuid": "a8843b0b-4610-4508-a539-9998475596f1", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235040, "uuid": "13da8511-fa37-4b6f-8feb-ca6e1ea7b79e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235040, "uuid": "b02c18e0-1824-4a0c-a842-c5ea163ac540", "value": "279c47e43f8e0b9b937ef12df421c5df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496e1a06-4597-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693222656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222656, "uuid": "86e6e452-1875-48a4-be11-ff2fba46024d", "comment": "Malware payload (Formbook)", "value": "25fd99c8d26878c154af25bed9b1926c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222656, "uuid": "f39373fd-7624-48e9-9cfa-a432e3cf7134", "comment": "Malware payload (Formbook)", "value": "c1453cd1a5ae681ef47a12c359bbecd0e2c08abcf9c444aa6f13be6a86fa8777", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222656, "uuid": "705f192d-c2d0-4c48-bd3a-5c52dcb7de67", "comment": "Malware payload (Formbook)", "value": "236f20b6601126727b1269972a518e1b07a5cd24", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222656, "uuid": "f28f07f4-23dc-4b01-950f-f36ea93e50db", "comment": "Malware payload (Formbook)", "value": "1d8f9bc1269341ac549e8bff3c8d09884bdf82c5c698a42c39c033b4c153f29947d8747b74404d62e7fb22dccdd97eee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222656, "uuid": "ae68f87f-ce38-482d-9df5-bf6ca24e67e5", "value": "T1FC4423680574D259E8692DBF981B50003B9336FDC71AF42C4379A2FCE83EA6A58C3775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222656, "uuid": "54275d9f-a2fc-432f-9595-63fab6bae267", "value": "6144:F8YfF55e2PDlkyTD4yV6/yyPGONwUUpO2za8CijpiafP3at0yDdYeC6K:FMKlV4t/yyPGvt1aExf/EBRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693222656, "uuid": "a774d105-2202-4fa6-ab3b-8ca30c621130", "value": 259947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693222656, "uuid": "cdb8ba9c-c6e9-4f9f-ae6c-16f848a7b902", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222656, "uuid": "61e8aded-32da-4024-be0b-87298783bb3b", "value": "Payment Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e782189a-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693209178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209178, "uuid": "ec4faa8c-7d32-4b87-9c86-1a21f74ffe8c", "comment": "Malware payload (Formbook)", "value": "98aedfd4f74ec3722d09f791c05af9c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209178, "uuid": "b46fa70e-294c-4891-b797-0fb70398a36f", "comment": "Malware payload (Formbook)", "value": "c1d19cee2a05f48cedd6f1f7aa6eec9e27c00cedb7135d0187200b030b302c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209178, "uuid": "cc74f25e-4f48-4bbb-b656-f7282d0f70b8", "comment": "Malware payload (Formbook)", "value": "4a247ce1ca95ad10d0b9d55b67809c1919806f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209178, "uuid": "ba3a412b-2550-4bd8-87a9-fff99aba00e0", "comment": "Malware payload (Formbook)", "value": "534e0207e13fb5f106e41b7b1595dadb7fe07c53b6d71c77c6eb308efb02303b10867a7956f90acde494a97534fdcf3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209178, "uuid": "7d09fe2c-4481-4f5d-9820-a0bf641875f5", "value": "T102E4F140366C3B33E879DBF4102268100BF66C5B60BAEA4C8FD37AE72676F415A59D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209178, "uuid": "4de6df24-df60-43d7-96f3-a9cd1d9a6481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209178, "uuid": "270ac8c3-3351-44a4-8d2e-0fae30ab6eef", "value": "12288:pb23/gPrk7WIAdLIejT5iGP7J/gg2EHWhLl8lgSNCtuHKk:uwrkKHdL5YI7J/gg2EY5Og6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209178, "uuid": "f9b6d61f-d9f3-4a9c-a62d-c5dd7005b790", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209178, "uuid": "f9d8cbb3-e63b-4185-b532-63f284d507c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209178, "uuid": "c937931b-b660-4c8e-8e5e-adc47b05943b", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deac277a-45e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693255119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255119, "uuid": "1c5da6cb-077d-4102-a77d-9eb83d7184c0", "comment": "Malware payload (Mirai)", "value": "7516eae2db2dc8efe8f7544d9fa38fa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255119, "uuid": "b3306e93-5808-40bd-a22b-8c71cdbcaa77", "comment": "Malware payload (Mirai)", "value": "c22f4ec55d0439e1c60b4188f23e1b1ce97fe71baab796df5ec6858d093fd824", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255119, "uuid": "2deb2059-6cf9-4ed3-abe4-e86847014caa", "comment": "Malware payload (Mirai)", "value": "e1ae2683518e34118809a9424042ab480f47c82f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255119, "uuid": "90622867-dcb1-4fee-8fba-53a5464a77b6", "comment": "Malware payload (Mirai)", "value": "134e58a132f1db65bae80f2b90a1df63e7caaff2e91c636443350707a88a8486ebce4153144014c72537077478e285de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255119, "uuid": "fb262bcb-ce37-480e-a52f-7603ab539ac0", "value": "T137539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255119, "uuid": "59c764aa-0b74-4f54-8201-b21e823e5390", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693255119, "uuid": "6a7c17b9-d631-465a-97f7-2eb32a0545e7", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693255119, "uuid": "8fdd7c28-4d3a-4566-836d-214679b4b68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255119, "uuid": "0d794c12-f58a-47b1-a5f3-c4b1f49344d2", "value": "7516eae2db2dc8efe8f7544d9fa38fa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59090753-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693214093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214093, "uuid": "1e274c04-49c4-4127-a5f5-d1321ee89a3b", "comment": "Malware payload (Loki)", "value": "ed06afa1516e859231e58886441e60cf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214093, "uuid": "4498c7f3-d787-4145-9616-0fc3d07d9e09", "comment": "Malware payload (Loki)", "value": "c353b1ca0492e7033e4c50c110f71be0d89958e58f3a0344d8627f1c88bf42d4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214093, "uuid": "ddcb8e24-f27b-4e64-a990-eda5699cff83", "comment": "Malware payload (Loki)", "value": "303714cbb3eb423279a74cb3631a9292766cb123", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214093, "uuid": "b3e90257-842d-4dc3-b091-6121c0c10c27", "comment": "Malware payload (Loki)", "value": "00e1f3dc93b1017beceb9d0e16fe3e3bba2ecf5d5f6eb43d49add521c83ba9ae226a30c737a11c124e69ee5231137cfd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Siemens", "colour": "#EADC3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214093, "uuid": "4e8c8bee-18e2-4d40-8094-2595df23d2fb", "value": "T1F3B312DF31ECCE106CEA0E984257D4B890D84483AD5A5954666EB3A3FD998BBF00261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214093, "uuid": "05d134e5-9032-4265-bcb0-b8e1448fc5ff", "value": "1536:G5djR4KLxRF04i6CA9UyQRwS+gFk8we4gE2i9nHUO4Q3Ho9UKmDRf65fq/7jCNbQ:G5/P6WUFdwJ2i9lXo9UTwY/vC3q2xG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214093, "uuid": "c5dfaf00-a70c-47d6-833e-a371fd2ca623", "value": 112382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214093, "uuid": "bb420fe9-8831-4e61-9c86-818ac4ac0fc9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214093, "uuid": "15af71d3-30ec-494e-806e-d913eda7ffa4", "value": "KIEFEL Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2259845c-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229892, "uuid": "5a23f628-33b7-41f6-b464-9f2fab44bd93", "comment": "Malware payload", "value": "b866925120b57edaa0cf54e8d58b82f9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229892, "uuid": "cb91f008-35b4-4047-a7e1-59781747e0b4", "comment": "Malware payload", "value": "c466ef67caed4f27d0ca8fd6ed5320775eb4c34ba9d73c5740b32889c756a7c7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229892, "uuid": "bc234373-fc42-42bb-8749-6fbe4b7c16e0", "comment": "Malware payload", "value": "b903a95aaad655df5758bcbdc091530b978e285b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229892, "uuid": "11872248-0b31-4dee-8d38-927cd117557a", "comment": "Malware payload", "value": "45638593c6a55c1c42f3cd7124fbea8fbf78b9a989b821703a21ffd926a02e7292146851f0cd86937975a770f58621ab", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229892, "uuid": "52954f69-371b-445a-b31f-ce1b160dde51", "value": "T11D252350BD952F5FC31A363C686B6E2E16497EBC2706C2F7E355708A31B4B3902B7609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229892, "uuid": "62825f3a-b24a-4451-86e5-cf0d532ed471", "value": "12288:MFL+CX7+fqgSRde6C/KMgZtS6vNS/166sw7vx5pEVL76k+YT5ZwVog/ovlD1a:MF6CSStM/Q0/fsw7v5436k/NZwVN/o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229892, "uuid": "7572e853-ff6f-497d-af0e-dd97072bbdf8", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229892, "uuid": "51c5c4d3-f549-4a78-81da-fa3d093fa729", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229892, "uuid": "53d4262f-986e-4eed-a299-c603af2d26d6", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.12462.18414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986617fa-458b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693217635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217635, "uuid": "03e82668-0541-447c-a5ca-1bb7380c1c63", "comment": "Malware payload (AgentTesla)", "value": "99ffdd3978f06a6ff2bafd2d72ee7703", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217635, "uuid": "18467165-5939-4b5c-8f45-bac32fe70185", "comment": "Malware payload (AgentTesla)", "value": "c52c725fbd2ce6317b9330224b30bff68c7e4d8acadae819a206451ee7c23ebe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217635, "uuid": "eef22159-efb6-4204-b37f-9b739937b389", "comment": "Malware payload (AgentTesla)", "value": "a5a490e969b07ed7a2d55267d15cfdb49e6b3461", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217635, "uuid": "84781099-ed89-40ca-aeeb-dfa0873f2a78", "comment": "Malware payload (AgentTesla)", "value": "c78820ab8d54c2a6be3e5a31f65a34b67f77df8574a4c02b6fe246c5fecfcfe9c6834a1bfd43150d7ecfd5b02674a491", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217635, "uuid": "287531bd-974a-4615-bdf0-c8c1613a8fc3", "value": "T15E9423888C3BEA501375EA9DE8A6010428D4CE7CFF6E6521E34AFED1D040229FB7D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217635, "uuid": "f796b1ba-3687-40a9-bc3d-5ab4a62713be", "value": "6144:u1sEcJH49avC5U0BcnwU3/wRmisE8cg7orFplEoncP1cnmC29TZYMl5UgZqdnJ9Y:uGrN4A9vsWk7F/7mcZ4NHlzZzLzysXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217635, "uuid": "7759e866-9898-41cb-b7d6-a964b518aa55", "value": 439193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217635, "uuid": "76ecbad3-b28b-4e3e-9f86-d23ab4463c3e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217635, "uuid": "2f91dc38-6165-4c2c-b44e-5e009308a0f1", "value": "Invoice & Packing list.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce028509-455f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693198827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198827, "uuid": "841ab1d0-1a83-4d25-bdea-1efb4c0fd659", "comment": "Malware payload (Stealc)", "value": "45e7911fb31bb279f24aad0516910583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198827, "uuid": "8797f3c5-6adc-4189-a94d-0386f428a2e0", "comment": "Malware payload (Stealc)", "value": "c6186abbc52d0a34405bf96c60672633ddf83daee412eb1b5c4a5500dcb6749b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198827, "uuid": "48f8de5f-cbde-47f7-9ac5-22df4bd46a47", "comment": "Malware payload (Stealc)", "value": "6df277d4ade047bc12319bcee3ec9a80de7e64b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693198827, "uuid": "14e6cc30-d786-463d-b12d-38f1a5599ba4", "comment": "Malware payload (Stealc)", "value": "79b5b6da945a69f154ba204724edb4599ecb2cff930141f2ad7382961e90130bd08995961203624954d66c40d550a9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198827, "uuid": "880f74c4-d7a2-4eae-8807-8767272f09de", "value": "T13DB55109DB4B2695EF9C39B71257F96F460DFAA2AC73CC95C44D1280741BCA0058FBAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198827, "uuid": "6d5bc814-0ec3-476d-99b5-deeda1636da2", "value": "6e185375613a404939a8a4e26e541f70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198827, "uuid": "9fee1e38-24f8-4931-9959-faaafbe2b593", "value": "24576:WkqqzQY7tb25GTgaVXWSC08scaH5AZXB25x3MG/InCnYKfHJgXuBu/2zzeqIR5ha:LzQMiyZYhIIHoNP/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693198827, "uuid": "ab172a90-3657-46da-8214-ac716809d807", "value": 2483864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693198827, "uuid": "854d9ae6-a7c1-4150-8464-b9c330f9f6c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693198827, "uuid": "f6cfb9af-8ad0-4100-b95f-cb46101320bb", "value": "45e7911fb31bb279f24aad0516910583.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df84e4f-458c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693217993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217993, "uuid": "f11a5f9a-9255-43aa-ac36-6c99fb542671", "comment": "Malware payload (AgentTesla)", "value": "fddb0d745ad53504c14dac1281670277", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217993, "uuid": "eb90ad18-447b-4ea4-b0f2-9681a54ce015", "comment": "Malware payload (AgentTesla)", "value": "c61a8b2e374bdc0af0b2b54c40e9b1ac507dc16ad6ac5e8fa8ef9b4a8d3d9356", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217993, "uuid": "1ee71b57-6c3b-4ced-982f-857cf7de67e3", "comment": "Malware payload (AgentTesla)", "value": "23c89c45b9b7ec0e3ffe179ad141b69f867214db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217993, "uuid": "c42d10c0-23a4-4f16-b1f3-6e950f573b67", "comment": "Malware payload (AgentTesla)", "value": "8a361986a173215cd6a2c5935c4784e43449f4f9b07003fda1821bea71eb37e926d1dbd22d87d659046d1daeff7b5e55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217993, "uuid": "1198af56-19ed-405e-a588-61ee907d1ec6", "value": "T1AA9312953DAFBAA3A001E95D4C58A8F670AE00E887DB507ADD3FC6115DFF4FC582A250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217993, "uuid": "26bcd2be-2770-466e-bbe9-c59b3cc95857", "value": "1536:N6hp2LaJDDcyEcWqKdvQcg4DQ2DO2J5jN7722VCsiVr8fxU02gNRNN3H2BT+rXZJ:N632OSzq2ve2OMZN+2oRr5gNLg0rXZHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217993, "uuid": "c3b931fc-eaa4-4ae7-be3f-a907c5e3b670", "value": 97412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217993, "uuid": "c05b3818-ace7-4706-808b-4188aaf06274", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217993, "uuid": "681b6ca5-b425-4b49-9c13-4342809db327", "value": "RFQ New order inquiry product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8f5b53-45e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693257909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693257909, "uuid": "776a4699-3b10-4284-bfd8-59f682049045", "comment": "Malware payload", "value": "6ab675925dd0e44d05168e660841bb53", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693257909, "uuid": "ee976670-beb0-45b4-9e88-ea1599185b39", "comment": "Malware payload", "value": "c6c60e4b0e39f547455b2a866ba5b0a9b22d17381d95015f959a862cb78d9e24", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693257909, "uuid": "677a59aa-7100-4997-a760-83c66b25914a", "comment": "Malware payload", "value": "22ec27e932b6f4b6c0cdf3620f205f1d05ee8352", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693257909, "uuid": "b3441fac-76de-4a65-bea4-2e5b559fc3ef", "comment": "Malware payload", "value": "b277eeb800c5c7e6f72a087c6681bbbac778a59ad5f9d3e72774f18e637c0eb54ff5caa4a1c8d77f64753bcdf89f23bc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693257909, "uuid": "6ee5d871-0739-4627-967e-5fa1ae88f22b", "value": "T18866CF5AA3A800E9D1BBD179C9569607E7B17815133097DF52E08ABE6F23EF11A3F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693257909, "uuid": "a6e35c36-c440-4897-b7a6-f9cdf6751e50", "value": "b21175bc8a787130dff27460af0fcf25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693257909, "uuid": "0e61fac1-e8ed-4d8f-b0b8-85c7a623ddd8", "value": "49152:3ooBRhgWI0VDgxEPwvMhLza5VZDzp5UixSEh+XXWlNoxnNSh:57he0XPUMhPa5vynWX+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693257909, "uuid": "d7681c5a-05a3-4d94-bae2-424b36304370", "value": 6996480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693257909, "uuid": "89105eed-57fd-4673-9e6e-8543e5fa6c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693257909, "uuid": "9205882e-a93a-4f08-b4e6-d9704b002e23", "value": "6ab675925dd0e44d05168e660841bb53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14629f73-458c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693217843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217843, "uuid": "bf60a301-d06a-4fcb-b2ae-daaca2b450b6", "comment": "Malware payload (Formbook)", "value": "060e8d976cb47c0c9f4d8d8c974a01fb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217843, "uuid": "3db6d424-cbc2-477e-b492-9b44d55213fb", "comment": "Malware payload (Formbook)", "value": "c6f14fd7467502d749a091ff389c8bc6f162cbc4d4b3fe60b1e41221203c4398", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217843, "uuid": "30545cc6-6ee2-459d-9c91-d2a2f750e7eb", "comment": "Malware payload (Formbook)", "value": "c603d1aac09419a2694075beed504d461fe0b470", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693217843, "uuid": "4f52643e-c600-49f5-9393-ac44cb7fea32", "comment": "Malware payload (Formbook)", "value": "f0e41bdc887bcd8f290adad090492371a82ba6ac704d91787b713d99e584cecf0710d95e1e48bf954b4a672d68e179ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217843, "uuid": "1526e5a7-576d-4102-9d3b-ffefa88d3801", "value": "T1723423CBE641B4FF651456EF603B8889CAEA314DC512FD04E2FFA9E2F6D010C4AAD560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217843, "uuid": "3f8a0c13-cd87-4198-8919-5a334516765e", "value": "6144:WbZPmMEME2VNwmdzdrGAiO0WijUg0SkuQPnGbY6A:+PVLdArWijUg0tuQeMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693217843, "uuid": "89d89d3f-2fe6-49d1-a949-bcaf5b827f4d", "value": 245870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693217843, "uuid": "76d5a2bf-232f-4482-8345-71c630f17f83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693217843, "uuid": "c32f4682-daf2-47b3-b9cd-742a9bead63d", "value": "T3 BERTHING SCHEDULE 21-08-23 PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798e4493-45a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693230468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230468, "uuid": "6e9978c9-e2e1-453a-a4c1-dc1db0372449", "comment": "Malware payload", "value": "cdbf3c3c7aef6ed6465cf430281e57e1", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230468, "uuid": "17439b34-9601-43b0-8cc8-a34df2d2ed05", "comment": "Malware payload", "value": "c74044ca8b0e5e17ca97375129109444cc2ba64e9d26630781e40f7d6085d398", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230468, "uuid": "14a9e771-0b08-4991-9713-51e3c0845998", "comment": "Malware payload", "value": "77a7e92602926d5bb3fbefd68fb1b5001574a82a", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230468, "uuid": "de204221-62e0-4472-a9de-8129e3dbe496", "comment": "Malware payload", "value": "73340c54f6ad7ff29f2ea33c53b15076968517fedee9384e205ab537ff93e14de20141c96e04135d10b95be9757130fa", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230468, "uuid": "a6e10086-c14f-4d14-acc1-40a18f276735", "value": "T139F29EA281220D0ED3628D37920A3A04D2F8E357B55A73D378F19DDDC8EF5DA2B50A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230468, "uuid": "16c2ec3b-3e2b-47e0-8293-c497e6494e21", "value": "768:0IOq5f4ZMQlFbAgtIgglgUSqo4O6D2fiAcA368R0RSCgfiA44O6GfiA3J4O6//p:0V60t7tIRLo4oKsd0RuKB4cK8J4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230468, "uuid": "9e3bfd56-2760-4f56-aa54-261903380a71", "value": 36169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230468, "uuid": "5996855a-ca9d-416f-bed5-5a08a484a6f9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230468, "uuid": "45a86f19-257c-4829-bb06-5faf90a17ad8", "value": "PURCHASE ORDER.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99c50bd-457e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693212134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212134, "uuid": "aa48b3fa-621e-4837-a66d-8c68109b0e47", "comment": "Malware payload", "value": "af3645fccd58db301f50dd2c5b46b8a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212134, "uuid": "58882791-1d75-4e47-bcce-cd82419a4385", "comment": "Malware payload", "value": "c7723b622ad081f803633337c0b732c920b73bc9ca87ed1823ac9269c041bfd5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212134, "uuid": "b2fa2f2a-8375-4fe3-9da6-94130f8e0b9c", "comment": "Malware payload", "value": "93c6086ea6cd0b7ce54a9ec2800bdf08891832b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212134, "uuid": "90ea9cc6-6af3-43fb-93de-195dba4e58c6", "comment": "Malware payload", "value": "864eb2eb89368cbfea8d784b50c6374f1c16e587d46063a6277006d80c762726fe69b3394fb89bc3d9cdd0cbad8856bb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212134, "uuid": "d6a4629c-ce53-49db-8635-4e39bd24d028", "value": "T182047F4233C71F2AE2770278947557A42F25BD29BEAE839B10BC3D2D3F725604D28796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212134, "uuid": "6d80b536-0b80-4254-a047-df85dea1bb6d", "value": "3072:fS7rErqwqV+mLNPx3eKbJ5/tCekdvRqUkjafORrgTec7Luzs:fUr+QAep3x5F7kd3kmfORrgTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212134, "uuid": "2d225087-8cb1-4a0e-ac11-f0b922974ee3", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212134, "uuid": "7028b103-d7d9-4f98-8bd4-d31318b33cbb", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212134, "uuid": "f8338d07-cf43-41d3-bb82-5ad7f8c15865", "value": "ALGUSAWEEY 1.INVESTIGATION OF STRAINTH.