{ "Event": { "published": true, "date": "2023-05-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-31", "timestamp": 1685577781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a5d519cb-d2ee-45f8-9fdf-1deacdad6dab", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705faf46-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685512826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512826, "uuid": "941c1c49-5553-40fa-8e71-06c8e70a51fd", "comment": "Malware payload (STRRAT)", "value": "fe881928beb52511a8775d239f49b645", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512826, "uuid": "3be0411b-de1e-43dc-94a1-9b70fb03bec0", "comment": "Malware payload (STRRAT)", "value": "036d5492f5a724535c521ea06e67862727dd4e36c77bb5328344dc1b0338c04a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512826, "uuid": "f9f20c47-5ac5-4482-9cf3-b16189170839", "comment": "Malware payload (STRRAT)", "value": "bd8e0da24e2887fbccab557cae80694f082abf2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512826, "uuid": "215474b5-a2b6-4280-90d7-b4abeb655458", "comment": "Malware payload (STRRAT)", "value": "cd081eea2ed1048e15d91286976e3dba324791544ee8a1010a01e0932119d8f4bf519609bd98b32399265c6093f86195", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512826, "uuid": "c4389596-bfd3-45c2-b280-dd08be1700e4", "value": "T104746C5E53800FAFB924482A45D723F3B568EA4B5C949C9C9563CF6EDE51C7B20083BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512826, "uuid": "1484037a-9fff-49d2-be10-ab878042ecf2", "value": "6144:H9W2CakgjgB9uBjBl31VghH24Aep/qw7rWCvNzM9+H+GqiXY7CQV4jyR0Xk+:vCa5i9MihWa7DdM8H0Ipi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512826, "uuid": "a029f4ab-df13-46cb-abca-851a4e1e5612", "value": 370425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512826, "uuid": "a695188b-cb9c-4b5a-8b8d-ad56bfea9384", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512826, "uuid": "edf3fe4c-6b1b-4514-aa2b-63d9e0702aa4", "value": "Proforma Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4108e347-ffd3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685551831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551831, "uuid": "29682cea-0f5b-4f30-8874-8acea3050d5e", "comment": "Malware payload (AveMariaRAT)", "value": "6ea6237fd00b52f59dbb5ad00f11bd9d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551831, "uuid": "e6f3416b-abac-49bd-bf1f-5536c7f5d771", "comment": "Malware payload (AveMariaRAT)", "value": "03de1b6d7dc6b32f6b46bd2729f7ca9fbf44c377296bac8240a54ad1baff0198", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551831, "uuid": "2d7996fa-69ff-4ece-9ea3-558d2d90c6c6", "comment": "Malware payload (AveMariaRAT)", "value": "1f60127952726027a647f33cf198855e880e32d5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551831, "uuid": "80bc3c38-62d4-47ec-97bb-2fdf3c1e40d0", "comment": "Malware payload (AveMariaRAT)", "value": "237db3b1a758b7954fcb4e2e9e91dfb15942583d8190ab7bdbf84495a56dfa5e07558c257052b0764e129381d10b4bb5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551831, "uuid": "d62574ff-bab8-474c-9b31-86f1cbe1d79e", "value": "T1091402187790C5ABD8610F720A7E4E676FFBDD235239970727D04F0C7AA6853890E7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551831, "uuid": "e37ed587-ceba-457d-956a-6ad28c359ae1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551831, "uuid": "fe057c3f-1ed1-4caf-b5b6-6ec7a01e14ec", "value": "3072:3fY/TU9fE9PEtuWbtBBndc6xExWBbzSzgrK3PxX7T5RNA50GORh7YmLaEsN7YbIb:vYa6WPJdcVFkrK3PxXJRNU/O/bI80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685551831, "uuid": "7311284e-8d55-4518-ac42-5993513e48e0", "value": 194291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685551831, "uuid": "685a0aa2-68f9-466c-a99f-ca229fab5c74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551831, "uuid": "3166fcd1-9367-40e5-be55-47dfa777d4ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2958fc-ff66-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685505197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505197, "uuid": "9ddc3623-ac6a-498c-893f-abc625ba77d9", "comment": "Malware payload (Loki)", "value": "524d20bd1245aa40eaafaa90992488e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505197, "uuid": "60159f59-d869-434f-9ec8-2223fe0ac05a", "comment": "Malware payload (Loki)", "value": "04eacefef801a460be4831841a7d400332030d8d3609138f636b43a9dcba9eb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505197, "uuid": "79a1a2a8-9a2b-4b67-88d1-496d873baf91", "comment": "Malware payload (Loki)", "value": "6f60ad55aa3c1657df52a71b8901a99c693474ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505197, "uuid": "8f6c28dc-3b78-4da2-aaa4-7b99b0f443ad", "comment": "Malware payload (Loki)", "value": "f5755d346370b7cfec07f7fc5de5dcc9b071ab96d205fa6ee2f17b8c1fd30ce87a1b50e43c7676ccd6da3fcc1431345a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505197, "uuid": "3c81953b-fafc-4d56-b483-a50fa691d5c0", "value": "T18DA31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505197, "uuid": "1fee050d-d289-46f0-b2b7-46e2e407c600", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505197, "uuid": "f11fcb04-b901-4304-98b4-f678bf23a5f3", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685505197, "uuid": "80334d00-5212-40a1-8db8-46ced022e6e8", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685505197, "uuid": "85598b30-7647-4149-9233-aab6fe4cb260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505197, "uuid": "f7e8c76e-2e8d-4c5d-982e-9e2877460a26", "value": "524d20bd1245aa40eaafaa90992488e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbbc97d-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685533330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533330, "uuid": "3d54bb7d-7df8-4161-bc67-9c4161e3bc8c", "comment": "Malware payload (STRRAT)", "value": "a52ec9fca7c149255a26b5f94b626a3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533330, "uuid": "f6809dac-75ff-4b14-9db3-86c224fb7d85", "comment": "Malware payload (STRRAT)", "value": "0505d0071cbc17784945887be863998476d478d9f4a67d84b3dafbe0ccbb9e07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533330, "uuid": "ed03c871-400c-4144-abae-c2cf57527f16", "comment": "Malware payload (STRRAT)", "value": "64402213a38c554a79e19073117ad66d7f904123", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533330, "uuid": "11229c7f-0bec-4a25-945d-27bac8c09074", "comment": "Malware payload (STRRAT)", "value": "522f420fcdf9c6a08a910de882eb492d6a2f93fffc9438335c16cf9563566a44e9d78a7e906f3832103c26c413407fb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533330, "uuid": "637d3695-20ae-4721-916d-26c628528343", "value": "T150749E89F8CA0737EDE9203654A72B3286D496091AE4BCF9D5B3DC5FDF52E481118EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533330, "uuid": "1582c87a-68f7-403d-8553-6ec2a298181d", "value": "6144:I70jNAmRdFLPgmzKVbQPkyx1rYi1a/rN8tBtjUgpexE4pryG6LOEyvXWQ6WjAA:55AmRd/IQPkyx1rXtBTMmG6CmQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533330, "uuid": "ce191031-37f0-43f6-be52-da2d3a51f2b2", "value": 354999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533330, "uuid": "06c24649-4b71-44f8-b452-b07016d49281", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533330, "uuid": "ba8555af-3fdf-489d-a9cf-b6d224876201", "value": "slifgjhkjj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4577dccf-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520914, "uuid": "cd7dd161-99f5-4542-8124-563bc0188976", "comment": "Malware payload (Loki)", "value": "48d319aa088a6270bb9d77daae449584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520914, "uuid": "ac2aa6fd-f16b-4177-9dad-9b5db00d4208", "comment": "Malware payload (Loki)", "value": "061d5260cf6dc7d572961097606059265b986188ebfe59c603fab9a4165a973e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520914, "uuid": "18b708a7-99fb-43ae-aaeb-8c877e8a3896", "comment": "Malware payload (Loki)", "value": "8c325f6b95c04a5046ea545a78375a96dc9d0402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520914, "uuid": "bd8039f9-b85a-45e0-91f8-9ff14d2e112f", "comment": "Malware payload (Loki)", "value": "8f71ff27a226f556fb6a80897bd653833415beab5625d5f89be48c5a7e72027f7436ac28572b9db64d934df2f6d272d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520914, "uuid": "573032e4-30a9-4f5a-b33d-454248874c34", "value": "T133D41242EF7F060BD4257DBD57704470A6FCC651A03FE29FEADA286FC918A346C92162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520914, "uuid": "d8f2e409-ed3a-4849-9dbd-7c3703490114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520914, "uuid": "97fda8b2-4a53-4505-ba16-47e20c8e1712", "value": "12288:L7AMTihh6xhZ6OrlExA6M2E3+U4k3adfpd3gLU:QMUgh8ylE/M2ZUfqRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520914, "uuid": "b158e948-9bc7-449f-93bc-f583433209f7", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520914, "uuid": "70a36548-f30b-4096-8558-8b91f1740f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520914, "uuid": "4877891d-a6f6-47ec-a894-28af0897ca6e", "value": "48d319aa088a6270bb9d77daae449584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fefc91b-ff94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685524878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524878, "uuid": "16b03751-4834-4d23-947a-54d8c52706a4", "comment": "Malware payload (AgentTesla)", "value": "40b83481a38c69110126c0d166fe6893", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524878, "uuid": "d914aa7e-763a-49b4-9590-611756ce64ac", "comment": "Malware payload (AgentTesla)", "value": "09b72e8fbf997287b10e2927d2c54ef6fb7e7ff44e8b2e16267db1b9e54ccc89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524878, "uuid": "5b3eba06-5024-4f73-913f-d646bdbd5f17", "comment": "Malware payload (AgentTesla)", "value": "cddfe4866b13ca1a90b30593fa5cbc9310d465f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524878, "uuid": "85b1b66f-be97-4b16-b764-3cc0c40a625f", "comment": "Malware payload (AgentTesla)", "value": "7167a8f243808a10c3b6872008ef803c7a57db01e3bf74c9134fbd745ef4ceda278c544c87b8481257755cfc827b975f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524878, "uuid": "ce7bd083-c261-4940-b5af-3e54247976f3", "value": "T1E86412103AA0C2ABEB928F734E3E072BAAF4E5555DA08B4F53C04F0DF967256854C763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524878, "uuid": "68279efc-c3a8-47fb-a836-d433df7f8c47", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524878, "uuid": "e3d4b774-5e33-4b20-81e4-4c5b7bc43747", "value": "6144:/Ya6mJuqOdZWF2dv6aWfohqdIlPJzXhn5SVyQpdkhS3Yt:/YoYdZWF2d9Wn+lP1hnkyQpShyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685524878, "uuid": "6bbbc2e4-0144-48f1-b6c1-330ce4e92346", "value": 312586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685524878, "uuid": "589fcde3-e8dc-46b8-85a1-889d76967e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524878, "uuid": "4ef843b3-f57c-4a09-8a9f-461363c18d4a", "value": "rOriginalDocumentsShipment-AWB4447097169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067e9a74-ff8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685522527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522527, "uuid": "496124c1-7fd3-429a-a839-beedf3c82610", "comment": "Malware payload (Quakbot)", "value": "e14c56e8f10ebc94872075965f718055", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522527, "uuid": "3d767f14-1e60-4ebd-a5e6-6211c11120ca", "comment": "Malware payload (Quakbot)", "value": "0b5ae300a06303cf73611a7337984dd0bc674d1bb2430a008d04c4a758f31e67", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522527, "uuid": "1e08a7f3-c7eb-4a44-a53b-78b79d4cf4d1", "comment": "Malware payload (Quakbot)", "value": "ce1ea4f9441c0f2e8ec06d98b1536002e8f2ca0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522527, "uuid": "b720ac2a-329e-41ac-b1a8-88598204c750", "comment": "Malware payload (Quakbot)", "value": "3ed3694e471de0582341f8a6055ed030291f54c052582770e1b1e3dd2d9d397642e42791a43bf296479e890bb63d61d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522527, "uuid": "6a2124cd-4490-49e3-a44e-75c8db44dd76", "value": "T1969100B69F88DD2ED269FA111086DD8FDAD1C578211FAD93F34B60A4B8ED41C82B35C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522527, "uuid": "1741d37a-fb7c-4842-aa4c-da2b9bd10147", "value": "96:HKFTkp7rbbv9bNgTQpizsBKsuF0wLhXnlQMCOqFwNvHtBzW:HKF49vbzizsBKs8BVxP3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522527, "uuid": "974efa91-6958-4069-94fe-c52e04d6dc21", "value": 4623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522527, "uuid": "c351ed6b-87af-4952-8874-380cd3010cd3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522527, "uuid": "808445a7-1a5e-4391-a49a-638aaa59ea65", "value": "doc_C684_May_30.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e715214-ffef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685563825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685563825, "uuid": "bfcecd02-3386-48e3-b738-a0eaef2f81cc", "comment": "Malware payload (RedLineStealer)", "value": "b029b41c45659b1444090db746ca742a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685563825, "uuid": "07938a2e-3d89-40e7-be07-38db456ec264", "comment": "Malware payload (RedLineStealer)", "value": "0baf82e29d938f8ce86d56784d4249181155983eecbfdae1f7324705b152da7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685563825, "uuid": "08945305-e91b-4215-b180-b97654d9b906", "comment": "Malware payload (RedLineStealer)", "value": "f74c393f27f3f562db77c8f3a0afaa6474f58e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685563825, "uuid": "0f712dcd-8be7-4fba-9795-23d3f8e3111f", "comment": "Malware payload (RedLineStealer)", "value": "a5c030678ef82f681a589a31359faa78fa8a147bbfaa347facba2d8380cba02de407987fef80410776bad66fd8a07068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685563825, "uuid": "833d4f9f-1367-46f5-b076-84d9ef5a5310", "value": "T1C3858A31FE82C4E2D4952635CDE35F58373AE8AA97100697D7AC163D9DE33884DAE183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685563825, "uuid": "9d4ead89-6012-4757-a8d1-a8dee86e8aa3", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685563825, "uuid": "51ed8a95-ecca-409c-abcd-b112bd55c78d", "value": "24576:NLllLl72q3plgjEaBCiTkBm0iy0x1Fb3inclQ:VllLX3pyFCqkBmDyG1IJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685563825, "uuid": "b8dfdf08-45bf-411d-a209-18b67c46178d", "value": 1718830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685563825, "uuid": "0163c345-f3d9-4948-9355-269ea27c1d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685563825, "uuid": "d65064cf-f39f-46a5-ba13-313f44204c68", "value": "b029b41c45659b1444090db746ca742a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659d3009-ffaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685534283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534283, "uuid": "fd82e4c7-1f1c-4948-839e-4681fef97904", "comment": "Malware payload (Mirai)", "value": "8c5e49d46775fc844284391bd97ecaf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534283, "uuid": "675aaa6e-806f-473c-870f-e7213041179b", "comment": "Malware payload (Mirai)", "value": "0d35db1f1ff02809f1bcc9f0b090522ce1763704ea004a972ff6ca904a1bf75a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534283, "uuid": "7d23e643-e156-4320-83a4-52313baa39c6", "comment": "Malware payload (Mirai)", "value": "ca87a0af619526cc79fbb75246f5db2c5af5777e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534283, "uuid": "dc69395a-1ca0-4d54-8db1-d7c1a95921fa", "comment": "Malware payload (Mirai)", "value": "1dfe891a6b8b3ff8299b51eccbe895e7960e3174314a9b06aa070b29ef4bb17cd081ab1b53c53233a13d305f64dbeaa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534283, "uuid": "ac56b763-d939-4a89-af4f-091735437033", "value": "T16F838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534283, "uuid": "3d2b98a3-a3c3-4175-a170-404653cf4c94", "value": "1536:LsMhLMLiQAlHvBoaAopJpLwA9Z5lsiUd42+:LsMhLamZvBkA9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685534283, "uuid": "1fff5845-720f-4c2b-b343-8d7d2f0a99eb", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685534283, "uuid": "04f47057-f34e-4725-808b-909c5d5c8c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534283, "uuid": "5617d39d-0c6e-428a-9cb9-bbeaec48d5ba", "value": "8c5e49d46775fc844284391bd97ecaf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4699b3a1-ffaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685534231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534231, "uuid": "bd0002e9-404b-452a-95ed-75962ffcf4a9", "comment": "Malware payload", "value": "46b31cf24adf64f749a4dbb94abfe7fe", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534231, "uuid": "ddd4c950-28a4-4357-ad18-6c7c6fcd6166", "comment": "Malware payload", "value": "0d6e2ebe648a9cb27d27555a58609085a2bb37704a82259d4db626302f0fb646", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534231, "uuid": "a6fa3054-dec4-4a36-b84b-2895597da306", "comment": "Malware payload", "value": "25c6b760d704e624efd324d86db81439a4ec7f20", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534231, "uuid": "39f05990-41a5-45c3-a4ae-e543781945e5", "comment": "Malware payload", "value": "4b07665ed06d48a1f66384371d67a79c952ef0fee988169f3349409e8f118a2719c7b8cbc12844a8ee8a45438e4aa2e2", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534231, "uuid": "38856d37-e1bf-4431-8c49-d5fb7d878cb6", "value": "T1EB33E185CC2D5645E8D7C5AEE53CF639D5FDF20DA9C8B8C8332C46839B10805DA5AECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534231, "uuid": "bbfcd895-92f0-4653-b77c-c71740108d7f", "value": "1536:PbRL+YYbZCpJdo50XEarnVJtPOCIIXfZe12+VUlCOi0:di5ZCpJdVXEaJJtDPPZeIpCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685534231, "uuid": "bf4dd670-55ad-4cc1-83d7-2e51d88f306e", "value": 51851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685534231, "uuid": "0a9f5bc5-cc4c-4edf-bf6d-13ac49c5bacf", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534231, "uuid": "916e3b4c-10fa-429a-8ab2-8fefa04a2415", "value": "Fattura_01787980.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7e0952-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685498646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498646, "uuid": "83d2bf2f-d00b-4487-9580-c2a7848bf230", "comment": "Malware payload (Stop)", "value": "003e3c14688fcc30fe7d69a2a68cd27b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498646, "uuid": "6ba79299-378e-4947-9418-a6c6ffa24449", "comment": "Malware payload (Stop)", "value": "0dea9d29d4aedc99d8becf261b8ebae1238d7131f9751a9e8874af4bf2b76f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498646, "uuid": "643e891d-d9f0-40f7-b7dc-7a1a78a3e306", "comment": "Malware payload (Stop)", "value": "23747327e5cc03a31270112c58916316aae012fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498646, "uuid": "df7a68d0-699b-4144-91e3-a0222bf10021", "comment": "Malware payload (Stop)", "value": "7a9db344698b863ee076ac66ea80f700598db9ff5ec110ca8493fa9c32277e1520e348083ae185030ed771562e34bfad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498646, "uuid": "c4c2f068-472e-43c4-b6d9-0b3960a4556f", "value": "T189E4122236E19037E3EB15B09470EF581EBFB9628E35859B2314D2BE1F217C1897935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498646, "uuid": "66e6cd26-6ecf-484d-8d4a-db9be3f5b4a0", "value": "127d7b931dc3731e782c23c78259af73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498646, "uuid": "16e3c95c-a7b4-41ef-bb97-04fde358c11a", "value": "12288:hO4YoxKko8DORE39vVzMsE3Zh3zttJAlhJh0MsW6OKhHaVj:tYoxK+DO4M7ZDt2dOHnOk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498646, "uuid": "fa572a41-1a59-4887-9589-48630bc78b36", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498646, "uuid": "523df434-8f58-456e-8569-fe8b1136d798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498646, "uuid": "46dca4cb-2788-48bd-bcb5-15728797576a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5475390c-ffd1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685551004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551004, "uuid": "82d9f29d-c0a5-49f4-aae5-34f41bae705d", "comment": "Malware payload (Mirai)", "value": "5b9f09062415cfae8bfae48e2db43d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551004, "uuid": "136aa4d4-5d46-44d8-a93e-5028d037a2b3", "comment": "Malware payload (Mirai)", "value": "0ded240220cc349c505f43d4a9f6403d586bcc9eb94c0317da288f9b81189797", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551004, "uuid": "f5ff9f33-4127-44f5-a79b-3a5427fa8334", "comment": "Malware payload (Mirai)", "value": "856a3abe21774940f5b8b1ed71a38312a876521d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551004, "uuid": "5032d531-7fac-4230-9fa6-58b1f18aab20", "comment": "Malware payload (Mirai)", "value": "bdaf4f9cde51c0eb3c3a55858b6eaf1f4b457491eac44b7654f413ad6b5d16e2a349d99db36559cc3f05803e670827b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551004, "uuid": "e2bc7a19-f229-4ebe-b76a-c1074eed88ad", "value": "T1A0335BC5EA83E9F5EC26007C78669F709E33E57AA476DECAD39D58329802442D30739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551004, "uuid": "b2e98b3a-5893-4f36-b6c9-9028839d95b2", "value": "768:1Pe3EQPs+5JRs3JSx53nFkNlRVOXS4e27luAYBIckYU8K1gmOSHPBnR0DNm:1PeUS+Qx53kIpaAY6cbU89mOqPBnCJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685551004, "uuid": "df9a7d79-9eb2-4005-ab7e-0ff206e43afa", "value": 54404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685551004, "uuid": "23901bce-d02f-450f-8c4c-58627ec22c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551004, "uuid": "80a0cefa-4813-422c-8bd7-e9da5366dc1c", "value": "5b9f09062415cfae8bfae48e2db43d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fa6136-ffbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685543356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543356, "uuid": "87a3799a-3f2a-45f3-8d19-db59c7e46020", "comment": "Malware payload (Mirai)", "value": "ea3f273b3736eb935ca48da13e09e5df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543356, "uuid": "cb4b5e15-35b5-4aae-8a74-d8824093402c", "comment": "Malware payload (Mirai)", "value": "0e2f70a9355e2c93f3eff4d203e0003092a305fb7e4a8591625b13ac85496151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543356, "uuid": "5bb511c5-95a2-4e4f-89a5-005f8b227b74", "comment": "Malware payload (Mirai)", "value": "bc74b46afd4159df6de086c53f36416463226d57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543356, "uuid": "d5377ae6-549a-4307-bdda-c537ff37c18a", "comment": "Malware payload (Mirai)", "value": "54f39d791f8247aba5858ce05db90aa94d24be3ad8420b15e1d27dc54e85e619fa1678a84b95e7a58a7e1b736de664cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543356, "uuid": "39e35a99-e9e6-4daf-9a4d-2937b8433296", "value": "T156F2E12D4606D16ADD3554BF0FA9036EDB880EB6FA62DC4A1542A6808B83071B6B7CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543356, "uuid": "094bf0d8-59d1-48ad-a761-26b3f8d4876c", "value": "768:1/YBLUqA9XH+hfs2ahhDCNKy5Saqn2TddbZwJgGlzDpUYsl:1/0ASfs2aeF5Sao2TTGVqYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685543356, "uuid": "f4da3a55-ab68-4549-ac48-6a51df2c4159", "value": 35004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685543356, "uuid": "945b6050-95a5-4179-a342-0e73421166b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543356, "uuid": "af47b446-1af1-448f-9515-eef1f60d2e3c", "value": "SecuriteInfo.com.Trojan.Generic.33747869.27756.31810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebfa374-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685511615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511615, "uuid": "1543a1e8-17f5-47c5-99ee-b4ac9bbb6bcf", "comment": "Malware payload (Loki)", "value": "67db8431a355d41b2fbc33bb22065990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511615, "uuid": "c90ddff9-0bca-465b-bbf0-6ab4c37f232d", "comment": "Malware payload (Loki)", "value": "0ed203a02f9c7f7e9794a8fbb4871fc8d2aa2e52f59897915c9afb402f768aaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511615, "uuid": "e813bfa3-3fb3-414c-86af-6c228fe4a344", "comment": "Malware payload (Loki)", "value": "168337069f6b9f9c122eff416b27c4c106e11dcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511615, "uuid": "239487cc-a046-4ec2-bdba-dde075e02122", "comment": "Malware payload (Loki)", "value": "186a4beb5db54dc7b6dc1c7cc6d64779284a9f35b75daf1db624585e85413461ecec5676b435bb6de407bc2563c70ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511615, "uuid": "fbb8e44c-ca36-46af-a462-ac380feadf4b", "value": "T1BE444A1392F13D55E92B4B729E2EC6E837DEB2504F69376A121ABA1F04F03B2D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511615, "uuid": "6a19acc0-7f72-4cd1-ba2b-128a39bfd255", "value": "9844fba67f0c450c411fe3395f872b3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511615, "uuid": "f369e6b6-c208-44c3-a4ef-e5f47d3476fc", "value": "3072:1MQc8Kxoa0xVZmVqicAzboXzvFi+Yv0K7hav6QueR45ZVhN1DABa5M:mQZKxCVZmoEkBicx6TbVhka5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511615, "uuid": "80f1f267-03aa-41e3-9544-a74b1e386116", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511615, "uuid": "785d2c71-30b0-4617-a3d2-57dc345ad273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511615, "uuid": "c3107e56-34b6-4e33-bb22-9ce0153719ff", "value": "67db8431a355d41b2fbc33bb22065990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297f171d-ff56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685498104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498104, "uuid": "bd2e8ea2-3434-4034-8631-7f8bf1f8c270", "comment": "Malware