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175fc7f4-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693233310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233310, "uuid": "c4cfcf95-36bc-4964-87d1-9483ab296082", "comment": "Malware payload (AgentTesla)", "value": "a080093f5c5c9293b5a4201d1a3f38e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233310, "uuid": "25e6aa22-9baf-40f2-bc39-e975fdef83ec", "comment": "Malware payload (AgentTesla)", "value": "c90c906895f7e853dafd1e79fe228cdf0d63d677228f49ba6837179d3b62ef0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233310, "uuid": "3e43e72b-ec08-4cbc-848e-189cef0733f3", "comment": "Malware payload (AgentTesla)", "value": "07d9a66dc6352b97e7d89287da00d6bb5d294260", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233310, "uuid": "c1c01197-7e48-4881-ba08-7621a1f2e9cd", "comment": "Malware payload (AgentTesla)", "value": "6bb39a5f27f509e102c9ab82316a853155567cd9d6e655f1b85e4a68388783672952a5da4278ff60ab892dcb0e775411", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233310, "uuid": "358915f5-b7f4-483e-b625-e7bc3f00038e", "value": "T161F412342978CB2EC66F0BBE4E64446013B197A536B4EF6FCED572C92A703C11614EE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233310, "uuid": "0eefd399-d825-4db6-b5fc-a3b7927bd50f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233310, "uuid": "2e7ee65d-714a-4d93-90aa-94620d0fba53", "value": "12288:x+uZevYmJ+379ZaQc2k546qnCmpY+f5vQVD5v0UbtpYFzxEGanC0PiNfyBxOWpSL:x+uovYmQ379ZaQc2k9q5XfhUbtaRqGaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233310, "uuid": "76c7a01a-bd54-4406-a663-6bbb5e5e8c52", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233310, "uuid": "64d38940-f3b2-4867-9d2a-8adf8d226e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233310, "uuid": "fcc67358-011d-445e-9084-9a80f52eeb72", "value": "SecuriteInfo.com.Trojan.PackedNET.738.11718.4610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292d1710-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693229904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229904, "uuid": "140a2b53-fe20-4078-9626-f76f5f87d573", "comment": "Malware payload (RemcosRAT)", "value": "18276fd81e82cac1d771951a7d505c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229904, "uuid": "f3c14003-40fe-4d5a-a75d-815000112b42", "comment": "Malware payload (RemcosRAT)", "value": "ca9c5b008a075bbdb57a89b0aef111458f5f9c8ee21f279a06abc481d35ba324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229904, "uuid": "a72d272b-95cb-465b-a687-04031fa150ae", "comment": "Malware payload (RemcosRAT)", "value": "4a1849e4239b29b4a3ee45a578741f327e09af52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229904, "uuid": "ccb9e7a2-670e-4a22-bc30-48e80959e45f", "comment": "Malware payload (RemcosRAT)", "value": "1d4842a8b764fc1a421a49995840143331771437a024a178c7e5c66bd7f745397d291e1c68647011d7e1770fdc25ec2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229904, "uuid": "ecd71a2d-85cf-47b9-bb63-0ea6adac789c", "value": "T164C4238237D0C226E8DB6A3016B99D6DEF5BE53C0960C7971BF02B197C303A15A5F365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229904, "uuid": "bd9ef1d6-a3bd-4ccb-a835-fd7a0fe21a90", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229904, "uuid": "5568d0f7-706c-4395-9369-a9e38902e0a0", "value": "12288:vYVxXx+VffdRAtYnormhk7xMpIMAa49mY8fDJCShMAkXcS9LZMcU1:vYVx0x8Ioahk7OpFsmYaBhMPXc4mH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229904, "uuid": "f75a61a0-b24f-4b6b-a405-b72c2ddbd830", "value": 566856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229904, "uuid": "e1f24d82-9188-427e-88a0-3d8af025aaae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229904, "uuid": "ab3d8484-1b47-45a3-8fe3-de03bc6b85a1", "value": "SecuriteInfo.com.FileRepMalware.18185.9184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a07be1-4594-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693221546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221546, "uuid": "ba2a1973-8163-4239-a67f-50cce6ca36af", "comment": "Malware payload (AgentTesla)", "value": "9d030d50aa9e71d20d1cc72232768790", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221546, "uuid": "9bdb9de0-f0f2-4724-9c8e-08a43f334268", "comment": "Malware payload (AgentTesla)", "value": "cb35bd8d1cb596c3f78a94b6f8ba4630d9ed887ff6933754928b13d39e6562d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221546, "uuid": "63358a1b-de31-4f3e-b20c-4124b32c9d2f", "comment": "Malware payload (AgentTesla)", "value": "923295464c9544a02fd0c449d40420899c9db93c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221546, "uuid": "dc9ede53-f6e0-4493-8e1b-e1a3130d4618", "comment": "Malware payload (AgentTesla)", "value": "e8dce70b416beb012d7752e59ebe2f5bb478231cd6f6672fe3c58cb679848420666e94e09a9b775c7955b74a9930277f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221546, "uuid": "b7e1ea9f-86b2-4866-8002-b790589bfda9", "value": "T113A42307F5DB2124E1E45A84BFEF2D846F073F23065B62401E9AECCE6940AD1EDA7479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221546, "uuid": "b7c0d9ed-31fe-46b0-b2be-b74c3ff68e00", "value": "12288:nIptm7buRSpsDkpbJdb7NaPB3ckM+iPleGVz1aXbKH:neqKRSuoxbYp3ckzkQXGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693221546, "uuid": "b19ca2d6-7cc5-4662-8c80-1e3386e94d5f", "value": 458172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693221546, "uuid": "ba8b72dd-f0de-40dd-b2c3-7efc5c598cd1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221546, "uuid": "6a0b3852-b9c0-4b70-8153-a63115171eeb", "value": "IMPORT SHIPMENT.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f65c0e3-4594-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693221512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221512, "uuid": "0407b364-e586-4954-8ef1-b4c004d89ff8", "comment": "Malware payload (AgentTesla)", "value": "f447780b961e7ca2c6c59cc9f20e2dcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221512, "uuid": "38f1ba96-8c91-4bae-966a-2100f41d39b6", "comment": "Malware payload (AgentTesla)", "value": "cb4801bf539728282f9de87399b3eaad4c20bf7fd0cc705774b03a80a3410883", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221512, "uuid": "86bf53a8-a512-4be1-be1e-8068f0197ac5", "comment": "Malware payload (AgentTesla)", "value": "d1ca0dd0f0eb7f7dea29a4d83c8d1ec9ab44c4bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221512, "uuid": "6628e167-6fca-4311-8678-4a6feada4a2b", "comment": "Malware payload (AgentTesla)", "value": "983cfcde434418001a54e1448bc5b5530831e9cb7e3708a5e08418c39eecf4499c1185ef3ea6db09be6e4adcca6e269b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221512, "uuid": "e87b9c07-2651-4a71-bddf-abb1f383f8b7", "value": "T1D0B423B84C31A365F97090212656DBB1B6B7C768632CDE2CB2A3C23D531785CF18399B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221512, "uuid": "9b63fc73-bfbf-4712-b728-9611abb2dfdf", "value": "12288:eduLGO67W1CPiGr7qvb7wRnO44YF9aVK0f13zNHx:edu6O4OCuvHwRnRSK0N3zNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693221512, "uuid": "8b414a0b-3f18-4eac-bbbf-b482046166b5", "value": 513238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693221512, "uuid": "64b035b6-6325-45e8-8158-a9bec9b35cb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221512, "uuid": "cf32d24a-5b81-40f8-81c4-9c7470c28994", "value": "Swift Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcbd180-4597-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693222664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222664, "uuid": "4eac08f2-5714-476b-a83b-56dbb49c493c", "comment": "Malware payload (Formbook)", "value": "2887f9fdbaf24615ea6835c63239e8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222664, "uuid": "cf6f8e4e-199c-42e6-a678-ba3e337baf77", "comment": "Malware payload (Formbook)", "value": "cbcfd7f5e01a53f530bebf71dc07ddac59b03d2ee0f5825f541e3bf668d6abc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222664, "uuid": "88ac6387-2ba9-4641-9cc7-849bfe0aaf4e", "comment": "Malware payload (Formbook)", "value": "fa0253b40157a5820a528d8859064343bde6f14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693222664, "uuid": "6f126cd7-3537-4238-9af9-6bf572ceb356", "comment": "Malware payload (Formbook)", "value": "1794fb4c40e8e390de622042722dd888410b3a1b4385c2c9e2a3407650159b9f07a792f3bb948a256105a9795712c732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222664, "uuid": "3a355d40-2324-47e7-990a-5d5b608e6dc3", "value": "T14344124406A0D0ABF8B10B734D3B46157FE2B93A5539A21F635093ECBD3AA829D07776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222664, "uuid": "d71ba77b-5d24-4daa-bfc0-beed68189271", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222664, "uuid": "e1981656-3ced-41f5-9e02-bb89b0a0c8b0", "value": "6144:PYa6W3DlkyTDcyV6NyyPGONwUUpg2za88ijpiafP9at0yDd9eC6V:PYAzlVctNyyPGvtjasxfVEBS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693222664, "uuid": "2a98cdf5-a50f-436c-9e75-97bcb7d4ad9f", "value": 273963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693222664, "uuid": "04ccee1c-9190-404d-bf85-6f2fb8c6623b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693222664, "uuid": "65ec2f4b-7228-48a0-977c-feffdd44dc57", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8cc21e-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238176, "uuid": "757423eb-d106-4d03-98ff-537043ea02bc", "comment": "Malware payload (Mirai)", "value": "bba27b70338a75693bf974994c633509", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238176, "uuid": "c6155864-4e9a-430f-a36b-66b00ccf4927", "comment": "Malware payload (Mirai)", "value": "cc30eb5578c601f2eb9e38b128724e375741f269afd2075349ae9dbee60e51fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238176, "uuid": "d10e647a-39be-40ec-bdc7-e8e8f6879cee", "comment": "Malware payload (Mirai)", "value": "cf1daa4ec13027ea9a930c4220c6f8e28bea3971", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238176, "uuid": "e9af85ed-ac05-4e81-9c37-fae9d6143773", "comment": "Malware payload (Mirai)", "value": "3a8f2fefac8f61b1a468a4ff19ba1fafe04ea844721ad5c11f2738f257696d633e35c017dcda09f000eea0285e3457c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238176, "uuid": "91fcdf23-33c5-4ea4-9b02-e655aca84bb0", "value": "T14F234BC1AA83D8F4FC5709726133E3739772F4B91028DA97C3A99A33AC52711E65728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238176, "uuid": "7d93a638-54a6-460d-a438-f0c64cf949d5", "value": "768:1+6Z+xXyCjHkip3q7vrOg5bBFIx3R7SV3TYPZNwYrxt70JHU8FuSkIlbrx:3Z+xXyCjHkoa7v5bA3Fcj2LrDIJHhuSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238176, "uuid": "341f000c-d2ca-48ca-801b-bffe924a3d24", "value": 46384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238176, "uuid": "76f36667-efee-46b6-b144-3328dd942af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238176, "uuid": "8f47b72d-50b5-4ca0-ab0c-119755eaeaca", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37a066d-45ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693244712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244712, "uuid": "17c3b60e-6afd-460b-bfca-8a441ecb6f1e", "comment": "Malware payload", "value": "a08e5bcef2507e63f9459565d0356f94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244712, "uuid": "2f63ddb3-c426-42c2-9ca0-7d48a9bc575e", "comment": "Malware payload", "value": "cc4056731930338716b787d529806e61dfb2f625f7ea75ca07fca9d3faf32551", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244712, "uuid": "bd6625de-2416-4bcb-9271-bae5e8ccb0f2", "comment": "Malware payload", "value": "379e79bdd2f141b780cd7d9543f0c012996cf3a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244712, "uuid": "1a30b42a-684d-47b2-8827-ad69951404ad", "comment": "Malware payload", "value": "9569df54546db3b133b0ef83877c12357ab1a05d7ae54d71f057a008efc1a17ad8b1abc85d01ab934799483f277b772b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244712, "uuid": "f04efdb2-08e9-4ffa-83d5-e93e341c8121", "value": "T17343515019D264809707AA7E772FE4E4F7B648B700889D4BB50C7980EFCAD2ECEE4671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244712, "uuid": "9b6b9ab5-afb7-48c0-859d-fcf08d50e3b0", "value": "1536:eHjI9MTNsLm/6GlrTy8O62o7G7MrYRtKlVBVSQ9:eHs9gNsLm/7NCNy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693244712, "uuid": "295ea47d-bb56-4e16-a461-a9076a7a37d8", "value": 58730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693244712, "uuid": "e8773c90-bf64-414b-be0d-38d0a400cef2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244712, "uuid": "ea6cee09-688a-4dc3-9b1c-36efe0b471dd", "value": "magento.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317ad5c4-459d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693225193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225193, "uuid": "44f413f1-ffde-4025-9113-f670f3502e0b", "comment": "Malware payload (AgentTesla)", "value": "1e70f0fba6bd8503368ee6d403f93ce5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225193, "uuid": "762642b4-4981-45b5-b397-7ccced2a4174", "comment": "Malware payload (AgentTesla)", "value": "cc50ec935c76ff44a744b79ac7288b9fe3b6c403738bddd9b66d112f28652fb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225193, "uuid": "08d09295-3a47-4fd2-b62f-e60bd0d82f3a", "comment": "Malware payload (AgentTesla)", "value": "475a483709096ec13b40e08939dac865ba1e2702", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693225193, "uuid": "96757f3b-ab63-4c3b-8f93-8291e0868cd4", "comment": "Malware payload (AgentTesla)", "value": "fcf3776f33f3da35435a56fb1311ff8eb4a78597dc68b1163ac3341e1f8f45629c26e7cc45d29e67d566853324dbbd60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225193, "uuid": "d4bddb22-5a2e-4d94-ac98-a246e7866e73", "value": "T15AC4012C96AABE66D8FD47FD9113144013F3A5A2E372E24B5FDE04ED5E16BC08A46313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225193, "uuid": "1e66e05e-8c63-4bdb-8206-b01fbf36facd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225193, "uuid": "92fbafd9-0c7f-4a72-b2a7-5bbdfa5f7044", "value": "6144:0BNayUKRzvFCk6GsgkJZzti5Kc2gWzBAaVyy90PsDN/f0tozgAf8nMzfCVIo+nnL:EjJzf6RlZBi5x2ehyqC/f0gaMzfCebh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693225193, "uuid": "29dc0016-f97d-4255-958a-1a96dda91af6", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693225193, "uuid": "217b0d61-3350-481c-a998-3be389476603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693225193, "uuid": "f85f3828-adb7-4d98-bc46-26951fc33160", "value": "SALE ORDER_22-08-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a8507a-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693229381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229381, "uuid": "69f60171-ca25-41c3-a244-d4352ae196bf", "comment": "Malware payload (GuLoader)", "value": "cddf28f458970b396c488dc2e1724189", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229381, "uuid": "8a94662f-f134-4272-a3e2-88e880037300", "comment": "Malware payload (GuLoader)", "value": "cc53bdf913a5715ee4a4fbc5b95a14bae4f1a7d57348163c917fbb37db8d9724", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229381, "uuid": "9d016541-6fc5-49f7-851e-5807adb3819e", "comment": "Malware payload (GuLoader)", "value": "22af30e965bdf048c4c709e29820f022ecf65fca", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229381, "uuid": "609bf5c9-a00e-42bb-92f7-f779a89a9300", "comment": "Malware payload (GuLoader)", "value": "fc56e11a1870d98ce0c99f4136f7431ed09cbc71b1abdf5fcf7ba11443f92395a5269f7272c7c07432dd19a6832cc50f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229381, "uuid": "67086c40-ce97-4d53-a2ca-506b2e2dfe87", "value": "T1E7B423D51E6D70844C3FF234776A338205B72F129AAD39AFA29036BDFC359495A0C279", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229381, "uuid": "e9b23640-bfe6-4e81-b154-88ede6095bcb", "value": "12288:RQznxchOlsLxSymZO8+4SfdnOy60+I8RUI4bME:Cnj6Syh8a8y2I8SI4bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229381, "uuid": "56d587ff-81ec-4981-a8ca-a3769e908d2d", "value": 494543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229381, "uuid": "5602f7b5-4c72-4c94-ac74-baec61f600da", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229381, "uuid": "55e168bd-6e16-4fd6-8289-f7c5ac91fad2", "value": "RFQ20230828_Commercial List_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d9c17a-4583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1693214079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214079, "uuid": "1b96ad90-b9dc-43a0-8629-5d188da72310", "comment": "Malware payload (Fabookie)", "value": "9c3261f343c50e89fa6f9e411e4adafd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214079, "uuid": "277ed962-a7f7-4300-9e3d-e6afc78fa44c", "comment": "Malware payload (Fabookie)", "value": "ccb26ef88dfff6653b7b2fc0bbd36ef58a4c8db24c9011f8c7d577dbe544cc3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214079, "uuid": "d764a773-861b-45e9-815b-4e05b307c628", "comment": "Malware payload (Fabookie)", "value": "d19338b428840b0bbd1f500a8822413f8b5315b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693214079, "uuid": "b7f91b7d-acf3-4049-9fdb-efa38369f8e0", "comment": "Malware payload (Fabookie)", "value": "2f9ec107cf02d937b6fc0fe03b39afbbcdf96bd74c54fda03cb492c9183138a87ba1a7794ed7d53e860c4f1f9073ab3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214079, "uuid": "5dbf0385-a04f-479b-ab0a-5097f6df8319", "value": "T17DD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214079, "uuid": "2c354368-9c4c-46e6-b52a-c781ae99b871", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214079, "uuid": "ac2c235e-c11d-44d1-96d1-4ec7cc1736ab", "value": "12288:TeE9CMmn1yBvivHTPjPTXzGRDJcaMuGEPnW:qE9jmn1AuPjPTjGRSaMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693214079, "uuid": "6cc4274a-3212-43e0-b45b-cf7331b618cb", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693214079, "uuid": "59cf714d-bf93-42ce-9122-1e049565c57e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693214079, "uuid": "fb94e2a9-aec3-4163-b92f-d3ee3e41105b", "value": "9c3261f343c50e89fa6f9e411e4adafd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32872623-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212740, "uuid": "5dadf5c9-6d6a-4952-b3f2-e56bcca9869d", "comment": "Malware payload (AgentTesla)", "value": "753bc6ce131953c70af0eb67c4490cd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212740, "uuid": "e43f0ee0-4abc-417e-8c77-0d6962d06bda", "comment": "Malware payload (AgentTesla)", "value": "ccddf3fe6a00fb7d71df42df100e1cef6c07c21de1c3718cb9704bf6b36f2020", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212740, "uuid": "0433ecc0-c317-49e0-92ec-eba03318e697", "comment": "Malware payload (AgentTesla)", "value": "1f6428e8350cd4e5d1785963a8fe720df0dd5462", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212740, "uuid": "f692eedc-7981-45e5-b93b-001333c95de3", "comment": "Malware payload (AgentTesla)", "value": "ae36dd324867aa4a271aefd82e25b516629cc8cd11528ba48a7c763eb17e05e7891de762d559936ab2530bb575532053", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212740, "uuid": "29072c8b-5204-49a3-bb5b-d506e2601b77", "value": "T116E40223BA11EF7ED03B57F93C55E40546A2EE4E6860E358699673E25D72B03403AF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212740, "uuid": "20b8b79d-b556-44cd-a845-8a0fe5b6005a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212740, "uuid": "2f192cdb-4f1c-41c2-b895-31a01f4ea174", "value": "12288:b1WJp095v3oOMI6EdMAMSHCozGjfiXtoxZnSfh6QXF10MZx2+HL:b1F9deIOVj6XyT4vXzO+HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212740, "uuid": "3e58f875-0826-4202-992f-000658932a4d", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212740, "uuid": "3fededa3-f8c8-47cb-aa86-44346f3f708e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212740, "uuid": "71c8f1a9-93ff-4519-ae20-3900f99a7abb", "value": "FedEx_AWB#5019409274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa08e6c4-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693209209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209209, "uuid": "b9ed2306-1fa3-480a-8ab7-fb60268376a3", "comment": "Malware payload", "value": "ba84cb431da839bba1bf4dedb3e2ee8f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209209, "uuid": "7c6de8ea-5ff5-4e98-8083-623d097edd6a", "comment": "Malware