payload (Amadey)", "value": "965fc044ae7d09f148ec5e256a672c7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498104, "uuid": "9811d8bc-1003-449d-9c67-4cc486e9f72a", "comment": "Malware payload (Amadey)", "value": "0edc080c89bdd04a8e26524e773de2a140f645469a892e4956d542ff1031ee0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498104, "uuid": "b58ea1e6-4b21-441c-bf32-cb5db47cf09d", "comment": "Malware payload (Amadey)", "value": "7f2f519a183440bb064928a7cc662c68daf729b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498104, "uuid": "a2061763-4cd2-4d7f-ba3c-bba2f8eeae1d", "comment": "Malware payload (Amadey)", "value": "dcfd970d40a846ca64f3d302ba02bab82c70c08e3339d7b634f5d7e24fec85e0d36055516d037cc0a65a65105a3459b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498104, "uuid": "6f1635cd-0b58-416f-b077-7dcd826fd2e4", "value": "T1AD367DA95BAFE119F48BD1337F107FBE4183DDA8769D0224C080925C2B4BB497B959CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498104, "uuid": "d2c356bd-137b-4382-9191-8fdd11092545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498104, "uuid": "b3df028e-5af7-4c8d-b3cc-8eba617bf315", "value": "98304:XdBY9slh4DJF1QWHc5ymiJA7MNMrL3HW4PD25u:XdBYh+WaaSrLD78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498104, "uuid": "9baadfe2-999a-4b04-951e-a1f4ea2f8b0c", "value": 5128704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498104, "uuid": "73f8f68c-cbfb-4177-a7fb-1e0a7b8bef2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498104, "uuid": "7b2b44f9-5465-423a-9819-ca10b5585190", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1435429-ff6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685508264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508264, "uuid": "7fec3e74-3512-4c62-a01b-5f235d7e8ce3", "comment": "Malware payload", "value": "486ce67349a1f31a1426600888d189a9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508264, "uuid": "83adff1b-e7ff-4fc5-afe0-b1729617b7d0", "comment": "Malware payload", "value": "0ef73e1a120d4d6976e8e23488b684f86159c214d30f6dbbc8e716b48674c3ce", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508264, "uuid": "727b4381-4cf1-4335-a849-033341bd1bfe", "comment": "Malware payload", "value": "34d86e06380c2df67608dbf8f6487b5a6dc2d67d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508264, "uuid": "840aa0a9-b1ef-40ed-8a64-4eb9f572bb77", "comment": "Malware payload", "value": "faf13adda8e6adbaeb4d04ff56d6b56c4b49644553037665f8a69bc60f6ece9f165b6979f18be7f9acc1e1d51889dd96", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508264, "uuid": "85ff375e-b313-4224-ae8c-54913019c20d", "value": "T1DC361847F85154E4C1AEE230CA669253BA703C955B3063D33B60F7B82B77BD86AB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508264, "uuid": "0d2c5cfd-6bfb-40c6-973d-b35bcef614cf", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508264, "uuid": "1f163cca-fa0a-47e1-aa08-4023b033c7eb", "value": "49152:yR2JYSU/rZmbmHSyC9lSiKWltiCEjGRzDB2Cv5EcH9XlM419JXjCQ01:m+bAEEiM41TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685508264, "uuid": "f805c94d-1745-4a96-a3ba-c642a0805892", "value": 4907520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685508264, "uuid": "772ad35a-f68e-4c70-94c5-ccb3966004e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508264, "uuid": "c799ce83-b6c6-4494-a3e6-f69e430b9612", "value": "486ce67349a1f31a1426600888d189a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf3451b-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685531743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531743, "uuid": "87965061-1831-4750-af86-6261d7390db9", "comment": "Malware payload (Smoke Loader)", "value": "dd82110eeaa193a98e3f8300c82767ec", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531743, "uuid": "c001c824-a932-49f9-805c-6f7b2c619da0", "comment": "Malware payload (Smoke Loader)", "value": "0f42edd76f7309fbf1e26780e1e3e184dfa6d291ef6516ab8ae9c3107082eb39", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531743, "uuid": "12e9dc61-6be8-48fc-b55f-97c93623b0b1", "comment": "Malware payload (Smoke Loader)", "value": "d076f0956cf11d5204af5f94c7078791cb01de6f", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531743, "uuid": "8086c91e-6236-4168-b620-738a74e53c88", "comment": "Malware payload (Smoke Loader)", "value": "2a47e76d5b35ad3b1a107afd6bc92e389777a15648244faa4e6921692450673b66d14c6f67b09b1874877e8a302f9e8b", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531743, "uuid": "0ebadb45-c70f-479a-bb45-7bbebaafa05f", "value": "T124449E1273D1A871E6664A719E2AC3F8672FF4314F166BEB235C5A2F0E702E1C672345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531743, "uuid": "8fc690e0-682e-4f56-9dae-d0174c7bb0fe", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531743, "uuid": "7bf37c37-b556-43e3-bda7-41596b55b4e4", "value": "6144:jZJ8DquxGbmpTW9+l7kpAPQdo1Hrhg0X6:jWquxGbyWo1PfNgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531743, "uuid": "8a927c98-c65e-4cae-b47b-e3c22bd9bed9", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531743, "uuid": "a964a433-c811-49fb-a7b2-b6a577d91a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531743, "uuid": "11c473a9-2602-4678-86e6-a0b031a70474", "value": "0f42edd76f7309fbf1e26780e1e3e184dfa6d291ef6516ab8ae9c3107082eb39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a0dd1a-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521587, "uuid": "a9d3409b-3f8e-453e-a297-81e39a5d283a", "comment": "Malware payload (GCleaner)", "value": "8580885bc70a758ec8277e5f52f5bbda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521587, "uuid": "8f7c24c0-f891-41f9-a0fc-cf16c235e850", "comment": "Malware payload (GCleaner)", "value": "0f5ad69c262f126d5001c44bd15c70af016f47c05eb4d5c22e0880093e4f3146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521587, "uuid": "6c4a401d-04b4-4f84-8312-5fb31c2334bf", "comment": "Malware payload (GCleaner)", "value": "f010dbab16929059fdeca59c9a2389795dcda4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521587, "uuid": "9fdf0a51-26c8-45f5-8e9d-ac969684e69e", "comment": "Malware payload (GCleaner)", "value": "f5ebc74b62b60cbbe1f7d9e8f77f0e54c0471be2ba41bf871badb3078708d3afcbab50c321016d6a5ee3da679549f06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521587, "uuid": "ca67fe44-ecdc-4b5e-82ba-d86635598ac7", "value": "T15C74BF13B3D1A830E96666719E3AC2A8662FF4710F656BDB335C5A3F0E712D1CA32345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521587, "uuid": "80e307f9-c83d-4c5b-840c-05fee70349b2", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521587, "uuid": "2a474b71-b929-4c6c-913e-c3a2c151d0ff", "value": "6144:dxf9TY70yv+z+J+uMFaYsMBK5jqQAXzQ/TuZXPsh6:dxVm0yv+aIu2MMQ5jOzQLuZEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521587, "uuid": "c1477cf0-1a82-4263-8dc5-1056d490d9a0", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521587, "uuid": "a5df6e08-165f-434a-b92d-4709260fc652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521587, "uuid": "6fe7b798-10cc-43cd-b28e-6d02b854336e", "value": "8580885bc70a758ec8277e5f52f5bbda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ebd794-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685519783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519783, "uuid": "f8eb0cf1-d5c3-4263-86e6-b21c186230c7", "comment": "Malware payload (Smoke Loader)", "value": "1313175470e5c024f9d74e38a4c9ceb2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519783, "uuid": "743ac583-b764-491f-a865-1886a116796d", "comment": "Malware payload (Smoke Loader)", "value": "0f894e06e5216382a7e3dbe449de7900fdd0b489d7e836eb007cfe59c0f41ae0", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519783, "uuid": "4036743d-4f69-4e27-a6f6-55eac11422e0", "comment": "Malware payload (Smoke Loader)", "value": "187cc9dc8436021fde4575afb9a4b1ea2afbb99a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519783, "uuid": "b4cad2ee-2075-4f5a-a0e7-c4b4bf58f7f1", "comment": "Malware