payload", "value": "cd3314bd837c138a281178784346756a37b84e95a32222e4dcd527be6a66e331", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209209, "uuid": "54485b83-fd1b-46ca-a5a3-0345d8c6d3db", "comment": "Malware payload", "value": "02241488d6044e1355d377b493e3b8b4877ac13c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209209, "uuid": "309cdd45-c725-447e-aec5-8e95d18b426e", "comment": "Malware payload", "value": "491522037bd34b1e6f6a41d60618c3db2cd5ac3ed1dda6ca54f8e611175034f48076e49e9d263930ac97f5bd4adc51f9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209209, "uuid": "010af4d0-14a3-4973-b4a2-6d43474827ac", "value": "T1038423C48F28C706F56FCA71D0E25D5BFB6C7CFB6A5EA20753AC82096C934C0A9851B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209209, "uuid": "81775029-5a33-4b8d-9da8-489d4140a07a", "value": "6144:0aPoIVYrV63Zmc1GrfSy4l0w4wN1o2Ef4ckkV5gZ0sK07yj31xrWuMotome1iu4U:0OHVWUZmVf6ylwN1nEnh5sNyjjidJbyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209209, "uuid": "63d24797-e79a-4790-9e3c-469781e90276", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209209, "uuid": "319520e7-1673-4040-92c7-62eebc0cf102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209209, "uuid": "b69c53bb-1d19-4dcb-b950-073d323d4b1a", "value": "ba84cb431da839bba1bf4dedb3e2ee8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320313b6-45b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693235073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235073, "uuid": "63b99fcb-04a0-4b08-a3d9-f89a825a8cbb", "comment": "Malware payload (Mirai)", "value": "48014d0787981a1aa5b6730cef057b05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235073, "uuid": "b2034aaf-e67e-4196-ab59-32a30ec55bdf", "comment": "Malware payload (Mirai)", "value": "ce810cfae236d453ade21b84426dc96852771d17d29127e317eb13492d52b02f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235073, "uuid": "f21598b7-a722-40e2-a25d-df3f1bc0aa4d", "comment": "Malware payload (Mirai)", "value": "9ff58a7adf32df2a0d08ba89e6aa38242c8834f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693235073, "uuid": "a058a9c7-3887-4490-a624-c5c160d29459", "comment": "Malware payload (Mirai)", "value": "87ae9ee3015373cc57162b3ddf919894ec7cc5a201879347f6a9866bc6bf955c8125346b15b14a35102fc047a24048e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235073, "uuid": "6c0d2e1e-2010-4987-8a1c-dce7571753fc", "value": "T129E318D7F900DEFAF80AE33B48130805B130BBA245925B372257796BED3A1D91577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235073, "uuid": "58303d80-ce84-4a68-9ba1-b486363d9d0f", "value": "3072:BnMasZdHJSjLGBXDzbEwLxA8bXG+bVrjbiNLdiAu0ymyggs:1MtZxZDfhtA0G+ILdiyymD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693235073, "uuid": "41646bb3-26e3-4e1f-a2bd-886ee90dd574", "value": 143744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693235073, "uuid": "092759d9-d94c-4360-8546-06c5a9251afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693235073, "uuid": "ec42a3db-2a29-4003-9417-9b7a21276095", "value": "48014d0787981a1aa5b6730cef057b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f69bb56-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266421, "uuid": "f075fa71-be39-4b92-8362-4a9683b4fc6e", "comment": "Malware payload (Mirai)", "value": "9be7fe568a3c014460c0ca085a2330ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266421, "uuid": "d20c9cbd-621e-4bde-a48f-68bd4bc2468d", "comment": "Malware payload (Mirai)", "value": "cfc39266d799dddde462bdbd3cd0ae295ee3b110d7fcf5563d6dff7c46562e1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266421, "uuid": "2c0f2779-ccff-4c63-a566-6189f6ad42c6", "comment": "Malware payload (Mirai)", "value": "e69397368aa6a268016b73838b68d199ce49bf6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266421, "uuid": "b86f9dc3-b56c-43f4-a9fe-377db4cde51d", "comment": "Malware payload (Mirai)", "value": "5f04d1806d0e022210077192f24b8446a387b0633f348a2c5253db826c89ef79eedb5a493cf865354adf67d7514557cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266421, "uuid": "56cc1c68-3169-470e-b118-1c44fbcb4e36", "value": "T1B8534CDDA4018E7DF98AE7BEC0D60E09B52162A520530F2B7BABFD833D72058D456E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266421, "uuid": "eec6d896-d10b-4362-94d9-25d73341e14b", "value": "1536:ojalKOHUBf6/vQHliGlYpbKGFwQYtdldiQA+YE/qjO8iu:PlK8UBf6/4FEbpY/vi5EmCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266421, "uuid": "47b3402d-faa9-4775-b376-d687b2a825f7", "value": 63228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266421, "uuid": "5cee3f51-e449-4610-8cba-fd3b619f390c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266421, "uuid": "d4219dd1-ac15-4784-88c9-b8f834264e51", "value": "9be7fe568a3c014460c0ca085a2330ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fed205-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212690, "uuid": "a336debb-2ea0-4d26-a887-220a188a9d4a", "comment": "Malware payload (AgentTesla)", "value": "c35c5ceca683d9173a9577559406c565", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212690, "uuid": "972b805c-079e-45ff-b916-e996e02cbdf8", "comment": "Malware payload (AgentTesla)", "value": "d0ff0a5fe47f75afadee4f2b22809ce9e5d8ee8983345e3da251ffe8f8edd920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212690, "uuid": "4fbe9cec-1128-4b4b-b34f-6c5d0c668349", "comment": "Malware payload (AgentTesla)", "value": "2bbe5a651665eced6e8e960c7eb8ba647d5a88ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212690, "uuid": "890d4cc8-0559-472a-89d3-c3924854f2dc", "comment": "Malware payload (AgentTesla)", "value": "ef3bef6d8f64ee1227aeb7659d58ee0ad97a6f8092ef154bb6007414c1f41949b58d3682ec6c47e8eb77b240a836175d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212690, "uuid": "9b98a727-cacf-45b5-bf8e-10945451dba6", "value": "T177E4232129EF0B1AF6D648740150E50F8EE877DDB3C97A36A8F2814F15E2174E1FD8A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212690, "uuid": "6c385152-8e8d-45a5-b4be-0f5149d2f737", "value": "12288:mzfbPUdjz7dGm9TuHAwdcVWbfxSt+B7mQU36GFbTqY:mHPUdj/dDaHA8cV8dB7FUqGF6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212690, "uuid": "dd04b077-c833-4ae8-950a-b77327954295", "value": 674178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212690, "uuid": "332a751c-73d2-4274-aaa2-ea837222be89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212690, "uuid": "19124c6a-5be5-421c-937d-d6279755ac14", "value": "Purchase order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43aef58d-4588-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693216204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216204, "uuid": "bf518d4b-1441-482c-b1d5-95a9322ddfc1", "comment": "Malware payload (Mirai)", "value": "4fbdb8ffbe0d4f37f45c1ece3f5a502c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216204, "uuid": "4f59ba74-33e0-4cb4-918b-8ef2abc76e05", "comment": "Malware payload (Mirai)", "value": "d119b310c7a4d77f9d833050cbfa8ca8b172282febdf981c6b923f02f3a489e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216204, "uuid": "a285c4e6-227c-4ed0-8e77-efa36753f043", "comment": "Malware payload (Mirai)", "value": "ffc87a56df7a9020d36c112bf564cbb2ff5ad34f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693216204, "uuid": "a3701983-764c-4573-8755-3a0849caedee", "comment": "Malware payload (Mirai)", "value": "dfbd993682405e23ecd99da68a6d34fc3b229d18963c6f69025c77500641b9a030addf7d8781a704e362833543465077", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216204, "uuid": "171418d5-1cf7-4c80-8fab-71c630de7eec", "value": "T1A4C2E16350B5CE03C8F3837A6A3D59A662605434A34EED2D37BA8BC837464D0657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216204, "uuid": "56aa8c22-61e1-48d0-9667-460000048759", "value": "768:u5+Kcrb9VDJee2KTgdTHOBcK5ZCAy5DjR:hlrb9veKTg9QB5VSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693216204, "uuid": "989ee76e-3e09-4fe6-9167-75d3817085f9", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693216204, "uuid": "e5545807-5e2b-4d05-a3d2-63da83cfc1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693216204, "uuid": "a9ecf13b-5e14-4424-b042-230087bc9344", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c328b1-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212723, "uuid": "3de6dc68-aa7a-4090-a09f-549c48649700", "comment": "Malware payload (AgentTesla)", "value": "4752ec1a7d2b27ac399525515d060a59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212723, "uuid": "c490b058-9097-481d-9ac4-5a35af67f907", "comment": "Malware payload (AgentTesla)", "value": "d243c2cbd33c32c26a4353a58a59f230100967d37830af1a14dd4650100789ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212723, "uuid": "45254243-4c1e-4514-9550-4d9d6df13970", "comment": "Malware payload (AgentTesla)", "value": "b8cb3f3382da8af551d4b516c700db09f8143f9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212723, "uuid": "8eab34b9-90dd-430c-8723-f70510e97567", "comment": "Malware payload (AgentTesla)", "value": "3f3a16b19d041993328cff9f2019ab0feb50ccf1d1a0a5935aedcc5071e535a40b539e1af1cdf7dbffedb4895dbc2d9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212723, "uuid": "b6f5722b-94f3-4e8e-a9e2-320b5efec241", "value": "T15DE4122C7AB4AB5BC67D07FE412013788AFB912E6456C3D60CCB788D4EB7B808545B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212723, "uuid": "725aea04-7158-451e-8bd9-b5a483c4ce74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212723, "uuid": "bc380e94-8cdd-42d7-a9b4-589429a43522", "value": "12288:8sspPXr8ax/Q+mhdugO0l5V3h26AaKnOWqDA3iP/fOeQL4:8nxxWLLVh2AK+HPK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212723, "uuid": "0445c66a-bddf-4c62-933b-04a0e7983087", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212723, "uuid": "23da9e92-714c-4164-9899-a244dcb31f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212723, "uuid": "e14bccc6-c97d-4bdb-9a16-614cb98d4a0d", "value": "FedEx AWB# 772803166933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25440e6c-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229897, "uuid": "505452fd-1a6b-48ec-a2a8-8f8c59964f23", "comment": "Malware payload", "value": "53fd6a912073ae9b26c24809a1e356f0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229897, "uuid": "e705ab5b-eb45-4afc-8d6f-0aa6679f9f75", "comment": "Malware payload", "value": "d34a4b86218d78d19f6ef93dc27802d3b80d24db65abe0fbf224b5239f2855c0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229897, "uuid": "9f912cfb-6051-4040-a98e-ec51378e28f0", "comment": "Malware payload", "value": "d29a6871e9bd89ccd3434fd5d26c9219e484c450", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229897, "uuid": "3ed4cb33-96b7-4a13-a9aa-80f28edb3b21", "comment": "Malware payload", "value": "cab7dfe4f471793259e2a1edd4c966dd806a4dfa16507ad8d723f454cf012118d430aba80722e8a196511ec2d23febaa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229897, "uuid": "416724c4-8cfb-4ef0-928b-fa83d2775785", "value": "T18825232E7CD60FAEC748E47A0517EA3822B6BF6E5794A07763D2354B7536732864302C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229897, "uuid": "98cd9697-b32e-47a8-9495-651bb2fa9a8a", "value": "24576:hmmUd389eyH8hkLT87e3a2apggO6CIph:h2tGFapZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229897, "uuid": "c6c77cb9-5af6-4e9b-9f24-3239a54c0a98", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229897, "uuid": "2c68e8ea-fc4c-445e-b758-6eeecd75c3f2", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229897, "uuid": "41ac012d-7b67-4b7f-88a4-a74029c07b27", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.27280.1259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1c661b-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212838, "uuid": "59e473de-3f65-4ce0-8f6b-66343e5c5268", "comment": "Malware payload (AgentTesla)", "value": "34c74ed2300a242fb0c974a51c8c72e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212838, "uuid": "7f5bd4b6-912b-454e-a65e-29bfa8966e10", "comment": "Malware payload (AgentTesla)", "value": "d4af8019f4fb6f832ad72af1304293684e5299a6f263228206efb74569d10e4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212838, "uuid": "7685f359-7f68-46bd-b6b1-ec2cfc175944", "comment": "Malware payload (AgentTesla)", "value": "5221f4f8f3d4c208cdba6933ed4eb9d6e6919021", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212838, "uuid": "9b50b833-86a6-46bd-9e91-2c55ffb26183", "comment": "Malware payload (AgentTesla)", "value": "1d13c34f86625a63a60f7bb3aa42a15d6603bcfc4c99602c68c0cdee895dd156a35bbc5fc3035aa317b484781c210c94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212838, "uuid": "1a74cbfb-3042-4467-994d-7352bb17143b", "value": "T155F4339AE5D622124B6008B4A0DB3479FEFDA0FD47C101896B12C0FF955DED9B91C3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212838, "uuid": "d59e0179-ea8f-438e-91f5-ad670755df92", "value": "12288:fu51V6q8xfTVjtiawK3VVOnjBmNB0d7UFBwYdG+IqK3uZuCnPO6rXL:fHZjUawOGgNBc7EW4GhqKj0PdXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212838, "uuid": "b3233af3-45d9-4977-8e9d-8c6afdf43dad", "value": 733145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212838, "uuid": "197a7a21-6cee-41fc-b769-619eac2e8fb5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212838, "uuid": "110037e0-6a9a-483a-9ffb-57f8b000b1e1", "value": "New Order PO2087441006AUGUST.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07c8f23-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209515, "uuid": "853bef34-935b-4432-bce1-0381e652308e", "comment": "Malware payload (Mirai)", "value": "3332a6506fc0aa2058acd36c88dc9c35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209515, "uuid": "d6ef93d2-d622-4a37-bb84-cbc818ecc30b", "comment": "Malware payload (Mirai)", "value": "d5198a4eca0267349bf54d61ab67ad8f37d52a7042ab5152dd0ba840eeb5ccbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209515, "uuid": "37c68f37-de09-4571-be69-b03462ace023", "comment": "Malware payload (Mirai)", "value": "0f6676e42bbb2f0aa1c1e4bba5e8a3b02ee6ba2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209515, "uuid": "fbf10b9c-4882-4bec-a7ea-62f16fd8e595", "comment": "Malware payload (Mirai)", "value": "9d9bffbf2e94a9671840a70f86fedb2c78e337122ce7b8c34e7aa01c80eef0a3c071bfe2ff85b36827263af5c62c4716", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209515, "uuid": "7ddfdc5b-2745-47ee-8e0b-d6d46682b6f1", "value": "T15E63964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209515, "uuid": "5cddfe30-d81a-41c2-abc2-2d23c8346795", "value": "768:RzZWyvL5MsRXxPx2pqV2UHz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UxGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209515, "uuid": "226df56e-df3f-4d8b-95a6-d1270f649cb2", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209515, "uuid": "254b0100-c616-49bb-89c4-4f0f1597ab21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209515, "uuid": "91b3b987-cbfb-4031-9e02-3c6b1364ea31", "value": "3332a6506fc0aa2058acd36c88dc9c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b88c83-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229896, "uuid": "b2bedced-558f-4dea-a691-e4f841104f80", "comment": "Malware payload", "value": "4de16e4fc65b489ff75c4aaa013b1a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229896, "uuid": "09c83106-e9a2-4acb-bfbb-c0156b410b0d", "comment": "Malware payload", "value": "d5dd0ef5889a2914827bce9e094f7736994149ae7c1fd6c8e0d63d6525aa8c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229896, "uuid": "859eb420-25c7-4367-851e-696fd48aa5cf", "comment": "Malware payload", "value": "2a667a2fea1c85d3697ec9a4bb6c9684bb9f6ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229896, "uuid": "0fc6080d-f2f5-4cd5-8290-6c00291a15bd", "comment": "Malware payload", "value": "bbf48bb4f5436ee890dfd27c595157f6c3b41c152e2ce3b45c4c91bb9e46a0f1fcc4d1459148e2b9c8fce3570881f832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229896, "uuid": "940f2213-22bc-45bc-a132-0e12a650919d", "value": "T109046D0074E2C073D977193249F4D9B59A2DBD210B259AFB77D80B3E4F306D2A631AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229896, "uuid": "14d21c22-9227-4aa1-a174-cee87bb0f4f9", "value": "0954beaebb211de35605a05432b8cbdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229896, "uuid": "d02eec00-c4f6-451a-8e22-05c57309f175", "value": "3072:83sZs5BHHERz7snk9wJPqO8uxAQ9MyN73OfFJiPAg0Fujy/PG+:/sbnEz6Pr8e9vAOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229896, "uuid": "b3d4e336-4805-4927-9227-5f1881845ed0", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229896, "uuid": "ca13bfc6-005e-4ba7-a5d2-dc82f74bc80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229896, "uuid": "b88f63b9-ef42-48ef-9c5f-0b75f8f2b60c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.7873.21224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fe67f6-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228878, "uuid": "7550a5c2-c20c-47a9-ad3e-b1e2ba0b4523", "comment": "Malware payload (AgentTesla)", "value": "5f5bf1d3a521601ad257f19589f78c70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228878, "uuid": "72c341f9-de3d-468d-b1e8-952b9b048dcb", "comment": "Malware payload (AgentTesla)", "value": "d609b7c26fc4a684c1ce9bc90bbae68e058bb1108ee91693fb1b8bc7a75266e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228878, "uuid": "62b3117f-02bd-4b8a-b260-283a84e68408", "comment": "Malware payload (AgentTesla)", "value": "f0e8ad5f2bc0ac71f9a4e40c4084a4b4a90d6d3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228878, "uuid": "973df65f-86e5-4149-b38f-bc2675e0a03f", "comment": "Malware payload (AgentTesla)", "value": "b043e11f2865df2c9db7ab18be3f367989cbd1e725f543e0cf673b8dc37a732721c526b0adf8282befdadbcecf684e96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228878, "uuid": "c42d51d4-6eca-41c8-ae8c-ea0cd6384ea3", "value": "T1132550ACBD9C5187E728DD28669F243C1C26D6526D2AA380DBB7C4D71FA01073A5DCE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228878, "uuid": "12a2e17d-744f-41c3-bc8f-662da4d8fb77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228878, "uuid": "f5e15396-aa40-4fe0-ab7c-ea2c9effe10e", "value": "12288:eOlr1Xr2iN25wSWrcArnLcZ2tiy6b2yw0qf4tRd6d1dBhc8HgE:e4Br186cAvcaJ5yw0tFIdg8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228878, "uuid": "c5fbba78-4753-402e-8373-936510354de6", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228878, "uuid": "2fbb62fb-3c37-4912-8a1c-9ed136f9420a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228878, "uuid": "27689468-a6a6-412e-a4f8-77adf82f0ff6", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88bf796-4578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693209528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209528, "uuid": "9bc4e005-27b2-4177-bb38-0a660b9b13e8", "comment": "Malware payload (Mirai)", "value": "0e67c1a948f378860503941b32c4aca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209528, "uuid": "c602354f-7fa6-467f-9b8f-d5da209f5217", "comment": "Malware payload (Mirai)", "value": "d637388ff5d119e2b85e38cd955f37b2bdce4e14a2d015d337bf2e4f589f52c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209528, "uuid": "d43c0b85-5b62-41a7-a161-b2a1d96f0b87", "comment": "Malware payload (Mirai)", "value": "9297e4e7c814569cfca8aed1ce4544139bb867b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209528, "uuid": "c8e133f1-fe3e-4227-af28-2ebe505423cc", "comment": "Malware payload (Mirai)", "value": "121a62afef69d21e1637e88390a725c403b461acc23ab2e00e7fc9a36ea1328953eb6f2f1f9f310658b8c48354a77898", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209528, "uuid": "92b42ca2-15fd-4078-bda9-c7e3da97cbf4", "value": "T1EA831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209528, "uuid": "6ecd248c-5a25-4313-a10e-6b1e18532fce", "value": "1536:CxnjOSuwgUtOJ8ggeoJup0gNaIAEbSMDiYyom8Kxcl5kYG:FS098i0qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209528, "uuid": "df0a45cc-5c0a-4715-a517-b2c67fc5b6a8", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209528, "uuid": "52f79189-62c3-4742-877b-950b609e6791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209528, "uuid": "5e2bfb33-c444-4846-acd2-29aa9f72943a", "value": "0e67c1a948f378860503941b32c4aca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c22aa68-4581-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693213266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213266, "uuid": "9b09b5a9-bfcf-4349-887d-42468068cd2f", "comment": "Malware payload (Loki)", "value": "749632b06eb71cfc0695a3c7c594f2c8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213266, "uuid": "21c914c4-e900-46a5-9fac-760aa6927303", "comment": "Malware payload (Loki)", "value": "d644940e1de68cb9c64f6570f78f2a043c91b85e124e9a9e3dc3e5a56a941812", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213266, "uuid": "0c9401ad-b8f6-40da-aa88-4ef357c42bf7", "comment": "Malware payload (Loki)", "value": "db011fe3e28fdbb939740d74eb7caa75c5f0c35c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693213266, "uuid": "319fb0a8-5085-42c9-a930-b66985f08c5b", "comment": "Malware payload (Loki)", "value": "be6068f652471968596405ea7c21ba9b590a6f4265041ced7f9ba388961f67ed316b44852c7072ad1838a3a5c75f0b29", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693213266, "uuid": "b8524ca3-bf39-4279-93db-184700a121ab", "value": "T19D9312A9684DF0BED23372A5AFDDA517C0580D58BBA9C2F3DFB51712B2C14C81679E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693213266, "uuid": "44785693-ad06-4464-a9e3-cc2a77448593", "value": "1536:ZorKrLpLHfrhDANeeLuVgdufRbtQZIWUhasBQ8gPdGpR23T/l+MFJbTj:FfkwqkRbtQRUcsSHPUpo3T/Xt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693213266, "uuid": "73b49b17-22d3-4a59-9aaa-980ba5ce792e", "value": 96490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693213266, "uuid": "ac9e6b4d-6c30-48dd-bdf2-bcaaba49742f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693213266, "uuid": "7c9a52db-72e7-4fd2-8281-0022430e0dc3", "value": "Quotation for dock stealth supplies.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a38ef7e-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693233315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233315, "uuid": "36af6b48-0bae-4481-a37d-3476a22ddbad", "comment": "Malware payload (AgentTesla)", "value": "5e174035d0cfe50d69254b61822dd190", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233315, "uuid": "fa3777ab-8294-42d3-b55f-803a1999ac52", "comment": "Malware payload (AgentTesla)", "value": "d6497995d3f65551d193a651e10534d71d249b8e722290bc3c1f0fd4f7156c72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233315, "uuid": "927b4efd-c148-4852-a896-17b933e9aa31", "comment": "Malware payload (AgentTesla)", "value": "e5509f39330defbd5f356171e9f5bbc141d8a24f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233315, "uuid": "8a5da13b-05ed-4956-8c19-d290f9d2d805", "comment": "Malware payload (AgentTesla)", "value": "3c01085739d28f44738f63a5752485f6e8a0c0556f6f7e69d4dc8084e3c329b49ebaa3366106edddbad3cc16cf422222", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233315, "uuid": "52853b4f-a630-485d-a25e-990dff4a669d", "value": "T13B15F83804B80A12C135D2AD6AD4F513B3904F96721DCE5686C25FC90AD6E2F2DDBDEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233315, "uuid": "511d6156-de90-4d5f-8d77-4de5ff17e3a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233315, "uuid": "bee90ffa-3e1f-436b-a553-c2d4bea4c37d", "value": "12288:bEKaJILRrdbP4xqIR+c2+Os/Z33dJuHYsnMzS:BpFEHR+c2+TNJuHd6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233315, "uuid": "eae26fd3-b45b-4ac6-af85-665917d28f00", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233315, "uuid": "e7a5be4c-e810-47c6-8a00-f01ef152e938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233315, "uuid": "eb148b48-ef8e-4005-8e49-1cab56586096", "value": "SecuriteInfo.com.Trojan.PackedNET.2232.20720.10454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1510248d-45aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693230729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230729, "uuid": "5e9f5755-5e04-4de0-b143-4c318cfcb8ac", "comment": "Malware payload (AgentTesla)", "value": "7b4652acfc0abe22429b23055c099753", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230729, "uuid": "7d324f78-1e50-40d2-a3eb-99ad1190cea5", "comment": "Malware payload (AgentTesla)", "value": "d69d7bc7503df3d41dd157c79ffaaa0644813faafdca6a12ad4201758eae32b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230729, "uuid": "91b0c8ea-ba65-45d1-84b7-3e4c4948e2fa", "comment": "Malware payload (AgentTesla)", "value": "faf795af386ecbc0475d1711885c76badcd9506c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230729, "uuid": "13b0945b-7f9c-49ea-89b7-43178cceb95b", "comment": "Malware payload (AgentTesla)", "value": "8410c7e900a188da9b574f1f8d5a01399d4075967d483204df1a235184da0d8742a26fa1fad9cd13eeb7817addd258f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230729, "uuid": "0c5b09a0-da3f-44bf-9e15-afc0836e2056", "value": "T1FF0502357266ABA9CBBD4BFE81105C0007B726631030F7AD1FD162D69A86B46930EDF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230729, "uuid": "34979535-a487-4fa8-a0c9-c7cbf04b78b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230729, "uuid": "15cc2fb9-ec87-49f2-b0a6-c80d7b86bf39", "value": "12288:uMntzw+0+BMZfUkTRvBADAIBGrFXaAh1n877kxWNKCv2ptg:nw+0gMywn6cZhh1W+W0Cktg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230729, "uuid": "d71680e3-a764-4d31-b594-f2982a17c244", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230729, "uuid": "e6ecc444-2121-4bdc-9dd2-a51022c1d045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230729, "uuid": "09d95512-7829-4135-b6b9-719b855cf4b8", "value": "PAYMENT-DETAILS-8-28-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27beeb8d-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229901, "uuid": "56e1453e-c070-41e1-8935-7fbd98d58753", "comment": "Malware payload", "value": "cd52f0162f3149f6a4bbc0163d3952a9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229901, "uuid": "2451280e-a324-4dfb-853f-0339a62dfd8c", "comment": "Malware payload", "value": "d7c7e7817db03434cdeb92deb9e3e70f640e33865cf116d951ba25a39ee18ef0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229901, "uuid": "9cdc5182-4d93-4ae1-a19d-efb64c172779", "comment": "Malware payload", "value": "50c3c7e672867219df4a5380d73bb23e5b12fa69", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229901, "uuid": "e37bd07c-367f-4be5-9fbc-e31a8aa3c1e0", "comment": "Malware payload", "value": "10c4e9823106d812644c6a870e898b127a904ef81f987900bedfd5f1ef78b08333d377db25b7a9783a4e6c51d4de1eaa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229901, "uuid": "5bfa224a-644c-45ea-a472-e199c12e43ad", "value": "T1BE15233EBECE1F97CB88A9331893DD1501617E5D539DE2B363CAB50A253EBB19A43011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229901, "uuid": "3667109a-663b-41a3-98be-017381b7948a", "value": "12288:K5JR3xAN/lgP4OhE1v7MjrWIq2//tminUqO13H/CF9eIV/NHEWxw+:KXJm/yNYpD0tmmUd389eyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229901, "uuid": "8317a4bc-9f3c-4327-871b-c8c3bfb3eae7", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229901, "uuid": "85f681be-6962-41e7-b45d-524224e28856", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229901, "uuid": "6ee2f1fd-958e-48a5-a75d-9c18af83990d", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.22709.5263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13d5097-454c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693190592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190592, "uuid": "088efd37-a996-4e45-a7a0-24e8f81b4308", "comment": "Malware payload", "value": "c6df9e46a12c2fab299af9f6b194d9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190592, "uuid": "cd499b9b-d232-4c86-971c-1ee934e2c980", "comment": "Malware payload", "value": "d881c3b80f9d289efceb55184e8ef1aeec4ab91bac464e40e446ffece719a3d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190592, "uuid": "e3446ebb-8a7a-4afa-843c-4ca4d2c1ce41", "comment": "Malware payload", "value": "1c58f717f418cc5ec27de5d722940439b4887580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693190592, "uuid": "46452f6c-686c-4c7e-95cd-bfcb8f26229d", "comment": "Malware payload", "value": "c8a5d10ff4f533ce860b87ff9e84fd3541bc4895996766ce6b74df866d4f7d2e79a6ab53fe00edb424c91eb7e8da7e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190592, "uuid": "8c6398dc-2ef4-4428-a1c0-882d99c58df5", "value": "T187D53361B2C98872D5A71931A7E4C331BF38FE306B3289C7A7445B6E9E748C08935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190592, "uuid": "9678913c-21a7-4c63-9a5c-a56865bce049", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190592, "uuid": "9ba1d32b-5234-4e7b-99a7-fd8b15f73a95", "value": "49152:8cbi65JRWptipp/B6KnbOdCjWPS6b/7hEV4+/fji8T+RWMD+kko6kbWb8ODXhr/:8cbbJRWj4tb+CjL6T7hEnziTBD+xkbit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693190592, "uuid": "a4f6a197-7257-4457-8f9f-42f93336befc", "value": 2851832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693190592, "uuid": "131e3e9b-f4dd-4f59-b7d6-524cdbfc90bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693190592, "uuid": "663db6e9-15a2-4b2f-b5db-6616b3d7b154", "value": "SecuriteInfo.com.FileRepMalware.5354.23663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25a775e-45a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693228523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228523, "uuid": "b89e2197-ca66-450e-9b94-88e818f7554f", "comment": "Malware payload (AsyncRAT)", "value": "0b169fcd32e6d0dca2443ccc282dd249", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228523, "uuid": "4e99e8e0-ecc0-41f7-954c-b19342f72292", "comment": "Malware payload (AsyncRAT)", "value": "d8ec53ad1ab9dfb89de5dc56dd9467225cfeb5ace4e4da8faee3d2a19fe009a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228523, "uuid": "96f4fae3-56e8-4225-8908-0a4fa3fe1715", "comment": "Malware payload (AsyncRAT)", "value": "a241fc6e1e551c3d40310aa557cc44a0ec3ea5d6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228523, "uuid": "a77aee2e-4330-41fc-885b-418f485ac483", "comment": "Malware payload (AsyncRAT)", "value": "177f00578e8f2ff25df2ad53296dcef192113056b062b6f70ddbbf427cdfc90736832f2d0d3e00da9c06567773d288d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228523, "uuid": "c1f6bd91-8f37-45ce-9282-6189f48c3f20", "value": "T191534B0077D8812BF2BE4F7498F36245467AF5633603D64A2CC496DB5B13BC29A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228523, "uuid": "c784bcac-d33f-469e-b26d-727d7e406fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228523, "uuid": "4d55a054-242e-4d13-94c8-ef41f0d547ad", "value": "1536:guK49THfe24cPOmU93bZVM6rCZSOBPdF4dUb1dDSNm+:guK0THfe21lU93bZXCZSKrb1NMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228523, "uuid": "8d177241-14bf-4b8e-961b-a5353e55c63a", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228523, "uuid": "acff1d84-3bf2-4c4f-9760-5e2c04ebde71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228523, "uuid": "b334af5c-f4b4-4a8c-b5de-d16c553f2ea5", "value": "0b169fcd32e6d0dca2443ccc282dd249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267272f2-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693223027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223027, "uuid": "73d70ec0-27d7-4387-b370-b77751281c8c", "comment": "Malware payload (AgentTesla)", "value": "ff92e918d0522132aab23583d0308beb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223027, "uuid": "1bf8a87d-551a-4ad2-8468-ecbd791bac07", "comment": "Malware payload (AgentTesla)", "value": "d9130159c16a04430dd935cd2e158d1fbadcfecc12db3e9bc90c38f3e9ab63e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223027, "uuid": "a50f46b8-c91d-4820-8b6e-3ca0f5ff5eaf", "comment": "Malware payload (AgentTesla)", "value": "a21cc13fff7c71e9708ad9ae1659a6f1fe39347d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223027, "uuid": "f16fb31b-315e-49c2-be50-2c1433303d8a", "comment": "Malware payload (AgentTesla)", "value": "d442c381289321717d094b48bfc5a2ba8018d57faa2753d6693720401c1d7d8c8fc95a492ba46f000302356562a85754", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223027, "uuid": "d73ba549-8b43-4665-94ac-45528b53b92f", "value": "T10175BFF876047DE6267F576BDA96ACDD03B616239ACBA4CC8064B7C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223027, "uuid": "3c4a8002-6719-4e9d-948f-fefd18cfd487", "value": "24576:TKNu5W8iRI7LbHaLfvSS4zIB9cw7+NC59KzfszWtMJG8ni3oW9i+yhwUW89skQUq:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223027, "uuid": "281c045a-92f3-4482-bd7a-798013225c34", "value": 1684784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223027, "uuid": "78c4b91e-7272-48c1-b560-bbcd9616096f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223027, "uuid": "1ba5d576-7aef-4924-9f0f-a3acfcbda68b", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.12298.24932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb8dc82-45a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693230606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230606, "uuid": "4eb0b425-62da-4265-bac1-a2244be93b96", "comment": "Malware payload (Mirai)", "value": "d0581e3ad64e7151f87a4ea743e95309", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230606, "uuid": "e9b63440-da54-4547-a03f-2f176f710ed5", "comment": "Malware payload (Mirai)", "value": "d97ff29260f32364deeea518c80da0bf9239951579513fff84f475d7f0bf768a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230606, "uuid": "6fee0c9a-5cae-4171-bff9-d3f0a5c24126", "comment": "Malware payload (Mirai)", "value": "ec216f7723ef611ab99b619a63678e1724afa6dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230606, "uuid": "dff87176-00f1-4ab5-baae-e642de3d578c", "comment": "Malware payload (Mirai)", "value": "1c03d109274f26dadf2fa69ff6b92235e0db6e0fd11948a4a82e05436f1305ad08a965345d6d7da6f6045cb9da8ea92a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230606, "uuid": "371acc1d-e2d2-4987-9bac-20d0fc5363e8", "value": "T1BB436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230606, "uuid": "0e9c2700-764e-49ba-95d9-4e1df5840394", "value": "1536:JeESt/basV2rcZhG6ySN7naORe9xzWOIaEjrqML:JeESt/basVTgS7naOw9BtXESU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230606, "uuid": "198d0337-d42c-4071-80c5-b2b809e5889d", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230606, "uuid": "5fd4969a-db42-4935-a557-bf1372b6f54c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230606, "uuid": "e65f6965-12cf-45e3-80c4-bbab545a483e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c26237-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693223026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223026, "uuid": "f783c81d-a7c1-422a-a0dc-0b739fb7ae24", "comment": "Malware payload", "value": "2a75c3cdfb65adf97d131b26ec63e21d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223026, "uuid": "903fb917-e19d-42c2-b885-d800e2e557a4", "comment": "Malware payload", "value": "da7913ffbcf7cf4d5ccb13551971ef69fbe9abc4590c866c2a1bd05f1805e53e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223026, "uuid": "0a11526e-fc80-4bcc-ad1c-b9c3eaa7c615", "comment": "Malware payload", "value": "0a23721209a1813b606bccd755b707614a3c2da6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223026, "uuid": "336819c8-2ab5-4be6-aadb-368b78826070", "comment": "Malware payload", "value": "c1d704d03683e9600f38abca2eef7c8b8323e841516232f329e183c895fe07efdf1a69dc17ec8450a8f18d4b3930cf2c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223026, "uuid": "b73bf653-2482-48d3-b62d-6f3ce578d3e7", "value": "T188836B007AE1D071EA7E193A2474D6A15B3E7921CEE19D672BA605BE0F302C1EE34D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223026, "uuid": "dd5d0103-41d4-4a48-9071-8fdd62c23316", "value": "dd47ffb41128976d017bac9bd2536ae7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223026, "uuid": "caf47a82-1518-496e-9df7-122a37b8d950", "value": "1536:yd13lwSS42x5AW0iXlbnWyLMreuMJEbsWZLcdp3I0h7TtBFImO2rZt:yS/7x5JXlbnGaHyPap/h3/o2rZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223026, "uuid": "974d549f-bd7d-41c4-b7e1-2d5702b79038", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223026, "uuid": "a7fbb37c-15d6-4e09-8024-b209daa06600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223026, "uuid": "ae51e512-d40b-486a-8fce-c33c1133f192", "value": "SecuriteInfo.com.Trojan.Loader.1600.24592.8762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e363ba7-4567-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693202129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693202129, "uuid": "f2245175-ec68-4087-bb4d-29b67c1ab147", "comment": "Malware payload (Stealc)", "value": "6b0748085f0c2402574c138e0cd836b6", "object_relation": "md5", "Tag": [ { "name": "94-228-170-65", "colour": "#DCA8F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693202129, "uuid": "912b7b7b-05be-4989-9dcb-3fc35e6d4c24", "comment": "Malware payload (Stealc)", "value": "db079b9f4b4bbe149d6acaae93f18a5da2f1017dbf900dfbef3559452718e999", "object_relation": "sha256", "Tag": [ { "name": "94-228-170-65", "colour": "#DCA8F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693202129, "uuid": "fb3d8119-c22f-4fde-b706-1742156364fa", "comment": "Malware payload (Stealc)", "value": "130152a4103b7e29de4a1afc79a4e7fb986a3e90", "object_relation": "sha1", "Tag": [ { "name": "94-228-170-65", "colour": "#DCA8F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693202129, "uuid": "be48fe59-a8a6-4547-8258-a999bbf8b506", "comment": "Malware payload (Stealc)", "value": "cbe7e5150c56293ade2e230147ef9c7b3682e460f42af24d4016418ab15e9e9e7b4a855268d980dccb7363b72ffc22bf", "object_relation": "sha3-384", "Tag": [ { "name": "94-228-170-65", "colour": "#DCA8F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693202129, "uuid": "2ea422c9-3e7d-4e1a-b95d-5afd89e114f2", "value": "T134856D22B18288FAC073553C9C27BE7994567D1C1E38ABF93AF44E8C4E3D6513929397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693202129, "uuid": "59522bc3-0e9c-489a-b039-d0a5c1ba6b56", "value": "5745aa5ddd0d2812d1fd030bec82f591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693202129, "uuid": "ce30ddb8-1185-44c0-bc75-820c00932e3d", "value": "24576:7YbZnq/bVIBla/hB6/c+pIs04ERWn8enP+ryES2HHHH45:7Cw/pB5gE08eP+r/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693202129, "uuid": "b3722b6c-dd8b-4b7e-ae97-d3c41cdfeacd", "value": 1847296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693202129, "uuid": "cb024a63-6a59-4fca-baeb-4db9e7cf2356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693202129, "uuid": "2e5cd4ca-a92a-4e57-ad60-b92680610c9b", "value": "6B0748085F0C2402574C138E0CD836B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32546c50-4595-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693221759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221759, "uuid": "09d42849-b64f-492e-88a0-8d23e902158c", "comment": "Malware payload (AgentTesla)", "value": "116876807f67d24f5f6d8eda304a92a0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221759, "uuid": "19a3cf50-146b-453c-8701-3dfb6d25ba78", "comment": "Malware payload (AgentTesla)", "value": "db687168a9166a5abe6cb87bd5e9916276d5314134da6e902ef7ca2cc1c32cff", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221759, "uuid": "e2a4b5c1-4be3-49c8-864e-0edb887498fe", "comment": "Malware payload (AgentTesla)", "value": "486a3b331530c1544f5da9a9a9b5756c6222afb7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693221759, "uuid": "1597af38-9b9e-4174-9548-2ab4c1217c31", "comment": "Malware payload (AgentTesla)", "value": "0c45b1e78368b0f0813e6824fecb64c587037b352b7e7fcbd8d580aa566978d3e7df7d85a337fb4d487f39d601ad694d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221759, "uuid": "ebb56181-39fb-43cd-a8ba-3b6371635472", "value": "T1E4A4237D311ECD80A3A25D1D71C56847E276E3CAC7C1F2AE71E0A6232D1FE17A20B596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221759, "uuid": "fabd2169-a8f3-4888-9e98-8651674f624e", "value": "12288:Y1ygxwmGFcuf/EIZQpSIFNXBUrXpaz3Y6guxYHxd+ih:YNwtCu3EId8XBUzpT6guuRd/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693221759, "uuid": "47b26f71-33d5-46ae-8886-71f1320f167a", "value": 485466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693221759, "uuid": "567b50e8-0c9f-4097-a713-8540caf087ff", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693221759, "uuid": "823f1c33-28a2-4b36-81e2-1f284db13976", "value": "C-117562683.