payload (Smoke Loader)", "value": "286d0673cfc7c92abb24f6975943ca3119fcaf7f57226e919d7697bab662314c72d4511bd17307e731c9621a41a6e0aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519783, "uuid": "c9cc8d1d-7443-473c-b590-6f1a2dde222c", "value": "T164443A1392E07D54E76B4B729E2E86E8371EB6108F5B3779321ABA2F04F05B2D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519783, "uuid": "07564051-4219-4c8a-b9ca-deb1a50cfde3", "value": "9844fba67f0c450c411fe3395f872b3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519783, "uuid": "e5702b22-a3e5-484f-874a-5e0be6eb4b82", "value": "3072:8dQOczktaURVidryrHdVBtYXlVhO0c+aKBPbtiHr45Zj3d1DABa5M:EQHzkFVgE9VBtKM0c+16HEj30a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519783, "uuid": "03b7dba7-6bf6-4f94-bbcb-de5f3c34558f", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519783, "uuid": "447a2e70-ee06-421a-9d14-fd8b27bca1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519783, "uuid": "00302807-490f-44eb-a157-2429dadbcba6", "value": "1313175470e5c024f9d74e38a4c9ceb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a840166-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520950, "uuid": "edf569a4-420c-4834-83c3-2e3d2c8be075", "comment": "Malware payload (Loki)", "value": "b7add805622c7a9ea6eb868be7804f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520950, "uuid": "5823914e-41fd-493a-8bdf-a5c5d5c4a136", "comment": "Malware payload (Loki)", "value": "101e1bee011696853007ad648c156a881514f517b56667c2e953ba04ffb219f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520950, "uuid": "d9158a8f-3c94-443f-8bc6-deda4984f6bd", "comment": "Malware payload (Loki)", "value": "aa549a317f83b3ea5344d07bf67dcd6d4aec753d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520950, "uuid": "c70f9bc2-02a4-4a76-aec8-f9ce6d06ef3a", "comment": "Malware payload (Loki)", "value": "b11cfdd1723b2515e07feb2b6379b400ae6f3e4bdf48fa2c6262e2b27e2fed4a35a1e715db231d61dce3c655f4b2cc21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520950, "uuid": "fc86b5d6-06a7-4925-9e11-f2d16dcc29ea", "value": "T1EAE4F150B57F0B2BD1BB57F58540A2342BBE569DB8B2E71B4ECBB4D71961F000A81B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520950, "uuid": "9b183476-aef8-4101-8f1e-e6ef4a9432b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520950, "uuid": "29a6dff7-9d09-40d4-abc1-cb2af8b10728", "value": "12288:tV2B0xTGlxNqvNu2hZ+nUEsn9bLelAdpXDk9lka05h0ykCZsJtjcSEnQW:tVLaVUH999n5dpzk9210ykWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520950, "uuid": "f93fbcdc-2d33-4fd7-9e0f-93e10ec17cad", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520950, "uuid": "b8078f5c-7eeb-4076-a3e8-8ca5bb7a7861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520950, "uuid": "b680a7b7-dcd2-4044-8fa2-60b23e9719fa", "value": "b7add805622c7a9ea6eb868be7804f61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67ebf51-ffa0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685530177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530177, "uuid": "cf3943e4-afe4-45d4-81f7-dbffbffc5a9f", "comment": "Malware payload (Gozi)", "value": "47bee23df74ae0ec56188d9ecf633886", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530177, "uuid": "5c3bda94-c1d4-49f7-9c44-7c8cb59ad595", "comment": "Malware payload (Gozi)", "value": "1036fb7a192b5b9dcaadac2f984feacfe7146750116afa27f691f2d5ac4ffbe3", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530177, "uuid": "2d55af06-1e99-4ebd-ad04-8d72dbc9a0dd", "comment": "Malware payload (Gozi)", "value": "66c181a6a39269b07398851080bb2f00571b02ec", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530177, "uuid": "5f99c6c5-90d9-4122-8549-7676f63f3187", "comment": "Malware payload (Gozi)", "value": "d377deba689ccd904bee69dd45aa5cd6baf7608483abeac1c374dd67ed4557a157b8feec114edafcd5c3a185adea7a34", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530177, "uuid": "42a9a64b-577e-4b8f-80ec-98adcd47c24c", "value": "T1FEB412858B128FFCFB281AED143C29CC6A787D753E50E5E1D52B24538D23B6510A3A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530177, "uuid": "1d5c28e1-e6b3-4a8d-98ee-494f3de87167", "value": "12288:P+pNdyBNdyANdyrNdyrNdyc8CEIw52ALeyEiuEitSJxU5TsTGTwQ:0/yB/yA/yr/yr/yctw52AqB0OSJS5wi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685530177, "uuid": "f872a310-7046-4221-93c9-a97b3cebc799", "value": 494204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685530177, "uuid": "eb3b0b19-ffd9-49ff-8779-76b183d52352", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530177, "uuid": "5aa0011d-d75f-40a6-a2df-9fbba2d28532", "value": "clienti.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55821f43-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519653, "uuid": "82279e5b-1629-4104-a40a-5da8192cf7ef", "comment": "Malware payload (SnakeKeylogger)", "value": "6c60453fe8d8d14510d88a2aa9deb625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519653, "uuid": "2337905f-3e93-430e-ab9e-22e37a51e43c", "comment": "Malware payload (SnakeKeylogger)", "value": "103defe5089465f983ce4e96852a172e6f3e3ae5edac58d366df916f0a189cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519653, "uuid": "778560ca-a810-4f1a-9949-b0b56a01dab7", "comment": "Malware payload (SnakeKeylogger)", "value": "afeb0c67c08e425c2786be2a86d1039dcabc227a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519653, "uuid": "453bdede-c941-43cf-81f3-4ff4d4925f96", "comment": "Malware payload (SnakeKeylogger)", "value": "4075e2732e60f3ce49acbf9614d90ebbff6f7e103944a7d90664b4333d8dca9eb8979e073b3856f40a203d8a92e443d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519653, "uuid": "860457f0-65d7-4cf4-84be-7ed1e9f19a68", "value": "T13BE41210EEBF150BE4A6BE7D6B3010759BFCC750902EC1ABE593682FC8999741C62E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519653, "uuid": "4a90c8be-9ca5-4d63-bb00-b48550878335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519653, "uuid": "420c3c93-d216-41a2-8acd-d973202b1254", "value": "12288:BSAMTihh6xhZ6Or4zMjh3cIXlnYF1X5x1IOQakJxn4Wk3gmP75HPuP:bMUgh8y4wjhAF5ucx1gmP7pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519653, "uuid": "e2760cf8-38c9-4a18-b925-f78941ad0f9a", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519653, "uuid": "3af8abeb-da4c-4b69-8025-c790faa8f99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519653, "uuid": "0a74c16d-52f0-4bf9-a6c0-617a4e291ce5", "value": "No. NS2ANNA REV1.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02575a2-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685533227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533227, "uuid": "bbeb4202-9759-4afe-bebf-43b35418c41a", "comment": "Malware payload (STRRAT)", "value": "78c2ea2c13b2c79e06b1f48d8101e235", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533227, "uuid": "35de68c4-1f6d-42cd-8626-83c441c86496", "comment": "Malware payload (STRRAT)", "value": "10dc6cbcc3770cd94b0ca2edbfabe4b915e5b774b1a729be25853fbf7255b331", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533227, "uuid": "7f32c734-12a2-4359-9f4f-c3e37cb5b126", "comment": "Malware payload (STRRAT)", "value": "b4b3717319f29b6b489c7fbe8f9615dd560f1ca6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533227, "uuid": "41b19007-62c8-4755-bc33-4900c05c6077", "comment": "Malware payload (STRRAT)", "value": "f3fca9c7e3e8341e57362dc9aac8734614cb8ed9f51607b31cd2139948a550bf4ba44fde0766fb4bd92d530c5d3d0776", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533227, "uuid": "2f684cda-d00d-49c1-800b-3492db800321", "value": "T18563F196BFE4D17DD2BBF238942C480F3D1B518DF354215B57C284D730948A62A7F58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533227, "uuid": "03c57a68-a6d9-4ec7-bbec-1364168dee5b", "value": "1536:49jvwQKedLK/TbPry78puyod+YSYUqXHqQCFjeyid:gjvTm/TbjMsodf3LBfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533227, "uuid": "fc015237-3d40-459f-92ec-9607035745b5", "value": 72290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533227, "uuid": "bb89eadb-ee8d-47a4-8da0-d5981aed6dc9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533227, "uuid": "332daa72-7a2c-4152-8244-6d335d888adc", "value": "ContractBidAgreement.