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdee0a0-45e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693255036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255036, "uuid": "e43e9754-d27d-4812-9dae-afdf606a40a6", "comment": "Malware payload (AsyncRAT)", "value": "e81f079235a75b064ea503d86251f9f2", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255036, "uuid": "050275ca-d4cc-418f-b82a-6f239d7c269c", "comment": "Malware payload (AsyncRAT)", "value": "db84db8c5d76f6001d5503e8e4b16cdd3446d5535c45bbb0fca76cfec40f37cc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255036, "uuid": "0266b572-653a-4e14-be55-badcb98b9625", "comment": "Malware payload (AsyncRAT)", "value": "88b32ea430b21428ea64955a43f45665aac7955d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255036, "uuid": "753fc57b-c5bb-4d32-a8f0-7b01630b5a51", "comment": "Malware payload (AsyncRAT)", "value": "99bdf71cc8360faba9df646ab90bb23fc52c9528ab56c9c941a4d8dbf6dd52f338f5356333428e50c2eb559ab05f8e0d", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "EmpireRAT", "colour": "#788DE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255036, "uuid": "80f46ac6-3029-4d7e-9ed4-1f00b2bd073a", "value": "T135535C043BE98136F2BF4F7999F1614546B6F2277903DB4E5CC810DA0A13BC69A427FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255036, "uuid": "db4c5a19-b019-4876-8d32-44c5b789aa53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255036, "uuid": "aa3bb4c9-3cf6-4dea-8674-eb20310b457c", "value": "1536:iEOmtRpMee5fZeidiaDpbfod+PvRupWN34t0Kf+:bzpMKidZpbfFP5uk5gNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693255036, "uuid": "c78005e9-a742-4aec-9365-c667feb1e8d9", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693255036, "uuid": "3c985483-1b34-48b5-a56d-d0faf7b5a49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255036, "uuid": "24806e0e-a9d2-49b7-8e46-f41cc09eabf8", "value": "EmpireClient-Decrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241381fc-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229895, "uuid": "34d89416-0694-4d45-8e59-2be1dec5cc40", "comment": "Malware payload", "value": "2c789992232634278b48fe332b75d007", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229895, "uuid": "a1fb2a26-d2cf-4730-b29a-9d2754e83142", "comment": "Malware payload", "value": "dba93e88f51fccd0da33f3ae76630985cad89d0261541f236ff81997813572fd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229895, "uuid": "c7dd538c-7588-4642-8a53-f64c060ccc44", "comment": "Malware payload", "value": "071d118c5cc277799a5fe4ced47fd582afa37355", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229895, "uuid": "9d6d2659-48b3-4f57-bdf2-a4a6d731f70e", "comment": "Malware payload", "value": "ce86b9cca86ede969ea7652deacc1d02b9ca23c022f8c7d30c0c78411c1e9bd757cb2dbaf2a701951bd017ac333f0d79", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229895, "uuid": "b209a41a-8040-40ea-98fd-4d6a9894ec88", "value": "T165152325FFC24F4BCB48D67A9943DA4D014DBC8CA788C4FB8B997442637E79182D5C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229895, "uuid": "793ed75a-3eb3-433a-b4d9-79f0d4359ac7", "value": "12288:2ZMdlZFV2xxESqOBkzPQ04OzibomTAfJgujJxiO8TrVRmUa8m7cN8KQlLyX+/eEr:/lPMF7CPz4/72JguPoenV7cvXceE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229895, "uuid": "3493898e-d700-44f7-8463-a3a2b7da8052", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229895, "uuid": "49f49b84-c612-4ed6-80cf-7725af4a9b13", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229895, "uuid": "69095d89-1195-4c75-8a07-7a1fa41f6ef4", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.19660.20164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef9a0e0-45c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693241725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241725, "uuid": "7e034e1c-36db-43e2-9ebb-c5529bb66d9d", "comment": "Malware payload (RedLineStealer)", "value": "1c6faacb8862c545c18ba4bd01cbfc39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241725, "uuid": "0edccc55-df0d-44df-999c-56264a5ab916", "comment": "Malware payload (RedLineStealer)", "value": "dc7d22484f35ca6be941995a604bfa43b31c8dc0fead8907f2a1b5a586ae610d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241725, "uuid": "919cafab-c258-46ba-8d5a-900072b9f0d9", "comment": "Malware payload (RedLineStealer)", "value": "b2d751fbe750e80c9573970c2ac5d48e2a51947b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693241725, "uuid": "dfc08d14-dba0-42f4-a65d-d2c11c603841", "comment": "Malware payload (RedLineStealer)", "value": "2a1027a88acac45486d7cb5cd77cf5f4e72eee1ed17bfc6aa0688b9f8a0712a6cc9e9786244a59c87e61a69d5b2cd6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241725, "uuid": "f3aadd1f-65e2-4eba-b462-1b089c0e73fe", "value": "T1667429D0339879CDCC4F8EF161611F788A60D442A197BB537C8BACFB385A395AE055E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241725, "uuid": "482b8079-3a30-4081-b2d4-63708637f336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241725, "uuid": "9abe4f03-3f02-49c7-9f85-ec674d4a73bd", "value": "6144:MiNFouqVrpZKERF4ppjz/7M9QOWEbNRFqN1avTi:hqwe4fYWEbNRFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693241725, "uuid": "4f6e0e5e-11d5-4a54-a44d-9ccc52854eaf", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693241725, "uuid": "29fd8b79-16d4-40a3-ac0b-a82dd23939be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693241725, "uuid": "d77273c0-6604-4811-9705-9571dc348d5f", "value": "1c6faacb8862c545c18ba4bd01cbfc39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9ec550-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238181, "uuid": "6c5b70ca-b947-4973-8184-13f7c82b9db4", "comment": "Malware payload (Mirai)", "value": "bda55c4922c492eb5729b0e280d227f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238181, "uuid": "cbe5fbd5-d921-4c8a-a529-cb080bcd6c59", "comment": "Malware payload (Mirai)", "value": "dd51018c7a90344dd2d699398beed4a27a0ecc7f21c74bab3f2905812eb4fb5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238181, "uuid": "3129b4f5-0eda-4167-a09f-b66f306fa89d", "comment": "Malware payload (Mirai)", "value": "0b0e9a51fecd5ac288817ae91aad7f199e0b679e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238181, "uuid": "115d6ff5-5a67-450e-b123-7991a560de56", "comment": "Malware payload (Mirai)", "value": "7915fe7514d5595bb05594249c43ffeb0b6d5dce47824ddae498a56d31e22d22f74e95c5e4d0ab520d1e63d725aa61d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238181, "uuid": "69f33c6f-c4ae-4669-a0ac-b6937630ec70", "value": "T105D32946EB408B13C4D61776BADF42453323AB54D3DB73069928BBB43F827AE4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238181, "uuid": "724254e8-d591-4968-a464-94e9b5b96d82", "value": "3072:7KJ2oCbJaDJ7MeH7w5dxQem53P41ZWi+OwM/9CUBWJhnK:79oeJaDJ7MeH7wd8tcWiXwM/9R0nnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238181, "uuid": "fc8f4145-bf5e-4484-8a80-f69d42c8b65f", "value": 137606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238181, "uuid": "52484a9e-ad37-4150-be4f-06a8737ca7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238181, "uuid": "02c990f1-b7e6-4f0e-b6b3-1665aa3ee412", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248c885b-4598-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693223024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223024, "uuid": "398577a9-122a-4c2d-a785-84c2c26fd103", "comment": "Malware payload", "value": "1c532c3e7d2a16485818cdf4f9a6c81a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223024, "uuid": "ac4e0d65-35c8-433f-9d1f-b46a1638985c", "comment": "Malware payload", "value": "de5b04028342dbf1697951715e5488435ff8b57d530c6f99d8496765faaa2f2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223024, "uuid": "71065496-a932-4aef-a85c-9271b2332619", "comment": "Malware payload", "value": "ab4d562fb8e146b284f4575be03865b38bd9d5bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223024, "uuid": "a6cc273e-5ce4-4022-8f2a-0a548fa7523b", "comment": "Malware payload", "value": "eb2afcf72c196c8911db0d820971944ba1609b6a8bf0117169dd4cef1cc41be2fd3ae3f0abbb898bc3c4f19bb97084f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223024, "uuid": "6a1c2a15-885b-468d-a826-4dd13aebb839", "value": "T16C524B3597870578CB9A89B015E74C3F19B15115A3C942F3ABF44F0EBCA49EFE1630A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223024, "uuid": "4b61b212-b1ca-4073-80ec-1a1cebe5b59e", "value": "a6662c6630955eb0d75b891b46f3558f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223024, "uuid": "28dc91cb-2e53-482d-b20a-402e40452756", "value": "192:2wyd/23vWrZT+0exUG4z2JKnxmHxsKI1gqzBqzA83DHLFB8m35vMn++B:2wyFjkxUGJJKxOxshiclujxpg++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223024, "uuid": "4d00a603-a170-4136-ba2a-fbfb3efcab4d", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223024, "uuid": "5ec8c0cb-4d65-4510-904a-203907d296ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223024, "uuid": "4986e086-0f11-4c74-85c9-b748a8e48171", "value": "SecuriteInfo.com.Win32.PWSX-gen.13966.4698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d491ba3-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183713, "uuid": "5568c9e7-086a-496a-afb1-66bb2d8a8f63", "comment": "Malware payload (Mirai)", "value": "075b6900bc9f65338d427d784abe7ad2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183713, "uuid": "2d3d2fcc-1ec6-4c78-9762-88b8f1e316bc", "comment": "Malware payload (Mirai)", "value": "df01337ba232927d7f555776e5ad9036fb216b6256396289c2f938c8e9f86274", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183713, "uuid": "0b7c7761-acba-4bef-9056-36231ac0b172", "comment": "Malware payload (Mirai)", "value": "0b5eb3c0eb5aa31685b0d980939ee363529abb7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183713, "uuid": "b610d7d8-194d-48f5-9296-7a2162658116", "comment": "Malware payload (Mirai)", "value": "29b5992250c1aa6e11a6933a42c8eccd076b0ec9fb93954ff2a190b6310984dc769a2c3eb3ccf96d9312b04f701307e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183713, "uuid": "b2c21bfb-f10d-4317-9466-858a42b48c99", "value": "T193E3C60F5E129FADF36A873947B78E20A79833C613E0C545F1ADD2110E6438D646FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183713, "uuid": "41d0a427-b9b9-4d2b-8890-e81e4bac626f", "value": "3072:qHBNaUazas8U+VET0oWaQ0cfc5WyIRfMx3typh:UB412s8U+Vo0LaQ0cfDZIt0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183713, "uuid": "747e1ccc-6cec-4916-a72b-dc8d53ca1110", "value": 143412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183713, "uuid": "98430e58-f54a-437e-bf52-c5a45daa6320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183713, "uuid": "b33c8af4-6a5e-46fe-ba00-655621da10b0", "value": "075b6900bc9f65338d427d784abe7ad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c526393f-457d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693211697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211697, "uuid": "97837df4-3868-4f25-85a6-80c1dd6cad34", "comment": "Malware payload (SnakeKeylogger)", "value": "3577ff8a5f3d499f21c663a8bc497f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211697, "uuid": "465c43c5-26ed-449a-b68a-e049773c4bfe", "comment": "Malware payload (SnakeKeylogger)", "value": "e11ed5004ae05216e4051eb56cb6dd37b95794f97bd37da75903cff7254325ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211697, "uuid": "f3348974-a26b-46f3-b950-c0fa63ad657f", "comment": "Malware payload (SnakeKeylogger)", "value": "a10b0491dc5eb262268c796af7176c31040e303c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211697, "uuid": "7b24c0df-d379-48d8-be66-0fb17ba0e891", "comment": "Malware payload (SnakeKeylogger)", "value": "ab820308b3a0e6b9e1b788a2e195e8a210e7d8295bb5784030b581a72e6e23564d60a758ba233f3fe3004908714eaa80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211697, "uuid": "8e7865e8-8b05-45e4-92d3-5a18c1b0f465", "value": "T130741AD79F988ADFCA8E02F4D84147A8D7F6C2CD62A7BB8655C66CB05C43760B807253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211697, "uuid": "ab3776b9-761f-4080-905a-55e1b486a8a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211697, "uuid": "bb10b2b2-c9b5-402d-ba7f-a8713fbc332b", "value": "6144:gZJd3/GwC2elrc+9ShOxVzf1ozjr0rrrrrrrrrxrsOXn0AQzhH0dQlwcfM/enqr3:gZJd3/HevqOxl1cr0rrrrrrrrrxrsOXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211697, "uuid": "b644b960-1bdd-4005-ba8e-61cdeb6929cd", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211697, "uuid": "3681c251-3917-446a-a36d-f63cb460b09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211697, "uuid": "335b4d7c-bbaf-402a-9ac5-38a83928c3c3", "value": "Rlgmwu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5a87af-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229906, "uuid": "23e3e4b4-df04-4398-863e-354e99102f25", "comment": "Malware payload", "value": "3eee111e40809e5239a3fff891eef791", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229906, "uuid": "588e1031-30e3-48fd-8550-28cce50aa339", "comment": "Malware payload", "value": "e12dd5ec8d02967d4034c689ac7a05fa7eef1f6513fcd99d6a10ebb0bb8e6788", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229906, "uuid": "c4687030-0688-45bd-9574-012800bd2e0b", "comment": "Malware payload", "value": "9d18eb872463810228ec748831c4df3998661e07", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229906, "uuid": "fae9ff3d-8c1b-4779-9485-1fbbe8bdc26f", "comment": "Malware payload", "value": "54713c1afb3229045e994b32500eea0bda827dde98d77ed70025c4997a97b7ebca77e76c818e1ed02b74a94749999ff3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229906, "uuid": "b871604c-5219-4762-826e-03d5311757a2", "value": "T129252360FDC56B63CF5891347427991A15C5BEAC538FC0F39266BB8B293E77081A788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229906, "uuid": "7729f8a2-ddf8-48b3-894c-15de9ee0d90c", "value": "24576:HHzgj81VWgVf+Yw4y0rX+6auOUfC3QVIanV9RRYE:HTp/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229906, "uuid": "68b89c8c-9689-4114-ac29-3d80b1a9fa11", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229906, "uuid": "a479f23a-6338-4668-904f-b8c94ac76366", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229906, "uuid": "496f0ae9-a60b-4f88-b06d-04ee5c7f38bb", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.7565.25820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d88e323-455c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693197323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197323, "uuid": "54622cba-4e70-4480-baf1-8f6d25ad3c70", "comment": "Malware payload (AveMariaRAT)", "value": "4bdda5eb7eb63d9db47ccc313fab0005", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197323, "uuid": "8a3e60fe-3bdf-44f1-a390-2f36eaf88661", "comment": "Malware payload (AveMariaRAT)", "value": "e360dcf6f40f9eb2ae5ceb98825ca3c8942fe935463594cfcf9c29ccd7f28707", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197323, "uuid": "a65fa8e3-e90b-427a-9df1-8b4c78a7c105", "comment": "Malware payload (AveMariaRAT)", "value": "78a870be0801f05089947dfad4cc4248e0413a1a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693197323, "uuid": "58430703-c09b-4f6a-bd53-51389270c3dc", "comment": "Malware payload (AveMariaRAT)", "value": "eaace14abb72c7751c755a587dfe3519628f3bb987fd4f6d1126d7fdb574e20db08558dfab3546ad5362758b7bb5bab9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197323, "uuid": "abc502ab-33e9-4b2f-b930-acfc662b006e", "value": "T15EE4CF23AA3DDAF6F42E7EF5681493104A719D1A5430E247E85F7EE2EC33613C0296D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197323, "uuid": "42e25d3e-b2cc-4a51-ad56-4f02eac160d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197323, "uuid": "bda648eb-b15f-4382-8890-dfe34278804b", "value": "12288:ygWJp09rIJA9E3uHdB7ARBaIlsZAu1yR61knbKQt:ygF9hquHjUR4Ils2ZHnDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693197323, "uuid": "623741c4-7e69-44b8-9fb6-130085194cab", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693197323, "uuid": "191e366b-3195-43a2-8faf-d79917e26745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693197323, "uuid": "9da8ad94-5051-417f-aab4-d04d4b30b395", "value": "Video of our company specification details-PD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f35b98-4579-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693209925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209925, "uuid": "5a8532df-5403-437b-a866-2dfae47d2129", "comment": "Malware payload (RedLineStealer)", "value": "a67d19d9b405b831224b8ac61b732c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209925, "uuid": "343e8c7b-ec30-4208-9745-5c01293f7060", "comment": "Malware payload (RedLineStealer)", "value": "e434f17aba8742c962b60cde654f59543d955bac02d5f50498bdfabcee178a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209925, "uuid": "9b0cb321-eb29-4dda-ba22-fd9de17bb160", "comment": "Malware payload (RedLineStealer)", "value": "42eaffe43061dfca2485b9431a609bcdd1e0a3f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209925, "uuid": "3a002fa1-4de5-4e71-ba75-a8158dc472af", "comment": "Malware payload (RedLineStealer)", "value": "de673ad8842555b55cd17e7b014108f976ea0396bca46cf05b095f9bd66288f1ecfaf46d43c699d39348f3d5448b115f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209925, "uuid": "a3def834-a434-44df-a69a-e4af32417317", "value": "T11AA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209925, "uuid": "de6b52a0-0cab-4830-a119-6f942ba8827a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209925, "uuid": "36cfa79a-c733-428e-936e-30ea3acb3cf4", "value": "1536:5qs+OqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2hteulgS6p8l:XRuOYj+zi0ZbYe1g0ujyzdt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209925, "uuid": "d7b7b469-2bfb-430d-b1d3-0b101f9ebeef", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209925, "uuid": "d91b0428-26d9-4d9e-a6a9-f7741ea0f1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209925, "uuid": "ce738589-e4ed-4ef0-af56-4618a4efd4e5", "value": "a67d19d9b405b831224b8ac61b732c3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee482f7-45a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693228732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228732, "uuid": "184ca871-f955-4939-9c29-784810839b67", "comment": "Malware payload (AgentTesla)", "value": "3ee51865b6b88f20c8b8fa83560b6c2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228732, "uuid": "69529e4b-d4bf-4b28-a1a2-5d5d36b385a6", "comment": "Malware payload (AgentTesla)", "value": "e44c079482925433f0044a1482ce5247dc6fadd2b83e4bcaf0c20c0942c29313", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228732, "uuid": "cb9dad26-bf53-4414-ac89-55cb9e7fae28", "comment": "Malware payload (AgentTesla)", "value": "66f77e610b288c772411e9952836117a2d202211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693228732, "uuid": "d52bccdd-3543-4070-b810-eb8d79fa0a4e", "comment": "Malware payload (AgentTesla)", "value": "a01859f7ad56db38ec9dc5cc6a7fe736d87371bdcbcd24e1f5619367069263d6c56214eaf5dc74a46c03dbb9920eea6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228732, "uuid": "0c117db6-89d2-4c6e-ab07-a9c4b971f3b6", "value": "T1876418AF3798810EC89E13F8D444495ABFF3C2CC7297B767749616B89823764A9C3253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228732, "uuid": "bfe21c06-c693-40e5-b677-81f13e0c2e63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228732, "uuid": "4a2eaf8f-5b2b-4f28-b976-90de203b0ea6", "value": "6144:dKPgSV00rnY7FS6cKn7kLEsdKkmCQfmnil+151nm0twT8rqdc5D9FWJpVjYH6:dKba0rnA1cQ4LCwQZl+15Ri5QDMpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693228732, "uuid": "b2bd28cd-e6b7-46b9-a7cf-353fe12028ab", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693228732, "uuid": "af9077ca-c57a-4244-a861-a03427e08c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693228732, "uuid": "e73e2d3c-c5a5-42f1-ad48-12ab17158ae6", "value": "New Remittant Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28776f02-457d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1693211434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211434, "uuid": "e6d35e68-cb09-4010-98c2-98af4aa30f6b", "comment": "Malware payload (ModiLoader)", "value": "9bf263c8a5d06fba9b3cf486c2ce3cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211434, "uuid": "027273e1-19b1-448c-972d-7ea57c8bce1a", "comment": "Malware payload (ModiLoader)", "value": "e4688b491eef2134a09a6c4061071f2de9d71df4c07f0aef23aef84f51688d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211434, "uuid": "b5fafed7-d049-4211-bf98-cdfcbf314377", "comment": "Malware payload (ModiLoader)", "value": "c9a40478befb4d3e03c56148cffd4cd197759e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693211434, "uuid": "19a4660e-1f47-4aa1-bdfd-3d21bb50785f", "comment": "Malware payload (ModiLoader)", "value": "f8a87fcb6146d9e988e7cda8386b071802ad01735ca32750b87584adbebb087ab39d523f6f118cb509751cee71a8e5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211434, "uuid": "194b5416-57d5-4efd-b86c-97c3525ecbc5", "value": "T1F145D026E3B18837F03359388BD786E49C2C7D617904AC4B5BE8399C5F3A39178591AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211434, "uuid": "6a7d2d71-4838-4026-b0f8-f4ab390806fa", "value": "114f57eaa448137f2523bc685071ac0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211434, "uuid": "cb63f3b1-90b5-4406-8665-2309634b035c", "value": "24576:Awv/h2d7P9f7zJDleuquzXUQu+tkGdKiNd:Awv/8VzS3sEQu+/EiNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693211434, "uuid": "3cd13c99-5cd2-47ec-a8c0-250705a86432", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693211434, "uuid": "1d49388a-6c62-4ee0-a572-f90c0a8e73fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693211434, "uuid": "b8ab92be-a18c-448d-a5dd-1f04dc6e70c0", "value": "9bf263c8a5d06fba9b3cf486c2ce3cc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1620c2f9-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220852, "uuid": "0c9c988f-f093-4fa4-842a-217855c70e3c", "comment": "Malware payload (Mirai)", "value": "f3939df7c8d5e62b55da2255ed7dba28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220852, "uuid": "b4ee670d-aaef-4e15-9d51-1eb2491bf2b8", "comment": "Malware payload (Mirai)", "value": "e491afce41c067f099eb6775e3bbd8ebf2eaee658eee81136d81f14d41474750", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220852, "uuid": "726e2fd1-74ab-48eb-97e7-66823269be10", "comment": "Malware payload (Mirai)", "value": "b3f1d3cad3051dc715a516192209e14d2211a6f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220852, "uuid": "32f60f45-7fdf-4aa5-9756-09fe34b6bf84", "comment": "Malware payload (Mirai)", "value": "390bd00e9c993f91573885564e9ea78357510af80a2b6da2c3bb04162ad523f6bee99aa0fff971829f16d9bcab2d2689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220852, "uuid": "2cf38c2c-7b9d-4f0c-839d-dfd9bfa5e8ef", "value": "T161B2DF3461A960F0CD30A438F87EC987E7AA41FDD0FD7B21366750E85A9688D1AEC5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220852, "uuid": "c148ccc9-b66b-4037-b88a-1cef3b5b40f4", "value": "384:6oBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1RB7mYg1hymdb:maNSq5sOHpTqncvsdDePiAUgefoeDeX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220852, "uuid": "599c4dfc-5bc0-4b90-b164-fea677fdfa55", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220852, "uuid": "a7372802-1cb9-428f-8807-caa29cad72f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220852, "uuid": "6a147034-991b-438e-882f-67549f4d5a30", "value": "f3939df7c8d5e62b55da2255ed7dba28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dec7e2-4580-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693212853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212853, "uuid": "a2e5360f-bf4b-422a-95de-02d8ee054710", "comment": "Malware payload (AgentTesla)", "value": "ae154f56acce28a47e742ebecccd0729", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212853, "uuid": "9ebe409f-3a15-4bfc-b193-998b6446a156", "comment": "Malware payload (AgentTesla)", "value": "e5a6b7511661e04fa6619b9696b23640b0f9ea329313941800768e1d802a2b5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212853, "uuid": "c9251165-551d-4ba4-9df7-ab666bd85914", "comment": "Malware payload (AgentTesla)", "value": "33b13c3c0e8d920df387504f617b8eca9a420486", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693212853, "uuid": "bef24f91-497c-48e7-a9b9-a63e25219ec3", "comment": "Malware payload (AgentTesla)", "value": "6e12f46f758170b760db7e881d065e195b2d469767eb089f9dfc1c71a68615d4a93d452cac4942603ae2caa88e69fe89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212853, "uuid": "328489e3-411d-4383-a722-b54b4de29a68", "value": "T108D423E8F5993228493057B73217C90FBE195CB121596516D5A092FBFC2B37FA4AF0E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212853, "uuid": "0da8addb-9972-42a8-ac6d-bdc996d016d0", "value": "12288:q+UezMkly8ouZaLBrzafP2QGuTUiiu8MjLFI7WyngXxsSNm282EkEf:q+UezMkqL3uTUiiuTjLFI7VsNmnnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693212853, "uuid": "9e67dd5b-ed65-45fa-81a3-213febd7763f", "value": 601481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693212853, "uuid": "c181ac81-9eec-447d-b95e-b29163fb666f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693212853, "uuid": "1051ff4d-4aa3-4ecf-bd2a-d25db80e89a2", "value": "140X220 424-438 300sets.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93564ff-459f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226360, "uuid": "9aaf6f13-b130-44cd-a868-5253e4b9156a", "comment": "Malware payload (Mirai)", "value": "5761c995a97ec18182735b0a9a212c8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226360, "uuid": "491c9bdc-be82-4fc2-853f-9ce8d4605ab3", "comment": "Malware payload (Mirai)", "value": "e5ecfaf0748a36b2385ed21a490451b31d2e7739b22b68a97bbfcd951e9b26e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226360, "uuid": "66722393-b2c2-458f-9d20-e7809415659b", "comment": "Malware payload (Mirai)", "value": "5ba684f8a111181702824168e20b1a9b20abf6b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226360, "uuid": "96c9a21a-bda9-4c5a-9b76-39662bc7109d", "comment": "Malware payload (Mirai)", "value": "43380e81e077e182a1150fceeb645a847cdbc0ac434fbdfe43d63acb661d6cfc20c6f59c43d5224e7ae748bd4da9694e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226360, "uuid": "97c202ce-a587-44da-87e3-b509975b79e1", "value": "T153E2F157C3729092DE786AF2F97D85CB2ABC4B6CD13B30A3161556283E9E0535E3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226360, "uuid": "61f87c56-5545-40e7-afb3-34094f2af382", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XLGV0S49q3UEL5IO:1orm1vpALgUJCKaLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226360, "uuid": "b48f9578-4bce-4a8a-a879-4d62d6abe7bb", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226360, "uuid": "ad26ca56-a40e-4fbd-91f2-2a5a55f1c38d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226360, "uuid": "60ff51c5-46b3-4eae-9b4d-e9141dad7322", "value": "5761c995a97ec18182735b0a9a212c8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2d02ee-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226691, "uuid": "cebd0fd3-1f74-4fb5-b2e9-dc3ff4a1abf7", "comment": "Malware payload (Mirai)", "value": "e91046f0e50792a8df8a60d5a1358878", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226691, "uuid": "85e2d8db-dc21-406b-a7b9-f8986ecb1a90", "comment": "Malware payload (Mirai)", "value": "e90099d9abbf7921cc6f37397ea854e7fa0cdd844db4e1c5d8d0f25ae9e7cc8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226691, "uuid": "309b6fcb-ff9e-4804-a134-eb6ec8163576", "comment": "Malware payload (Mirai)", "value": "e5e5d34b5ebd3a8e7e3ae3c8c631063378c19a5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226691, "uuid": "e91bb401-7d05-41f1-8d6a-abf370f25a96", "comment": "Malware payload (Mirai)", "value": "3118af9a003efc39779a7fd915f9817dd660fe85d9a5cf7c8abf80128e23ef25883beeb84644a6cfee221d6fdb439a26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226691, "uuid": "d14feb98-cd28-4fc6-99e7-640d498441d0", "value": "T1BC535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226691, "uuid": "2b0e0182-358d-45d6-9ef9-6562413587f6", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8l:N1GjR8EVGOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226691, "uuid": "343724b3-c464-4ea2-a93e-0094bf085254", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226691, "uuid": "1d4e4083-b6d8-42b0-84a2-e27d92573411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226691, "uuid": "6f4cd66e-1b49-4666-b1fb-f2220d17d6aa", "value": "e91046f0e50792a8df8a60d5a1358878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc8c2f4-45b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693237351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237351, "uuid": "79aee9e1-22ca-4072-b23d-2d88f99dd0bb", "comment": "Malware payload", "value": "b7a1301dd54c78360cbf17a2f99d892b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237351, "uuid": "53156f86-ce1a-4f90-81c3-d3dfc4d73542", "comment": "Malware payload", "value": "eabf22a7e928181c8c1cac26ed548cdbc139521e4f5c0ead50faf4c4b51b4eff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237351, "uuid": "992a3928-aa2d-48ee-9b77-5b9c83725907", "comment": "Malware payload", "value": "92d85f08f513a61dc3bb139caddecfee4be64735", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237351, "uuid": "f5c13aa8-a3dc-4491-85fe-f48e72e88f29", "comment": "Malware payload", "value": "5b6ea3265beef802dc9bd1c61170f61fee0493567ca1d662dd298ad39808962ba835e8046dca7cc6ccfe7fdcc8442e40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237351, "uuid": "7771b341-bb7b-47b0-8cbf-5f0211f60081", "value": "T1D26633FC03699472C27ECF7CA841145A9485ACBA5D9F1D27DEEDE663603CAE68C24C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237351, "uuid": "dd6a08cd-37c9-4de4-8b3e-aa35e23f2400", "value": "196608:hVnscHKl/49/VDsbL7lr1dSuVWfOdcE8nE:2w9ib1ZlVWfOdyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693237351, "uuid": "15c10013-f33b-4f64-ac05-4f566a029b19", "value": 6727416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693237351, "uuid": "5f5d1b8a-68e7-4e18-a057-99cb531fbb5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237351, "uuid": "33eab10a-05de-45e9-9ac3-e199ae8f4873", "value": "spirit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bc1814-45b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693237126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237126, "uuid": "eb99b4f0-5d4b-432f-b588-010cb73d1178", "comment": "Malware payload", "value": "eee0836b7e86e19c5d090c23b7014282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237126, "uuid": "39034179-9485-4f58-b21f-c6aeb797f22a", "comment": "Malware payload", "value": "eb4f2de4089ecb8da49febc02ff2ef37a46191fe11a39a33e4389125024a0bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237126, "uuid": "2642bfcc-b454-4f8c-a639-e7867da5d479", "comment": "Malware payload", "value": "7decf13272c0759c905aebcf8c077b905ec277c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693237126, "uuid": "338c8dd7-f870-47ac-bbe4-89388818398d", "comment": "Malware payload", "value": "b80c7e586e6461b9ac37b1291f154190f3d3c122941e1f63717d6af50fe6e2a8d8785ca038e515a0e867781e4bcbce86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237126, "uuid": "a567d774-a0c4-42ca-8849-285da1f9340c", "value": "T17F72090EA5E84115F7F13835553AA6078DBFB9731FA1FC9FB740A1E104B0296E0B165B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237126, "uuid": "320709a1-d49a-466e-a860-9823e0b7e84e", "value": "ae971e65730355f0f0eac3a76c8927c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237126, "uuid": "65a9603f-1c97-482a-aabe-78bb8ac28a5f", "value": "384:nY0LdrV5wuqfyR13eiCi6/////7s/3S0z3jgGUTJMQ9+UByPQ+VXiRtP:VLdrluyRxki6/////7s/3S0zTg3TaQQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693237126, "uuid": "89283c1b-ad1b-4e1b-9aa3-d5604bb1b7d8", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693237126, "uuid": "87866f7c-f975-476b-b773-03f18ccd2af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693237126, "uuid": "5de78d2a-5cbd-438d-a8ce-409cd0dae83c", "value": "eb4f2de4089ecb8da49febc02ff2ef37a46191fe11a39a33e4389125024a0bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25752ad4-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266405, "uuid": "1a7d7584-b42b-4590-bf0b-2330f62f1acb", "comment": "Malware payload (Mirai)", "value": "a66a69e2893f2e6ad457e911e3985044", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266405, "uuid": "c4bef867-fd17-426e-8672-c459834f21ac", "comment": "Malware payload (Mirai)", "value": "eb5b6d72aaf6149a3f281341d0a66e63ab637041df71a23bf4433a7b8ddca476", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266405, "uuid": "933997ea-36f1-4c0e-a23a-c6c8d9354298", "comment": "Malware payload (Mirai)", "value": "c823146e3c9d7ee6f5d26758d80874dc0caf0c52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266405, "uuid": "d5d736cd-8fc9-4ceb-a64f-f0a7bf090f90", "comment": "Malware payload (Mirai)", "value": "b675eed2d3b7e90f907e5da5607090e39b5074f69f155b84042e2b07408de5665d962965f12798ae46729aa01b2c32dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266405, "uuid": "0c895828-a7a8-43bf-be00-d7481d187ba2", "value": "T1E4E2E130533FAC72C2727C37E02989C6759686BC866E316606D2534C2DA7A271F7D9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266405, "uuid": "615d2095-bba5-444a-acd5-8282fbe57168", "value": "768:+W0tWhUucTFUOiwx/Njo48U/GaVSUmf/2wVtFcJkS9q3UELw0:+WqIUucTFUPYN8JaY1tFUsLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266405, "uuid": "cb60c6e4-b6bc-4abc-8032-ea3e5b8b007a", "value": 32160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266405, "uuid": "5c619594-56fe-4c3b-92a4-4001f3b9aa56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266405, "uuid": "5a8201eb-7835-446e-8c44-dda9f786fecb", "value": "a66a69e2893f2e6ad457e911e3985044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407d9790-4586-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693215340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215340, "uuid": "de673b2d-5373-49f4-9a54-08eb3b60c95f", "comment": "Malware payload", "value": "724d683ec3a3cf152fe54b1751c4735a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215340, "uuid": "4a6858f3-d871-40c4-b38f-c03abbe9d3ab", "comment": "Malware payload", "value": "eb7e2721eadd20a0f23742a93bc94cbcd967b26d929f8757e73cd01e81d20ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215340, "uuid": "4a567abc-9710-4d63-a40e-988226607653", "comment": "Malware payload", "value": "9a2b4dd2f90601b734a4e6ee6b3bd4f45f7ffd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693215340, "uuid": "77af15ff-a462-414d-94f7-fc5a1f899407", "comment": "Malware payload", "value": "ac9e184c8ed3a485a30ea55eb12499002f8f6601af8a7b8b6e1067284f2935d181cf3fb8d1b5ab3b2fc478b5a32c8222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215340, "uuid": "242a74a5-7aa1-4a45-a64c-63c9b16eb2d2", "value": "T110C41221CBF79835E8C0B07AD4D61B1DEBC108BAF416D5FE259F1952080327B96E372A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215340, "uuid": "4a877596-b647-4177-9c11-e3d44374db67", "value": "12288:Dkfw6qdWKJEY5ZRRfcIgZcF09uGF24T0VZjPEv2IR7vv:Dn6qdlE0zRfcpZcEVF2l1Qvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693215340, "uuid": "cd3dc99a-b6e9-42e6-91a6-7f9ef690a972", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693215340, "uuid": "e3aeaed3-d485-4c15-a306-4c13a51543cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693215340, "uuid": "b74465c9-b24d-4f98-a0f5-dfeeb2e12bde", "value": "724d683ec3a3cf152fe54b1751c4735a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209d85e3-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693229889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229889, "uuid": "68422301-1356-492f-846b-68dcbe35f170", "comment": "Malware payload (RemcosRAT)", "value": "57b00a449fc132c2f5d139c6d1cee7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229889, "uuid": "53feeb52-f922-40b2-a1c6-869fb958b5ba", "comment": "Malware payload (RemcosRAT)", "value": "ec901217558e77f2f449031a6a1190b1e99b30fa1bb8d8dabc3a99bc69833784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229889, "uuid": "628639f5-789e-480e-aa5d-ff0716b5e7bf", "comment": "Malware payload (RemcosRAT)", "value": "560877ab92f78fa0aef8bb846674cd4e68729b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229889, "uuid": "938ca1ae-1455-417d-9b0a-2b4c004a5e89", "comment": "Malware payload (RemcosRAT)", "value": "617eef2605e9d4d59e2e4f582b415477a9d44d6eab860e5964167549d4e7c80ae0b6d09143f7746fb238dfaf939b6d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229889, "uuid": "f7d76bc1-ce7e-4c0d-ba0b-2d4aeaf5b8f6", "value": "T185151223FB01DFA9D13983FB7C1586164662EE1E6C54D368A8ABB6E21C31703847D71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229889, "uuid": "60aaca0b-0c19-457e-9d95-009286de4ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229889, "uuid": "be130ecd-111d-4137-af24-3f8007240cf6", "value": "12288:y6WJp09ESfsTNmWdUwx/FDuDu5gXTgdNxXiHjMerygN6S58OpfsovNIh9CjnJ6QX:y6F9EOamWaU/z5bdNFiHjH5pvChI0R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229889, "uuid": "71e44825-0ffa-44fe-b8bd-ddc3ac1e0d96", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229889, "uuid": "83e16ea9-bb39-4f9b-9585-810cf12344a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229889, "uuid": "3f26844a-f161-4aee-a226-9ec76ef74518", "value": "SecuriteInfo.com.Trojan.PackedNET.738.32297.32442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0715fdf6-4593-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693220827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220827, "uuid": "2fa312c7-054c-41d8-b026-434ecebc89aa", "comment": "Malware payload (Mirai)", "value": "9558fe7db38db1cb255ba2aeeeca28bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220827, "uuid": "dac37f54-e1af-4af8-8ae8-87f349e46885", "comment": "Malware payload (Mirai)", "value": "ed0fc205a34d8bc5f8704eb3760b0e71748e75680e8c4d9696b87522a4e3006b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220827, "uuid": "455ebb54-6c06-4080-ae0c-c8778e869b5e", "comment": "Malware payload (Mirai)", "value": "19454a58b814e90a11a39b377789d56611b195dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693220827, "uuid": "b0efa075-7111-4b7d-9117-596c3fbca5bd", "comment": "Malware payload (Mirai)", "value": "1f33bebef915fe0bcae74184a8ea80e111380f73e09bc7ffdf654cc7df9486c254a814524268e22a08618c01b777279a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220827, "uuid": "9d482ffe-b29d-478e-8f3a-f9b148f9f2c4", "value": "T1E11329C4F543DAF5EC02057130A6EF329E36E1FA2259EA97D3E8D532B852502B507A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220827, "uuid": "dddce729-4a14-4600-89e4-eef7e6f396dc", "value": "768:qz9XgVXwDuF7xk4HA6jdsEd3BqmD44bfiBRAVS7pP1zZPHGoBBqF7:qz6ADuF7xjg62MoaySSNNZPHtBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693220827, "uuid": "59c465f5-16b2-43e1-9e6a-287522c7551c", "value": 43888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693220827, "uuid": "c63c914c-dd41-4c3d-bf5f-4d144fa1e1ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693220827, "uuid": "b416a750-5ad4-48a1-aa4e-af9cf92dbbc7", "value": "9558fe7db38db1cb255ba2aeeeca28bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1856b3-459f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693226390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226390, "uuid": "dc8ef758-9cec-4d25-9100-37d8317884d7", "comment": "Malware payload (AgentTesla)", "value": "e8a9c8e73dc876371ca7fbcab5c83b3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226390, "uuid": "cf5d9915-106a-4c8c-95d0-99785282bd4d", "comment": "Malware payload (AgentTesla)", "value": "ed330c5047a23fc092b5700debf0ed142fb0e83a79b75a26ab7847b13b8603a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226390, "uuid": "d091fe83-aeeb-4660-9844-60485ccd7f5e", "comment": "Malware payload (AgentTesla)", "value": "326a3ddb12648a12b1a87e754024e400da48c868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226390, "uuid": "69dd8eec-ce2b-45d2-ad65-5ab3e28247d0", "comment": "Malware payload (AgentTesla)", "value": "f3cb02dfbf7aa26ed586a43e577dbac0be1d2a8282876b24b6210417e187cf67bba8d0d6cb84c7a638be4e5fb1823151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226390, "uuid": "5052eb43-85d5-49a2-bc22-93c7635ee412", "value": "T106D4237D222F4EB1EFAE5864D94F3F27671C334845A0D6313C7B9A2E6BAC315544EA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226390, "uuid": "ed70b9ce-98cf-43f7-a849-f03b24424b62", "value": "12288:cZG7aIOVB1muW+/4XESXhWVlQO5JTxSogpBNdqPwT/5ri+ksMQ4MbCVI:F7aIQ1mA4XEshWVlZJTxSznSPwrFi7sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226390, "uuid": "85d9d0d4-c2dd-4076-b861-6ccc08f0f99d", "value": 654108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226390, "uuid": "c4664b47-b557-43df-9675-8cd9939e214d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226390, "uuid": "e8905311-652d-48bb-ba11-8686f3d436bf", "value": "DHL OVERDUE LETTER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a314779e-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226672, "uuid": "5060fabc-1bdf-4f73-b58a-4011d5e6d1ea", "comment": "Malware payload (Mirai)", "value": "5e58ad73b33fd6dc46b08c4680a732a6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226672, "uuid": "e2f4abc0-fa7c-4547-9d27-e8d4b71c3da0", "comment": "Malware payload (Mirai)", "value": "ed9a08cff1808beb5734fecf092510d8d2b7c628b7f9bd10a2269480f1629fd7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226672, "uuid": "cbdd9f7e-50a5-4b39-8ae5-45150846a909", "comment": "Malware payload (Mirai)", "value": "df6572ef4a500714c138109d70287720f56f53d1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226672, "uuid": "55089946-12f0-420a-a74e-e620d9688cc5", "comment": "Malware payload (Mirai)", "value": "7e3c32056cfdeb7c67c4588ea81500b8c8eac3ddcb256114781a506fa5a1db3baaf71b4002d3c7d65301a78bf69f9379", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226672, "uuid": "c3ed81fe-8921-4b64-ac7b-495af8a73a7d", "value": "T166D2D0A985E7F1B8D0E666B5003E0684FD76B216D1160BB308FD2076EF571D90E31EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226672, "uuid": "dfd65e08-7432-4336-8734-4b6235c3187c", "value": "768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qB/Sx0sG:kYJdJZiy1aBnQfTqB6tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226672, "uuid": "7a3644ba-5d50-4773-8202-1d62a16f6946", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226672, "uuid": "08b7fdaa-d9b3-4e1b-8206-28802cdc5fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226672, "uuid": "511098df-244d-4439-8aed-a32f84a996b7", "value": "5e58ad73b33fd6dc46b08c4680a732a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff4e72c-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183717, "uuid": "b645b4ad-3504-400e-a827-f920ca7db0b0", "comment": "Malware payload (Mirai)", "value": "76450bb1f0a06cf57def18299a9b274d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183717, "uuid": "a64adda4-04c8-4acd-8b74-12f25db113e1", "comment": "Malware payload (Mirai)", "value": "ee1bec4156dd3c2b4280b6ea36545e13bdbe62bc75177c259bd51c74374f0f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183717, "uuid": "6c7b2ac2-acfd-46b5-9aa5-8511a66f13cd", "comment": "Malware payload (Mirai)", "value": "eef164e46fd0b453e2b48a2ae1f3cb1a1a40f9a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183717, "uuid": "548f9d52-dca3-4b5a-aed0-9b74bdfd5a80", "comment": "Malware payload (Mirai)", "value": "03e3dff4b37ccd2c989fafcfc8d8e141d4d820fb88fc946f59b59910ed7c653ea0f286f5360ba568add0e09f2a96f872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183717, "uuid": "362024a0-260a-48b2-ab52-83a102e13c39", "value": "T19FB2D1E4C6A19706C6B0B435A378CFD35A3B15E4C5F738172B2092AC968245633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183717, "uuid": "13a1e0e6-015f-4381-a50b-60ac5a6abb27", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BNwKhymdGUop5hu7V:4GHKQFH0rs3zWoDDRsjt7LB9U+Bjs3UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183717, "uuid": "57299d95-888b-412b-afdf-cc42ec4f3c0e", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183717, "uuid": "21b2494b-1aa8-4007-8652-1e055d6b799c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183717, "uuid": "a42e3ce9-d4d0-4495-9ac6-5b8aa99f3286", "value": "76450bb1f0a06cf57def18299a9b274d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b6b63a-45a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693229386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229386, "uuid": "30b952e6-1183-4268-8240-07128eb4d5e2", "comment": "Malware payload (AgentTesla)", "value": "760450f45a50f464b709a4bcdff0cc9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229386, "uuid": "1427d405-c5b8-4f02-9768-893285d51ad5", "comment": "Malware payload (AgentTesla)", "value": "eee873fae72e61e77aea49b377c6c8faf355e5521be9e8d4c1db6082542e155a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229386, "uuid": "601b253b-411e-440a-aced-2fdd8a3c8373", "comment": "Malware payload (AgentTesla)", "value": "f79c939d7ad793c45ab162c8f169756f2580808c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229386, "uuid": "fbbab5a3-2758-4991-9598-fd1d32a2223d", "comment": "Malware payload (AgentTesla)", "value": "5fea404069b3744765b731efc47767c26762f613fefbedda9d0093fef018ac062aa08ea042390b48d1082f0a22379bef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229386, "uuid": "d3384c9d-4cb3-478c-b2b6-1da5aaad5c81", "value": "T146E3221626CD1F30F6F2A9E5D582DD4390A28ADD194C09EC83991918DD1BFE039AF37D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229386, "uuid": "2116a960-2229-4749-aaab-ffd90f2c208a", "value": "3072:5TrUgs7acFR6hbXKkwDBC95wjlZl9+PtFg+xmOjYrFnwoGqGfXPQ0:psqFwDNj/lWt5orFnDjGfXPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229386, "uuid": "ca8991e3-b25f-4ae8-9da7-bcf8955e5be2", "value": 154400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229386, "uuid": "6b0aa628-c227-4898-b27c-86c39d6dd3cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229386, "uuid": "32829aae-249b-47ce-b356-54a853f9190f", "value": "sat\u0131n alma emri.