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07505419-ff8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685521669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521669, "uuid": "1e0a2a20-204d-49ab-bc1a-69f9b593bb00", "comment": "Malware payload (Rhadamanthys)", "value": "be98ab4f5a6ddd455393e55ed472f91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521669, "uuid": "690b65d2-1da4-44ef-8cbf-91fdefffc398", "comment": "Malware payload (Rhadamanthys)", "value": "10f2daa369b198308406e6aea0825604fd494fc35b9bac192cb6049627f4a484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521669, "uuid": "4434530a-e3c3-42bc-952e-3fbf07a7117b", "comment": "Malware payload (Rhadamanthys)", "value": "063abed2d47a32fd4c8349a550fcc404b532b3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521669, "uuid": "96fb8e6a-832a-4e8d-8990-efd9dc6f13d4", "comment": "Malware payload (Rhadamanthys)", "value": "b5d7741c2acef7aca5d0682dde516b713baa4f90e85f007da3a8460b5ba6e46b087e0110a6d2ce1864c2ab900bad0522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521669, "uuid": "09fdfd3c-f119-48d0-8362-dfd799d7137a", "value": "T18FA4CF4392E13D54E52B8B728E6FC6E8771EF6114E55376A22CABA2F05F01B2F167301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521669, "uuid": "b0e410b0-9bc7-43f0-9b64-1745d2e353df", "value": "d4d619a3c5b6358079da73c25b60ff7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521669, "uuid": "9c1da13d-ca70-4e9e-985d-553bf46bbb29", "value": "6144:MLILO4wyV9hO/fCCGGs9Yp4WaSzpcsktbVEJpGJDptcloda5:KCwyV9QttoSzpup7Dptcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521669, "uuid": "9fbc657d-02cb-4244-afe6-36a368746b4f", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521669, "uuid": "71989b45-e74a-446c-abb7-01e45b48585c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521669, "uuid": "fb47cc06-f155-44b6-8378-5be4f873c7f1", "value": "be98ab4f5a6ddd455393e55ed472f91d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0296edf1-ff8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685521661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521661, "uuid": "6b13df3e-6f20-41ac-955e-1e692e8eeac3", "comment": "Malware payload (Rhadamanthys)", "value": "5a6cbe35bd3626ab7d186f63740c956e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521661, "uuid": "947a628e-c5ed-45f3-89c7-d70bb641843d", "comment": "Malware payload (Rhadamanthys)", "value": "1184aeff512cf6da48a3c5357936da4f5488923f2327236be314d704e4cccdea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521661, "uuid": "99832dfb-3c96-43bc-94c0-f4774a283bfd", "comment": "Malware payload (Rhadamanthys)", "value": "ae27730f434a58c113467a99f6f5e9838afea569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521661, "uuid": "aa6f52b3-a023-4ca8-90dc-55c345d62c73", "comment": "Malware payload (Rhadamanthys)", "value": "9adc59023f5fea06d9464ef203555b8c48c2c85fe47ddb09c55fa4b55ef45d9bcaa198898b1f59fd0a71beb95aef7b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521661, "uuid": "872a01e6-9462-4ba7-82c0-f607d0f4b9f8", "value": "T1EA94E112A2E03D2DDD674B718E3AE6E83E6EF6104E19775B220B7A5FC4701A1F263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521661, "uuid": "ea817e90-7bd1-4435-9f98-931ac95b9a2d", "value": "b16c3db38ebd1039deaa7b416b1dd4fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521661, "uuid": "c8617957-ac5e-4cd9-9768-3c31c175eab3", "value": "6144:+K+aP89n8TcV0+1FXrCioSEIZYYTghEQXZD9FMLz6uMXwlrw0n4+vtV65:NPN21RrU4TexFMLz6uMXSrwA4aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521661, "uuid": "9d48728f-20f2-4647-9b76-669387813ff9", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521661, "uuid": "75e2e11a-a05a-4591-8373-6f2530e1f66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521661, "uuid": "5488c651-48fb-4bcd-9a1a-8350762aed17", "value": "5a6cbe35bd3626ab7d186f63740c956e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8a2c9e-ff9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1685527825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527825, "uuid": "9c137c54-8bea-4b04-a5e7-da59d8a85dda", "comment": "Malware payload (AsyncRAT)", "value": "cc54630cfed370da5d83b5c3d0ee9ec4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527825, "uuid": "be26e15f-cf1b-4d2a-b8b7-79a53de87602", "comment": "Malware payload (AsyncRAT)", "value": "1270491bd3068a4159eee0ad8c8d6871cf0ba80cac9fd749a7e9d1c02f6f3653", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527825, "uuid": "321136e3-4687-4248-999c-e4919bdf78d1", "comment": "Malware payload (AsyncRAT)", "value": "d18ba6e2d8e877bc0bec89536087f49a4bf32921", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527825, "uuid": "cf80d44f-598d-4adb-8b2e-128dc602a906", "comment": "Malware payload (AsyncRAT)", "value": "7ba644354418fe46b3b14230d40cceeb75a9cfbb65cc57e113a4d4fe8954d945722946187483a848681707f67dd18c33", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527825, "uuid": "9d39d319-a8ff-49fe-93f4-3dc35215731d", "value": "T1CD44D327A6BCC5E2F89D3CF9966853245AB0ADA34239E247D84FBDD1E877353C1011CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527825, "uuid": "66a09972-d6e8-4e0e-96c6-0384ba56f3b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527825, "uuid": "7477e8de-b25e-4aec-bef3-0e2526e275e5", "value": "3072:FRsjupfBVcoFDzbtu/c762soY8zyCy0A:MKxBVjF3bc/cpsoYSHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685527825, "uuid": "89dfd946-0f02-4ffd-bfc5-119706489cd4", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685527825, "uuid": "7d1a47ed-2918-4762-9ca1-fb82472f9e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527825, "uuid": "70cb87e7-5520-4cda-b465-65520f9af775", "value": "SCRSHOT02.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cae859-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520935, "uuid": "cc5fadbe-5537-4c8f-acc8-b0223e93b4b8", "comment": "Malware payload (Loki)", "value": "129ef3ee1c1d4388d430f08f65e20a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520935, "uuid": "2396a9fe-6695-41fc-8bc3-1ff57d0a9d83", "comment": "Malware payload (Loki)", "value": "1290e2fa7dd284fcddc2bf9caeac02ccbae1f1e715766eefd7644c245a6ecc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520935, "uuid": "a5dc8cad-9861-4803-a497-d37dc8ec9992", "comment": "Malware payload (Loki)", "value": "ce59be8a0f2e5414d86e1394fbcbea43b9cff530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520935, "uuid": "eec9865a-ecc3-42bc-99bd-f7b535115282", "comment": "Malware payload (Loki)", "value": "db685c87ae4bf88fdcdb8301b7f04d894abe9a86da8f5accfb40bec324e9d6248a1fd7bc6525d82edd4be9e11eaf707e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520935, "uuid": "8e47180c-b5c7-4b51-8688-757070cb892a", "value": "T15CD41265EF7F170BD4267EFD8B3884B1AAECDA82403FC69AA9571C2FCC459345C91092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520935, "uuid": "900e112f-56c9-427b-ad08-58a4c3efb64c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520935, "uuid": "e642c25b-d31e-4033-bdd6-9836a9335411", "value": "12288:4jAMTihh6xhZ6OrzazTM5MgtOnENBNp/B4mY40nQ6OQwDq1qm:nMUgh8yzanirtnNBNpKmYluVq1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520935, "uuid": "fe2edefc-08e7-4215-9375-46e0eed94b45", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520935, "uuid": "dc914c3b-b01f-4e97-9766-7ccd78f89d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520935, "uuid": "8b9f2ab7-23e6-4597-aac6-d8c4567557b6", "value": "129ef3ee1c1d4388d430f08f65e20a50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04f045e-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685511618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511618, "uuid": "22fcedca-93a8-4115-b3b0-36383a49acef", "comment": "Malware payload (RedLineStealer)", "value": "8f3e21d3d15b6ea17b573452d7857c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511618, "uuid": "23eb3f7c-18f4-4c0b-80d4-eb8c09240cba", "comment": "Malware payload (RedLineStealer)", "value": "14357575e409e06a45243465cd697a6c22f847968fcec7e5cd9238aa9419777c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511618, "uuid": "78aeed76-5b7c-4586-81c9-58b2689a4c66", "comment": "Malware payload (RedLineStealer)", "value": "3fbde3bd6f2f2001b8cd242cd9d68307fd140f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511618, "uuid": "59ae71d8-e51a-4db6-84a1-4d27c75e581d", "comment": "Malware payload (RedLineStealer)", "value": "dfc452ba6f2cb9a7a3fe8fb5a7284c8a53fc84cdf88e3572bf7efc051f2299380cada10f0383c5c38abe1f401992b484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511618, "uuid": "2d2b87a0-aa53-48ad-ac26-713daf7e7a8e", "value": "T15185F431C5E71E07F032BA3DFCE2B376557CF5A26B1BA5B655802B496A0B9C0CC81636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511618, "uuid": "b834c00a-0587-4a87-9ecf-9e357262ca78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511618, "uuid": "e43c9356-ea82-4bb1-9f07-eb804c47f977", "value": "12288:n0Hef2besfNRcrPNWdLBOr8GN54GiSdeiFIblEIwoZEsDbqhuhDW:Wl60wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511618, "uuid": "a7552c13-9815-40b9-852a-5964924a0f4d", "value": 1812992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511618, "uuid": "d7ed301c-d5d2-43e7-9f9f-a09b5257bbb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511618, "uuid": "6d6b72a4-67d3-4000-8dbc-2f69bed6afc0", "value": "8f3e21d3d15b6ea17b573452d7857c16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39aee3f-ff77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685512536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512536, "uuid": "b2ea84cc-d79c-4b7f-86e5-5f2d467c1011", "comment": "Malware payload (Formbook)", "value": "7f05cfeef59412aa055cc8dc2535ccf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512536, "uuid": "f1055a1f-fa5c-48ed-9b3f-326544cb519b", "comment": "Malware payload (Formbook)", "value": "16c87c0de9538e8cac5d187949b3fe9b1a11ee1ed2bcdcc726ea47115d6701e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512536, "uuid": "e9006394-28fc-4431-8281-ba68373d8750", "comment": "Malware payload (Formbook)", "value": "49b5fcca80a8387d2ca6507bf9aa0f5155fc43e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512536, "uuid": "1fe251f9-0b2a-446e-a3d1-22c77f345a5c", "comment": "Malware payload (Formbook)", "value": "bd5306ffb7ae95280c1209cf5c56cf48032ff84e5b817dc48a89e4bbf2643181d3f21b5982b7c73eb8c6c23c94ef425f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512536, "uuid": "2161f27e-7fa6-4a00-8a00-d428f2f04037", "value": "T11845D00863764797E03A2BF1C6692E3443B0197C34AAD7D4FED276DBA9A1F910833617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512536, "uuid": "4ebc7736-ab34-48bb-bb51-0fe3f3ecbf34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512536, "uuid": "0d4a9155-84fb-4235-9db5-a82d58fb0dd4", "value": "24576:xC6iLaVUH999xcPja8ywiNC/qTdSYQeiW5dTD0:o6cBH9qj54eQQ45dTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512536, "uuid": "4834eebe-9ab3-4b83-924d-075efc1045e2", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512536, "uuid": "ce86c03e-1de1-4bf6-964f-93996b422682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512536, "uuid": "be24c786-fd70-4a08-bdcf-1d712d688502", "value": "Receipt878673 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9264ae7c-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520185, "uuid": "74377632-9be8-4b7a-b423-05ee7887911d", "comment": "Malware payload (Loki)", "value": "d3d2e4b58cccf99daa192b11c6ed9099", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520185, "uuid": "7af2899b-142a-43a6-be19-fcd59cf15c7c", "comment": "Malware payload (Loki)", "value": "171d36967589f4cfad8ecef0de7d9d7053bb4df322818ec68a548fa993a6bccd", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520185, "uuid": "3da0a04f-c479-418a-8163-fa21929f3174", "comment": "Malware payload (Loki)", "value": "132de1ba2f251e6c4e03e15f8bc233b72a471dd9", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520185, "uuid": "2ba26291-07ac-48fe-8acf-fd9844da9812", "comment": "Malware payload (Loki)", "value": "ceafc3444642e9c7beb64ea1ca40941a6d97e1e505c9d56433e45bb5fd2c7de24ee78552568d95f49c926de8a3924db4", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520185, "uuid": "ee954110-0772-4ed9-aaad-ca58e5913a3e", "value": "T1F9A31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520185, "uuid": "968a94f7-abd2-4130-97d8-fbae0be56ec6", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520185, "uuid": "95af21f4-9470-41c4-8f8b-90f473f2b398", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520185, "uuid": "7857c2f3-fbdd-4f82-bf0b-58ca4b0f87d4", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520185, "uuid": "7c29fc61-46c5-4a0e-a3c8-f01e872b4626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520185, "uuid": "bbd752b2-bba1-4524-8a4f-e664e96f91d2", "value": "168552018318a4e88973d2cb353844acc988278b68cdf70efb80429131c9f6626308c2e49d695.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8758e70d-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521025, "uuid": "05f3ed3e-8360-48f3-b312-f834274e9557", "comment": "Malware payload (Stealc)", "value": "494d6a9bb196ae12207d45fa05c9e475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521025, "uuid": "649f66c8-6d08-41c6-bdaa-d4d1692cae67", "comment": "Malware payload (Stealc)", "value": "17652d33f21e1d3b977e02389d90e796e3b3e0fce1e910f2e9a8fb14b4548ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521025, "uuid": "1eba2423-c036-454f-9893-2ebac2b90dff", "comment": "Malware payload (Stealc)", "value": "c538151d186f2e0ff4034dcc7f66a10587d1729f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521025, "uuid": "5b18fd99-87ae-4c99-b489-77d799bc1f51", "comment": "Malware payload (Stealc)", "value": "20dbf987b9dd8656ca1415580147aff008d14ca2b4a20842abd907285b00414c8a073ff58296f2a3d44a6cecbff9f7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521025, "uuid": "3c831574-bf35-485b-aea9-25b81f440423", "value": "T12B643B8262E17C61F5264A718E2EC6E8771EF9618F5577E72318AA2F08712F2C173731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521025, "uuid": "7dfed1f8-646e-4317-a12e-d986fb38e632", "value": "7826118a518ad3bb6f3d483135c427db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521025, "uuid": "9a1833a7-3979-46c6-9a72-10f889e1bf3a", "value": "3072:znmYhJSd+BNNJXWBOAjKATP66ltkcE3aBpREmNrCJBEtcjt/ajAu1uCNgOXU4fdS:Tmsc+vAj7P66lqcBpREm9+BK8u1uEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521025, "uuid": "dec4ba47-7099-4d5b-84e9-d7b8605f6545", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521025, "uuid": "53f33472-9b29-4958-9021-659474009f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521025, "uuid": "ac0fc0a6-9770-4f69-8599-c616396ab7d9", "value": "494d6a9bb196ae12207d45fa05c9e475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fada4b-ffa2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685530678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530678, "uuid": "2eac1a38-2ba2-4998-a59e-169bbbdd8d3a", "comment": "Malware payload", "value": "84e70a2bba3d81ff6b67bb4166fdf280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530678, "uuid": "3b5df704-b073-42e6-aa13-f7d1aad69441", "comment": "Malware payload", "value": "177aae6a0cbb44a8b631a08f71613b5bdd79df07f9d8885a3174fe4ca664bcdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530678, "uuid": "5712612b-07c4-4f1d-8562-e75febc96355", "comment": "Malware payload", "value": "0a82211227ffc087b09ebdf33f5435c8293a1c18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530678, "uuid": "251e93b0-305c-4451-85d2-9421fb827cb3", "comment": "Malware payload", "value": "0412764ed2da53c3c92630d0fa56c50ccedc1d3b569bae588746d4b02622866294630cf58b3d20e607fa82c81701dc75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530678, "uuid": "28a61705-c6ea-429e-8ca0-81345c4cd477", "value": "T14D345A24B5C18032D473A43249E4C7B80FFDB8618BD969EB6398776F5F342C1A634967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530678, "uuid": "9b8b1d90-0156-4eaa-896e-b0bb6c40c389", "value": "5d6ffe24e2ee5b0f65ecc48d2225d7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530678, "uuid": "c3f30f2d-a05c-4f1a-923a-05a3ad67e216", "value": "6144:sH0RRx5PRAOsuwgbKtPFUlWJkAOwwU0cC6g6v66666ES66666E6kD66666E66gDR:xj5PRAbuekk0cC6g6v66666ES66666E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685530678, "uuid": "68011e5d-7178-41e8-b403-c8cad401eea7", "value": 242056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685530678, "uuid": "528f2897-dd4d-4478-8520-eacea74fc82f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530678, "uuid": "e84d8218-04ae-4f46-8a5f-b5ac8f2aa907", "value": "84e70a2bba3d81ff6b67bb4166fdf280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707e8a8f-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533872, "uuid": "cd9b0e35-55b6-42d3-9e74-5c54b648dd06", "comment": "Malware payload (Mirai)", "value": "7e750ddbbded6708116fc008e77658c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533872, "uuid": "04e381f3-7c43-4fe6-8ad8-99855b0c6468", "comment": "Malware payload (Mirai)", "value": "17f030e3d9deef64b93e7af8d7fe43e49fa573c2f2a8251b551fa2e3e6c6e564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533872, "uuid": "6042c1b4-1b2b-47b2-a552-dbc4d8fbd4d3", "comment": "Malware payload (Mirai)", "value": "ab7d84af43ded3bc68c27f63c1fd1b19f292fef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533872, "uuid": "46bcff72-beea-4549-b315-164b8fa99547", "comment": "Malware payload (Mirai)", "value": "7f87ed79efedbfd0c0f680fb9b8456a52434fae280fabaf41d88094fd3152d3bd1070627fbc3c0c2488bb6318a65304d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533872, "uuid": "61aae507-0d5b-4a64-9b76-9b0aea927989", "value": "T1B9232841B30E0A43E1A76FB46A3F17D6A399F95031E4A584264DEB4ED631C334ACEEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533872, "uuid": "40310c46-f40d-4fda-9bd2-879c0b06aac7", "value": "768:8TsGnbO7kw1oylD8W9FxzZYjKfoPe13BFqKtaMmIv:6bO7kw1pltFpZoKAPel2KQMmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533872, "uuid": "aa19fabc-081b-4746-9d27-fd00a8d7e41a", "value": 46516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533872, "uuid": "6d9246fc-96cc-484c-8a30-8d26727a2722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533872, "uuid": "d98b82e7-5c34-444f-a3d2-1361a8aba0c9", "value": "7e750ddbbded6708116fc008e77658c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abb6771-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519662, "uuid": "cab02b30-2884-4088-b2db-a8df4a4c7f39", "comment": "Malware payload (SnakeKeylogger)", "value": "f3c71815d4cc54f38c55d7f50b731a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519662, "uuid": "651b5685-783a-4d4f-8f97-632d909694d8", "comment": "Malware payload (SnakeKeylogger)", "value": "17f7f996c93bae1f623112911ebcc72de56b2c6bcc922c206241cc25c487e5b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519662, "uuid": "b2fc4c57-0f79-484a-a656-8f75e739c638", "comment": "Malware payload (SnakeKeylogger)", "value": "8dba7a30473da8a60339d59f2bbe5f05a7dd7465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519662, "uuid": "e1ea9ba5-68e9-436c-b56f-0eff37d24ab6", "comment": "Malware payload (SnakeKeylogger)", "value": "8d713b40eeb9ecc29b78a9fe61a1a7507ca733091250f332fcb41931be2123c90b671364fabfc18015212f10985e463b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519662, "uuid": "32d1da52-f29a-4870-8912-126e8928fefd", "value": "T16C42B615B74988A7E965093198A6D3C00379BEF37C53A71FFE84360ABDB16478A81DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519662, "uuid": "30e2c5e4-f31c-4827-b545-160a5247fa16", "value": "192:ri0jBBlf1OkHWhxB6wT/ZlFLRzdFjCLe0UK:riMBlf0zhvVT/ZlFLRzWLe0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519662, "uuid": "e2645de0-5bd5-4255-b316-2475f81a5b61", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519662, "uuid": "b78f3048-2e40-4f8a-ae1b-3f5dc224cee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519662, "uuid": "e1723a75-fd18-4c23-acbd-a017c66b2272", "value": "Lahurwf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac7678f-ff73-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685510776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510776, "uuid": "2ac53ba7-fc74-4734-b5b3-dee38f613ead", "comment": "Malware payload (AgentTesla)", "value": "b38f30630c599a64feface7bdd4e2040", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510776, "uuid": "bacdf984-fc8d-49c5-9d69-69033fc58f33", "comment": "Malware payload (AgentTesla)", "value": "19d89eb7dffdde1f430586fd0fbcb87e5e6b7bfc3ccb9ee1a80dfcf92c30c94b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510776, "uuid": "f6c53b57-5f2d-42c0-85c7-4d0cf5711585", "comment": "Malware payload (AgentTesla)", "value": "7447fe8bff79606dc0d3d720b43ae1abf3d0405c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510776, "uuid": "9f277dd0-ab34-4d71-9399-1b47af1c04c2", "comment": "Malware payload (AgentTesla)", "value": "4b970f98c19f8e02187d070dcde3b71d7564722faab06491a64a0075cf2c0a32f59658870658f07bc39297909e669dd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510776, "uuid": "de2609f6-8897-4197-855c-62d8ff1153e1", "value": "T1BB050154B0BF5B1BC5BA47F58500A2354BBE599EB872E31B4EC7F4C72521F164A80B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510776, "uuid": "191a6baa-976e-4f70-81ed-13d15aee4149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510776, "uuid": "8c665ab9-8e73-44b0-8b69-8ef6e385583a", "value": "12288:UO2B0xTGlxNqvNu2hZ+nUEsn9c3O5g2GHfVPBZHFOGlJvDhVqF57noN6/8:UOLaVUH999Ij/NFOGrOLj/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685510776, "uuid": "bce4bfff-460e-4b8f-800f-f5e296103a58", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685510776, "uuid": "5d9efccf-b7d1-4265-a8a7-02a485a64c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510776, "uuid": "c08f3210-47c1-472e-b0bd-e80c948106a1", "value": "b38f30630c599a64feface7bdd4e2040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f430883f-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "77d88edd-769c-46ad-8024-0edfb475d67e", "comment": "Malware payload", "value": "f610824a39614c2ecf2586bcd19f7392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "1c5d7132-4287-4a36-875e-6b16c676c45f", "comment": "Malware payload", "value": "19fb055a7307a182cad96404f97150dfe64780b1e67ed66edba86fa34b053f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "5ebd150b-c1de-4e75-a887-5a5f6f0f6bc5", "comment": "Malware payload", "value": "37626b5aadf62b3e44613ef3ede4cb3326383c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "91a322e2-9057-4922-9883-28b2d6bebb78", "comment": "Malware payload", "value": "f464032aabb77532219cede772bb4bebc5717a391c3d3de36dd129ef523b9f78e6fb9060c2fd9e254b2b1e4948a55158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "d745a35d-0558-44e1-89e7-090d90e9f90f", "value": "T1E695332F54879BA2E9AF367936B54CAE5804F8DA705CEA040D35C573E78CB63230D19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "a5d0e5b3-d52d-4f96-aacb-ef54654d5b3c", "value": "49152:DWzqrcuCCsmdyADJ1/thI4L1IuhOebvC9Tc9o0kr:DbcuGWyADhhIab1bveceb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521637, "uuid": "84278c15-5f39-4941-8133-ce9c34d415de", "value": 1887627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521637, "uuid": "eda05c41-fd79-4097-b5d3-81d8d4892b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "7f5505ea-aa7e-447b-8b80-165218984d1c", "value": "f610824a39614c2ecf2586bcd19f7392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6aa760a-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685511629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511629, "uuid": "1f5f5a2e-c44e-4f62-9285-916c65a0296e", "comment": "Malware payload (DCRat)", "value": "a29004d57b0582196965b9344e0eb7b4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511629, "uuid": "fbd0a4e0-3c94-447f-9f3c-eea2e6d57fe9", "comment": "Malware payload (DCRat)", "value": "1a659b2d6922bd1ea186c53148094c26733368e9099ea037a83912c02a59d410", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511629, "uuid": "0255a3ad-795d-4534-a568-628f597598f9", "comment": "Malware payload (DCRat)", "value": "6e0ab8638b3559750dc40e4c23623552d84b5d8c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511629, "uuid": "2cfe8949-18ce-4abc-aca0-2e281a343b85", "comment": "Malware payload (DCRat)", "value": "675e226daf26800b6eccc665287c73439cd9117ec48321d60a3458c1cde43fea3a0ee51f9eb4cd1e5394fc042ed5ebaf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511629, "uuid": "cc75b0ee-c74a-432d-b3f0-c526de18e51f", "value": "T15A0633979F54BB91C0181ABCE24A2BBCADEFB0078BC5594E4D9F4078C6E1853AC4A71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511629, "uuid": "779a0447-5508-4a94-b057-709d623c5964", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511629, "uuid": "8ab0e92d-def6-4e70-8323-86fe6fb13edf", "value": "98304:XFXg7GTzJBVeXbdAWTUjpI5q05tzpMpKcvA0T:XFw7CzgXRAh9O4K5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511629, "uuid": "6d509145-0141-405e-a686-1aacb8a516c0", "value": 3697152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511629, "uuid": "66565965-aa21-4749-97b3-0d9521a0835e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511629, "uuid": "70fcbd73-57dc-4ae8-89a0-9e35ea