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b59046-4577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693209193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209193, "uuid": "82bff3c7-63f4-4976-bf83-fd70e3330067", "comment": "Malware payload (Loki)", "value": "1d6c8c56fdda74ac240de6d54f61edc3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209193, "uuid": "eb1d99f5-152f-443c-9bec-0944f5d0e737", "comment": "Malware payload (Loki)", "value": "f15bb771826e247bd7eb883cb819ef7b9b6414c250c23581171c3bc96480c674", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209193, "uuid": "317b7306-8edc-4e0a-97b0-7e20f152324a", "comment": "Malware payload (Loki)", "value": "3bcd96b72a60208f1b8a3e40d9a3786ee47d7a1b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693209193, "uuid": "e81a01ad-8676-4788-8d1d-bb5c60a840f0", "comment": "Malware payload (Loki)", "value": "d0f7f6c0ecbefdff3f8538edbfc95c0f426d8cc292721bd4373621217034d2f2b8037362240bf635a2d27f143187dd7a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209193, "uuid": "229d5a12-c7cd-4d1c-830a-373e24f62b3d", "value": "T139F312F935C9B415B9CD76D422A3ACBEE0AA3FE41CF1321055D07F81C865AF25C8AA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209193, "uuid": "a8834ef4-4def-454a-8ddc-b11961ded8d0", "value": "3072:MS5uEF+pmthR70QOJpxiTr2AZrOAzOaYDpudnaaGJuAEYVP6LsPLfNlhp91PR:MS4EEW7HOJpW2A1ddny8AdPoIhtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693209193, "uuid": "33ac5075-4fd0-4c51-bc89-312164106342", "value": 171051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693209193, "uuid": "e5a26111-3aa5-447c-b6e3-398807f1752c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693209193, "uuid": "efed349b-36f2-40f5-91e0-b4ee0101a85d", "value": "QUOTE 705[2].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c0891e-45d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693249554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693249554, "uuid": "cd7bf3d8-a6ea-4002-a57c-78d35485c288", "comment": "Malware payload", "value": "5de4c3c0ce0e241c76fbb11b625c08fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693249554, "uuid": "7e449929-c45f-4c6d-a5e2-d65734eb3356", "comment": "Malware payload", "value": "f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693249554, "uuid": "8964b16f-935f-45c4-8523-d1826d8e2647", "comment": "Malware payload", "value": "9e88306ed91920dbd269f34031ec3eb6913c77e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693249554, "uuid": "b2a848e8-71b4-4af8-b638-0274f25723d8", "comment": "Malware payload", "value": "c629b3e3bee86579d83cf89bfc3e74aaa311cd64a3dedf7201f29bdb2fc89112189df612d8fb7d5a03d7c25211e3b962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693249554, "uuid": "54aaaee3-f949-4098-8efb-fcedded70e9c", "value": "T15B2733AA2D637430DDCED2F56FB088CDAE6097DB8119FE8B591340F95D8B14A6027C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693249554, "uuid": "787ae3da-a6f8-4ae9-b252-bafbea667dca", "value": "ca4e65ef48cd8fb5249e69100e9eba9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693249554, "uuid": "fa02cb22-ff2b-4a7d-9f4d-7dc5bf144406", "value": "393216:yNqMfrP3DdxTKbVqJHI/GggKXIP9OzLbmPpmt4HCmCi+3ms5KrXBF:2Dvdxm5GI/vdw9OzLbmPHH+36rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693249554, "uuid": "40cd7696-1cbf-423f-a202-88e70950a2f9", "value": 21643797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693249554, "uuid": "34242b85-a727-4c63-a1ea-7947cb99bde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693249554, "uuid": "b43b5483-13fc-4294-bad4-69d382dfafd9", "value": "eqd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c8dcd0-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693233306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233306, "uuid": "dbdaa74c-3835-4824-8467-c6a9544d290d", "comment": "Malware payload", "value": "9b923121ad1244d345df943031e39b15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233306, "uuid": "154c92d4-92d9-46cb-ae1c-525d76759891", "comment": "Malware payload", "value": "f2c0d154b30cdf7919cae092f2dc9973e7585353cf20d57f15bba3276dd7b86b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233306, "uuid": "242705f9-0785-46eb-b6a9-166025d5658c", "comment": "Malware payload", "value": "1049182a6d476a53ee7f838af8e6e521de3785c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233306, "uuid": "49966d20-3cf9-450d-97ce-e0efe03383d0", "comment": "Malware payload", "value": "067bdbf10991dd61c5df9def6845e270baffa7a207e8319a0d180aca9c65215917b4cc0bc5deaa7e18c0db8a02574310", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233306, "uuid": "a7d08505-bd69-40bc-b613-19d03b93d059", "value": "T11F738E45B5D1C871E67E19316464C6A16B3EB9124EE19DAB3B89023E4F313C0EF35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233306, "uuid": "1af705d1-8886-4c55-a500-379a7c17f976", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233306, "uuid": "55ca5b17-0870-4055-8c7c-de2e37954aa9", "value": "1536:XNEi7fdKoQocShCBPFvh2X/ciZceSsWfcd5v4/uLuI:dlQoQocNBPFvGek5v+2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233306, "uuid": "6412021b-c307-4cab-b840-3c96ba36bb75", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233306, "uuid": "d935e59e-df31-461d-9ee9-164287d888b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233306, "uuid": "53654369-06d5-40b2-985c-1cb449a06fc4", "value": "SecuriteInfo.com.Trojan.Loader.1704.19595.10851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ada78f-453d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693184029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184029, "uuid": "38290c8b-9d70-4760-8a60-d7a9c250e4cc", "comment": "Malware payload (Mirai)", "value": "0ad7011a521876f889137684dd35775b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184029, "uuid": "7b2f9a18-a6fa-4bd4-82a6-7a1237a39e6d", "comment": "Malware payload (Mirai)", "value": "f3898ea0c2f458bb1ffbae7a57493fc4fe66f1ade1ac0b962b417c18447f2323", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184029, "uuid": "a15daf59-81cc-4f70-b7c6-a1a0ccfc6ad9", "comment": "Malware payload (Mirai)", "value": "0776b258bc7317582be26f50f49e073ae2a92411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693184029, "uuid": "de307fe4-dcb2-4508-b0f1-ad1eb7eb9d30", "comment": "Malware payload (Mirai)", "value": "ac08ff789a59559371c1794f47baff87d4ca3d9e7dc5bf37773cb693aa07a6d1e5b2966bdbd90b2619c215f90550126c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184029, "uuid": "0fc5f8d4-5fbd-46ea-9d1c-dc4a5eca4f17", "value": "T1ACA39EA394256CA8C131467868FA8AB01333ED1041575DF666E7893D504BDBEF73C3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184029, "uuid": "537136e8-f312-4a7b-a0e8-23fa5fe72f29", "value": "1536:yacwtUz77le0a9sAuOT6SsUi7MKUlmnl+LRCUfVa2bX1Si+LSHF:yrXe0aPumVi7TUE+LRdzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693184029, "uuid": "720a677c-1ecc-46cc-9884-34f6b64d726d", "value": 99828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693184029, "uuid": "7ca79c98-882a-431e-9484-f4a2e461c3f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693184029, "uuid": "43eb12d6-e713-436f-bd70-5a910e252b4a", "value": "0ad7011a521876f889137684dd35775b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18e4514-45c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693242158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242158, "uuid": "92cfb149-91ad-4004-ad45-f3e8d9fd490e", "comment": "Malware payload (Formbook)", "value": "0ecb1b6a3d685cca1c3e93880787bb58", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242158, "uuid": "56a9dfa9-8286-48e3-834d-ddaa5156ee55", "comment": "Malware payload (Formbook)", "value": "f3a9767ed1de9ec00f8a260da650b3b0fcd63b96ce3406f4a1843dcbeb5bf034", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242158, "uuid": "96b4988d-aaea-4b27-b0d2-378e50318be6", "comment": "Malware payload (Formbook)", "value": "1a7b4cd8c5b413b2c63207f303274645e6f9a442", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693242158, "uuid": "3bba322e-fbfb-413c-b5bd-ecc5a6f7721b", "comment": "Malware payload (Formbook)", "value": "e9ed07fe00244b20f0d28f37fc3828a1c272733c3045e74e52c10bb509aec3a5aa9575b3db786e5b10dccc5fca4cab7f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242158, "uuid": "209f33d9-9569-45c7-8bcb-6e0dfe0e9b55", "value": "T1DA45121027A95E6BFC6897FA05759E53033573B8A138F7DF39EE90C84B2A341C610A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242158, "uuid": "05421486-68a6-4b47-8cca-66f1983655ae", "value": "12288:el2d04ufPnTWNpbRzAgbj0YH5xYazlEyW4H5TP2WrcFmkXzXe:1d+fPnep1Agbj0Uoom45qEcNXzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693242158, "uuid": "94d7d9a4-23cb-4079-80a9-da64f3718f1e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693242158, "uuid": "b7354dbb-e629-45fa-8987-a795876318be", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693242158, "uuid": "47366298-8daf-43c6-8ff5-66567b6bec9e", "value": "PO23043-WT0540500856808075.PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354338a6-45bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693238084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238084, "uuid": "bde82b68-f751-463b-9541-0b7a9c3dffaf", "comment": "Malware payload (Mirai)", "value": "fe27777689566d6765037ce35991ff05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238084, "uuid": "93d8c74c-4570-4c88-a15a-05254a942446", "comment": "Malware payload (Mirai)", "value": "f42a31f5e821de2a3843a0a4eb0d3f422b0fff02ff1fb87e8cadfacdf9ee6462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238084, "uuid": "1bc209dd-ecb8-4a70-a564-8c84a567ce96", "comment": "Malware payload (Mirai)", "value": "28c5262e5373dcc026832000340b8fea8a0d544a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693238084, "uuid": "d3cd5045-16ea-49d8-a319-bef0fdfa4c17", "comment": "Malware payload (Mirai)", "value": "7ecf4da23edaeea40e8b1b9bd32baa0bf7a3204e3998d4fa0e3460821953672f9c272fcb32adffcba993510ec62a5c1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238084, "uuid": "2ed2d106-77d8-482d-aead-fd902b11121c", "value": "T122735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238084, "uuid": "9d24e73b-6bcc-49af-99cf-8fcb7b5c69a0", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8/:YwfdNu4cmZvFqI3w7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693238084, "uuid": "93f83f16-a698-4817-82c6-ad43f3dab194", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693238084, "uuid": "73afa81c-a919-451e-b184-6f368e2486c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693238084, "uuid": "e1bcedf0-3bca-4e26-b013-8955d3cb065b", "value": "fe27777689566d6765037ce35991ff05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a2fd4-45ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693258553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258553, "uuid": "69f67329-5559-47c9-bbd6-8bd3b6026f71", "comment": "Malware payload", "value": "c15cf8f3945eb0f2af4538feed683b00", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258553, "uuid": "fb652c5c-fba0-43bd-8213-cde8ed9ca88f", "comment": "Malware payload", "value": "f42ed295eba519525da73222117d8ad7ee004fa225d9a720143a9bf8b2946d61", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258553, "uuid": "17f04e34-7b57-40bd-a8a2-ed1996291573", "comment": "Malware payload", "value": "aa52b64fde0cc65bb8dbb3cc8e687c656a66655a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693258553, "uuid": "88ed1a4c-1458-4e18-b5df-de99132cd582", "comment": "Malware payload", "value": "74064eb4e40ffd42c057befeb9b7b60fe69f7ad4d2293e2db743ccf6a566c5f3b8ec1ba9f08808ac99eefd4da4f8c335", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258553, "uuid": "a6828bd4-257f-420e-bb8e-42aeff195bc4", "value": "T1C9152384FE582F97CB56493C6A0BC62C2BD2FF8D831EC4B72BE635862D78F610492545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258553, "uuid": "edc9d9b0-c44f-4e34-985a-635a80fe4681", "value": "24576:jeLMu/lUHGguNaUgjg+NkTgThiNkKBnv:C1Kmg6RsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693258553, "uuid": "e10ebf2e-f5a9-4e53-8436-afab7de6b59b", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693258553, "uuid": "10167762-a839-4e8d-b05b-a762ac526989", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693258553, "uuid": "bce6f952-49f9-43de-9ca7-31f850962941", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.26064.32533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cb8e0f-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693229891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229891, "uuid": "18374a32-b7c6-4131-953d-7e5815556efb", "comment": "Malware payload", "value": "fd3381e7c4fc6e37c45a476b9c4465eb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229891, "uuid": "f8c698a7-3a8c-4248-bd03-404b5e9577bb", "comment": "Malware payload", "value": "f778381de854deef0c289fe5aff168b5ddb3307b6ded42d851caa2dcf4f4c72c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229891, "uuid": "84025e79-ccc4-4e22-9823-d873750c1125", "comment": "Malware payload", "value": "65f78d6d358975a6fa3d5901ef61b29c1e838599", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693229891, "uuid": "aefa93f0-0d9c-4fa9-b86b-690f211105a8", "comment": "Malware payload", "value": "9acc8c502eb5b398d36e2fc7d4d5ded0fcb3a4192b0ee145ea9cc4b25f91ed592bc6da770d7a468b4cb04861f77598b8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229891, "uuid": "163d20fd-dfb2-4616-81c0-b71e1dfb5fc6", "value": "T11B152365FFC25F8BC70CD9BA9917CA4D010DBC9CAB84C4FF97853486637EB814689825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229891, "uuid": "f93572ff-dfe4-4cae-a7d3-73732469df18", "value": "12288:Fm584NkXZMdlZFV2xxESqOBkzPQ04OzibomTAfJgujJxiO8TrVRmUa8m7cN8KQlc:F48kBlPMF7CPz4/72JguPoenV7cvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693229891, "uuid": "ddd75825-c13e-4527-b35d-8f4b9bb950ba", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693229891, "uuid": "bdd351dd-0196-4edb-a3ff-4d0b733dd6ef", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693229891, "uuid": "c4bdce5d-3f6d-487b-86b3-f35710821929", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.3881.14847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d06921f-45a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693226662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226662, "uuid": "2af5ed36-a037-4b1c-9638-af9f42194267", "comment": "Malware payload (Mirai)", "value": "a44246bc02e6cca849f816b53b69c0d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226662, "uuid": "7626effa-a311-4dbc-9e91-acfaa5039e1f", "comment": "Malware payload (Mirai)", "value": "f7b61a1b0ef2d0aeb0da60c614a6212b975fbda58cd5a84391fde2afdad1915d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226662, "uuid": "b7059021-403e-48ce-9088-3a80220c50da", "comment": "Malware payload (Mirai)", "value": "598f57b027e5916bfb92eac3aa2508afdf720034", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693226662, "uuid": "f2c43486-9620-475c-a354-75ed92abaf2c", "comment": "Malware payload (Mirai)", "value": "355e0369978f7fd76be33bead9ebf9c75cd19bf341e4377544385868cdf08da14c2ef83c706846669c4fc8f555830c5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226662, "uuid": "34d10d1e-a6a9-43ee-80cf-9ff394139b39", "value": "T17D539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226662, "uuid": "8998b44d-d0e0-4344-a3f6-8dd817d01e10", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693226662, "uuid": "9260fdf4-8c69-4b2b-b38a-e7f8a62d5397", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693226662, "uuid": "41f50da6-aba7-4554-815d-86d323279d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693226662, "uuid": "bf5acff9-35b9-41f1-acbc-a17ddc4f38a8", "value": "a44246bc02e6cca849f816b53b69c0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084022b8-4599-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693223406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223406, "uuid": "1397e0f4-8244-4112-a752-9176a3e11b00", "comment": "Malware payload (Mirai)", "value": "611812c1d30407d0d673a612a838afd6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223406, "uuid": "15b266e6-159f-4c83-8004-0e7ebf2763f3", "comment": "Malware payload (Mirai)", "value": "f9f2a3476c6c0f1df4d3edf92eba80675eafd5f9f793b12dd90dc75bd07fa9f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223406, "uuid": "02c13c9e-288b-4151-8a83-d557d0436f49", "comment": "Malware payload (Mirai)", "value": "d6a7250c6ba4acdad464cca2217adb2747e552d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693223406, "uuid": "157eaf46-43b7-4516-859e-81dc291b52f1", "comment": "Malware payload (Mirai)", "value": "0d934705b0bb875e3d5050f673d11c8225cea4a8357dccb0be7e933a6b33e138b03b5d49c0de0ee3c12e3792a0240f4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223406, "uuid": "00dcad18-ff84-49b4-8e5d-fe8e171b9227", "value": "T158C2D070A2ED1CB5C6500932E7B856C9BE530FBDFAFE3C90114197BA3941D0529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223406, "uuid": "598fb6ea-3211-4cc3-8c51-1db678f6158d", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE9K+nshymdGUop5hp:A8soTAZ3alkXLvFh8nNE9lss3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693223406, "uuid": "15a859bb-2b95-4d06-a938-2ecff0721801", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693223406, "uuid": "3ef8f3e7-73a9-4285-9739-a8b83d04edef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693223406, "uuid": "382fe9b9-a3dc-4517-84aa-bd0682d1e248", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bbacfb-45e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693255805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255805, "uuid": "b30f18d2-b267-456b-b4ae-72e8acacb1a4", "comment": "Malware payload (Mirai)", "value": "9945caff611c67ee21cb092f0f57bc50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255805, "uuid": "1faba7c7-9455-4cb7-adc2-5f8d6ad13dc3", "comment": "Malware payload (Mirai)", "value": "fa513d32d71f4270c4e4067b8b63e67af596688eab510526ba6d6a4e104ba2fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255805, "uuid": "7609dcf4-14bf-4870-9292-12ae193a592d", "comment": "Malware payload (Mirai)", "value": "0f3feedad9bfe204bbefd8e0981bd3402cc6e64c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693255805, "uuid": "f7fa34c9-fed9-40b9-8c4c-75a230ef9804", "comment": "Malware payload (Mirai)", "value": "408494596ff1ae5ea6942c7e4e0a1c7c38cce2750efb195b765614927a2a1616d5f379d93ee7c81dbc78e8865cd04c91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255805, "uuid": "3bc455e2-d977-4c31-ab2a-5cf5ca04c96b", "value": "T173A2E01472632D56E3ED1C3DC9AE831BBDA61BFC80F632B579415620C94D20A2E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255805, "uuid": "a16fb169-aaa2-4d89-a45e-e62cc8871890", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj3whymdGUop5hk:TvQn4j+ZO5fKAlx7ws3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693255805, "uuid": "a93a384c-c205-4854-b25c-29c83713c1b9", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693255805, "uuid": "a9d1fde9-4746-4933-9292-6058cfe87ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693255805, "uuid": "dfd3c177-d6df-4f50-83eb-09468dd73d3e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f43224f-45a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693230048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230048, "uuid": "aacfa995-aa66-4131-a506-c78e1de23400", "comment": "Malware payload", "value": "a5bedc4c8c634e5b98945b1b7cdd8454", "object_relation": "md5", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230048, "uuid": "61df527b-67f2-4217-a535-1c09d56a314c", "comment": "Malware payload", "value": "facf5983b7e198c87af2575c3635d640fba3318c3ec6dc72007d205ca8a71e94", "object_relation": "sha256", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230048, "uuid": "16ccdf12-866d-4102-96a8-4438b7a5f57d", "comment": "Malware payload", "value": "f61a785cc8ddf9f1da473c33210c29d1d9c914b9", "object_relation": "sha1", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693230048, "uuid": "1242afe1-581d-4931-ad0e-d472bd919eb7", "comment": "Malware payload", "value": "a315e5e7b6c4c63ce7ef2d35267b9cae245f76909c67f0359c9619e81bd11c35cead888504af2cefd3c6d9e2fa9c6070", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-6-111", "colour": "#69BCFC", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230048, "uuid": "85d667d0-9ab5-4933-a67c-09418c734ecf", "value": "T10701F4A0250BFC7D1647F2D17B7442E02FD654D1A11A362496443C0FAE32C6689DF8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230048, "uuid": "304d1867-b657-4df1-aac0-9f302969fc39", "value": "12:YDLqzd+mPZGShR8kkiBlsVTXuZ7I81E7GXXfDWQCe/nmSuySIAlkzP:8qzEmPZNR8piBlLn1fXXfDjmIAazP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693230048, "uuid": "28d1fa3b-dd66-4bb2-b2e3-996badf1a2fc", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693230048, "uuid": "86a6760a-016c-4fc3-bd89-801607f5a16d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693230048, "uuid": "6e0e9afb-4598-4edd-9fdc-ae25b0484ce7", "value": "client32u.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3757a8c6-45fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693266435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266435, "uuid": "724ec872-1bb1-4e59-b223-00e93e170e5b", "comment": "Malware payload (Mirai)", "value": "b76dee823c3459967e27a8856e6e300a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266435, "uuid": "eaf7e9ce-930a-4aec-bfc4-ba1f65a2c783", "comment": "Malware payload (Mirai)", "value": "fada0276dd1893ff85ebf572fe0974cd23cdabe74762edc234a7bc022bfbc026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266435, "uuid": "8e7f7f1d-1ae7-4b54-807d-037c42ddaf66", "comment": "Malware payload (Mirai)", "value": "06c3d12480e23420c2c4e2a6ca0249085c44c3ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693266435, "uuid": "adde1bc5-5b13-4d0e-8d34-31f89ecc639b", "comment": "Malware payload (Mirai)", "value": "d0c0cd3fcf97418f46c42e7c9e884a2c05556f26b8a23fa3c896d5bd30a95d71d4136fb64f82f114fc3a11db67167f83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266435, "uuid": "a4de1d92-c552-40d8-97b5-b70baa37823f", "value": "T1E8B2D065E629DC28CF305436AABBC6DB65B101F4C8E432B37C068F39D1592C6587E8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266435, "uuid": "5394eb01-1ea0-4967-9220-1a3da41e9124", "value": "384:ZINwaCvFnMU+vVkd+f4L+LjBKvf0KjSXR8YhGJa45aMwRMl0hymdGUop5h81:ZIN5C5MCdghLjsHYIJXP4s3Uoz+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693266435, "uuid": "4ab41872-2f9c-4309-b37f-81649db796a5", "value": 24736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693266435, "uuid": "64f9d5a3-a530-4b93-9e56-bf28287d5cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693266435, "uuid": "c74c2dcb-2191-4978-9f61-7b41fc2af500", "value": "b76dee823c3459967e27a8856e6e300a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854f9f65-45ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693244661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244661, "uuid": "3d15ee67-ea18-4172-9bf1-58409f706077", "comment": "Malware payload", "value": "0b759ab0d836d9fcad1b978baf29a944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244661, "uuid": "e7d05f0d-937d-41ee-8aaa-241e8f01d5a0", "comment": "Malware payload", "value": "fafc6975924220c79656a8c6719937bcfc80d2166f1351120021774d24bb1fd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244661, "uuid": "e87e1312-7971-42e4-b083-5d102f132a4f", "comment": "Malware payload", "value": "9dab84add80410b580eaab747259d36430bb0359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244661, "uuid": "ad040ead-f2a5-4976-9662-b77b2a5c4be1", "comment": "Malware payload", "value": "5ed34d09d98ca67cc11398b3d932c1eced5469103ac8492f9a5d49aa8bd0307a610d13e1278d5b31990b0f1085b48e17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244661, "uuid": "537eb269-e6e1-499d-9220-3f61cd360468", "value": "T14D071993F89572E4C4ABA2748E215260FB32348D1B7A77D71BA093711B267F08FB5B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244661, "uuid": "11bdf2d9-3f63-406d-b89a-43aeae0730bd", "value": "98304:eFuXDph6DDI1BIH8AaUIVOqlKEtUVE7EV0s+h7OaxelXpYmI+E:Ik1swGPIVBV7EVRYOi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693244661, "uuid": "1db3f3b7-c05e-4309-a3b9-d6939a8843c7", "value": 17518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693244661, "uuid": "f50730db-b65c-4464-a56f-f88044b32de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244661, "uuid": "49094cd4-bc30-4d61-a79d-68f70e592153", "value": "systemd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198af1f9-45b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693233314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233314, "uuid": "1f1d26d6-37d4-41c2-90c5-1137c8bf9293", "comment": "Malware payload", "value": "2b983ecbf9901b06b6e91a8fdbe21a28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233314, "uuid": "49450c6a-01a2-4a38-93c2-6811c08832ea", "comment": "Malware payload", "value": "fbb1aff6a6d2ffb62e4173f4c313f0e480a8d52a53398829369f763e2cd674e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233314, "uuid": "84341735-1956-492a-bc34-def2916fe4ff", "comment": "Malware payload", "value": "547eae14097c6ecedf3529d90f9db02223400926", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233314, "uuid": "6a298a9b-6a79-4910-b5a8-35433a98a5af", "comment": "Malware payload", "value": "be59942dcf6037232bfcfb0b441c050d4f39ae0680ab76feceb4a36e65cc8a5c6ee8ed28ff8ff21e27dcaba9e780cda8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233314, "uuid": "d27c2e75-47c5-49b1-8816-bc916adf1412", "value": "T13E639D5172D1C4B1D6AB073554BD8B62267E3E225EF044837FEA2A8E5E702C0AF35793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233314, "uuid": "4b38b7f0-d1f7-4ed2-be3e-b1e09f263f64", "value": "b64ce983d84fce30f9137da1f913d5f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233314, "uuid": "e525585b-4314-49b0-8d02-e3583ae5f111", "value": "768:wTr4XWSGvSewnYVLx60SAbkR5XIJn8kEV9tNk8A+Q5bYWrLEWWHNKaqX3GqXyfdl:wgBG6wdVSGSXSOUXZP2rFaxTtBqgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233314, "uuid": "6d1a6ebc-01e3-41ff-a2d5-d4eabaeaeef4", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233314, "uuid": "02c71274-90ca-48e6-8ecc-fcfc0a27a4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233314, "uuid": "57a3e6a4-6e76-4260-ac30-0c1604175447", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16641.14472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f54760-455a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693196721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693196721, "uuid": "2f2de386-c171-4608-88b4-17423e1c4447", "comment": "Malware payload (RedLineStealer)", "value": "3f6bc8ef3023fe1aa3956e6134af78b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693196721, "uuid": "d6609aec-5681-4b6a-bfdd-8812e37b4f6f", "comment": "Malware payload (RedLineStealer)", "value": "fc6f534c0c0bd66d8973712b52ae241b3503a942645e18ee72e551b977eaabca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693196721, "uuid": "f309dc67-f79a-44a4-b82a-07e135ace5a4", "comment": "Malware payload (RedLineStealer)", "value": "b68650330210096ce8f94586dd4741babae0819a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693196721, "uuid": "9db92baf-230f-4182-ba8e-00fce38e61ee", "comment": "Malware payload (RedLineStealer)", "value": "a302ee6a8cacb111b5461213927c83cc984ec312b47cf1065a1c13188cc5d08a9da740d7c19a4b43292342dd3302ce79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693196721, "uuid": "e9d15c92-0d6c-482e-abb2-1ebeca00eb80", "value": "T10747AEA12E46027BC6DC637462BB6379BAFD1E4C230CA7F7D6D9F8743C4A94052A461C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693196721, "uuid": "f2a42039-9958-40f1-9746-e81fd1ebb40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693196721, "uuid": "4bf1c0b9-557a-441b-aad9-956def153513", "value": "393216:MdXQyvh0Xtz9jakSW0bbVCX9rmOE1cnHD:UXPh0tzHSAX9rTEan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693196721, "uuid": "733a29d1-3e8c-48ab-b6b8-3c48ba12fe91", "value": 26492928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693196721, "uuid": "81e1da2e-b5e9-4e55-9099-72faf7c1197b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693196721, "uuid": "db956a7d-f540-4b14-b553-f334b700fd2c", "value": "3f6bc8ef3023fe1aa3956e6134af78b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02aa6ec-45af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693233217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233217, "uuid": "e4bb5e23-f597-450a-8dc8-3d7156de0654", "comment": "Malware payload (GuLoader)", "value": "e3c1b03a5d108e6a35288b7231ea6726", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233217, "uuid": "03f475d0-91fd-4fc7-9959-e8f7739e91d1", "comment": "Malware payload (GuLoader)", "value": "fc7332e86188490e730a72e040963619564ff94a46616c206f4ae9f71e1f836d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233217, "uuid": "c2bdc817-0695-48e2-8b41-1076d8a0d60b", "comment": "Malware payload (GuLoader)", "value": "44bc29c4419109023f4c311410a85b3418bf2183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693233217, "uuid": "9df3a2e8-47ba-4ac3-98d9-5d2112fb3de6", "comment": "Malware payload (GuLoader)", "value": "22afa942a2bdc0e429726fc322da14d77e6b6c68024dfbce61e78e15eeffa73677f435e48266ef92803b71df075b606c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233217, "uuid": "d2aff7a7-52b9-41ed-99d0-1cdaa3a91667", "value": "T16AB4224212AACF5BE0175975E8B695F99A349C06CE3F0B1F1750BEF77C70A42CB0A681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233217, "uuid": "b57c0e1c-1118-4855-93b6-14f95ba1a5b6", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233217, "uuid": "9fc74882-23cc-4852-bd38-a91cbd2fdc6c", "value": "12288:OqYRUZ2Ro17RhWFpIyjSz3ly8IQ08J8znex2zEk3kZIlr51obRHz:ORUZ2q1HWFpIuSz1y8IQheznesVrlgHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693233217, "uuid": "81a3a380-0039-4345-9f12-b5db1b7ed23c", "value": 536644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693233217, "uuid": "d8d20904-257d-4016-a69e-2bbfd9cc127e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693233217, "uuid": "52e6ba04-a668-4353-bd43-56e6c41279f1", "value": "Orden de compra - P06672_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeefaec-453c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693183709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183709, "uuid": "da05737c-9cd6-4e73-9bb6-86cad6a7894a", "comment": "Malware payload (Mirai)", "value": "ddf947bb38f0e7eee71643aebd1fb0a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183709, "uuid": "029e5a1f-cca9-46a8-9b22-a2489a7e0f92", "comment": "Malware payload (Mirai)", "value": "fd132953f67e5420fe13a91199b903e3fe50f3353b915f42be62d88b629636c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183709, "uuid": "be049edf-fd37-4673-857b-75301cd84c5e", "comment": "Malware payload (Mirai)", "value": "761583fad54dbb2e8189ff7438236bcec38e533b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693183709, "uuid": "a1afa2bf-74af-4c10-a1b3-da4271a6931b", "comment": "Malware payload (Mirai)", "value": "5efe6a8afa06336729d31dd5d3d4e4a7470a0136f176afee9adce2d2ac178d08e473ecb4d59a2b5ae0130646f15a2a31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183709, "uuid": "8d707da2-89a5-4bf2-bcdd-bfcd7bb9b9a8", "value": "T194D2E18875D353F68C8DCABEB64F4036709E34E9B7A29323B306D5530766181E651E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183709, "uuid": "d0c78782-296a-4442-adb8-b63eb5655ad6", "value": "384:Mqd/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKLD0/PNy+:NlxKd2FLPxEnspd6IHE4RlY990gD0k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693183709, "uuid": "c98300d4-1736-4a09-bbf9-e4c7f954bfc1", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693183709, "uuid": "cefeb7c4-c64e-422b-8752-5ce5d793e2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693183709, "uuid": "b1719860-cd26-467d-83b7-9c1fcb980bda", "value": "ddf947bb38f0e7eee71643aebd1fb0a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c0f5df-45ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693232146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232146, "uuid": "bec7d2d1-f9c5-4cc0-b177-74c9b4aa1781", "comment": "Malware payload (Mirai)", "value": "ba9b24b585176a8ac0653205ed7e6aea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232146, "uuid": "2b6b2d23-b2c7-415d-a94d-fc0d285645b7", "comment": "Malware payload (Mirai)", "value": "fe44cc2f8feab075223b855fe6cbbb0a38def2543129e2632d463a9ee1666934", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232146, "uuid": "294977ea-4a2b-4b88-9aa2-598f626085fa", "comment": "Malware payload (Mirai)", "value": "64331df437633dd1d0632468ee19d8f13154b781", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693232146, "uuid": "d108edb3-267c-4082-a9e1-0ca504f0c4f1", "comment": "Malware payload (Mirai)", "value": "dc2627c22ba37618319204c77c031056d1fd4e870b99e27372ad787cec052791a33a26e6732233db6e5e441ac173c62a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232146, "uuid": "786668c1-cd83-4caa-84a4-668efbd1e80e", "value": "T146835BC5B6C3D4F6EC5305B2603B97768B33F43A102AEB43C7299936C852950E6177AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232146, "uuid": "3ae81702-28bc-4fe7-b81e-4c108db061ae", "value": "1536:JuBj0SLUbDqy1Okmq1TisuYXssJOnCgPmCRyTSQtUn:JuBIlbey8lqZz2sADPhU+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693232146, "uuid": "2962337a-1288-4a0d-86a6-e84c814752e7", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693232146, "uuid": "242ef074-6dd5-499d-82f6-cd342749bb84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693232146, "uuid": "0facd582-e397-49c8-883a-403ffda369d0", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c839e697-45a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693227594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227594, "uuid": "3b261f6c-b1c6-4b87-a997-cae6c02d704e", "comment": "Malware payload (AgentTesla)", "value": "3c95b0a1a2a0aa48236c7744fe89708d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227594, "uuid": "c6ddb628-c27b-4ad2-9e96-9c7667f442f6", "comment": "Malware payload (AgentTesla)", "value": "feb333473af743a18932031c5b279f4a8484f1aa220417274a26828b880bd39c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227594, "uuid": "7af0e126-4262-4c86-bc30-c4e6de25f26b", "comment": "Malware payload (AgentTesla)", "value": "2c713c2be844ca11a48d9530457f051bc48543bb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693227594, "uuid": "d1ba7717-7009-4ed7-bc8a-145949e8a8ab", "comment": "Malware payload (AgentTesla)", "value": "0b3061e180c426d32639629d70f5ba7b8517f9808b20e1ea29a020156ee20d7cd1028ae36c53f13edb537760a0694a63", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227594, "uuid": "64268621-ad53-42f4-adf0-ab2540c2de71", "value": "T1C6D423C8608D69199F928740B43E895B08F660F3A7476F60ACE18D10DF574A4FCBA7E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227594, "uuid": "11b5a05e-d5a4-4b71-9dfe-95863efcc13f", "value": "12288:FpJObV2QOjo9LESMwPcsPmS/6ST60PVtD5/W/Ojk5uNQIZWKkp/kvdvBbYT41:3E2bo9LEhwdOFSTD5/W/pUpvdJbYT41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693227594, "uuid": "1f8c4388-d23d-4c22-a906-d71a3a166a0a", "value": 652623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693227594, "uuid": "1f45ee86-60a9-4a9d-ade5-a9ed016623d9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693227594, "uuid": "d0e6747a-7dd2-4e1c-a245-cab2778cdf0f", "value": "PO - 12619.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aa875a-458f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693219179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219179, "uuid": "c3e7d507-986a-4885-b749-cd212e56fc76", "comment": "Malware payload (AgentTesla)", "value": "80aabd72d0b588edeabb5534a3c81d29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219179, "uuid": "12950648-9067-492f-8420-7d7a6d73f155", "comment": "Malware payload (AgentTesla)", "value": "ff15b350c7e36195d41344e9b6eb4c9ac3a4648b3db76df9db8d1dbe24ef4bfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219179, "uuid": "7a234d09-3e4b-495d-948e-c19b35dde566", "comment": "Malware payload (AgentTesla)", "value": "ea575cf09d1536ceb16ecbf25487bba6964ccc55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693219179, "uuid": "f0c1a4ae-6f33-416d-abe0-2064f5691ed4", "comment": "Malware payload (AgentTesla)", "value": "2c0466634708bfcd07e0ed622c396d8d6a03b903afcbddce29f86c344c35930e6da8796e37064d682a4896faa53080fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219179, "uuid": "ff7e9db3-5ec0-47a8-ad05-88d460f6c75b", "value": "T12A35D0EB2AA4582EC97D4AFEF3394C49B3AD85E8530BF705B89547B09427B306731613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219179, "uuid": "4ca21536-57a5-406c-a3a8-85dc354f9408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219179, "uuid": "8429fa7e-bbc9-424c-8f97-ee1faf7fbe70", "value": "12288:dHpMJyuE18hX7rbSbd/2Gd0n5FndwyX+ygX9rdjUK3SxGP1/GYU7mOOP8b4vNwYc:KX7HSZOGdOFdwsytrNixXYUQKGJ8dMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693219179, "uuid": "9882b017-1542-4c81-8120-f4f8a10f8238", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693219179, "uuid": "891c4a8d-5df6-46df-81bb-7b80caa4155c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693219179, "uuid": "50192b1d-ebeb-424e-8eee-52fda6ce61c7", "value": "SecuriteInfo.com.Trojan-Spy.MSIL.Agent.22569.6351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd6e45d-45ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693244813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244813, "uuid": "4d643f2a-67ae-4901-9a3b-1d1a2fe7c93f", "comment": "Malware payload", "value": "b3dd575633b2a2b8d98cad601c6dbb9a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244813, "uuid": "c7507f4e-d6ee-4bff-a913-a7343afe7fa5", "comment": "Malware payload", "value": "ffb2cd08717ed0d96b9d016d89a0c728b1cc4f27d0d8935f28b0e12386285a6d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244813, "uuid": "1c80dfb1-2269-413b-9be7-951175f09712", "comment": "Malware payload", "value": "08ebea00140741b800c5810b7282ce1d99a580f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693244813, "uuid": "5bbdf7c3-f2c3-4aae-ad3d-ee9989f0a674", "comment": "Malware payload", "value": "27b9faccf640515c5de12298a8493cd99a8870723457900331539736dca82d988cffa1254aa96a5ec4133c6fb10b1f6e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MageCart", "colour": "#300E50", "exportable": true, "hide_tag": false }, { "name": "sniffer", "colour": "#999F30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244813, "uuid": "f1581955-24fc-4231-ad2e-92fb5ff91215", "value": "T15DF22F45A9941139957BF33A4F2BCC85F92A4A3B029CD58BBA5C95E06F3047443BCFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244813, "uuid": "f2c6d739-98c9-4750-b55c-2100ea21fcbc", "value": "768:2s5Pbq3Nzt2mf8wlvV/QGv6lF7lQnYrGwsZj5ULcKNmuHSfl3wd13A96rc:zS5T5YX7sYrPsZj5ULcKNmuHSfJwd1/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693244813, "uuid": "db9224db-f9b8-4df8-bd29-3b7d35b382b0", "value": 34684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693244813, "uuid": "a0f5962c-6448-40e2-8bb3-85c80ad59835", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693244813, "uuid": "0cef5ec6-7383-44fc-b673-7421efb6a96a", "value": "card.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }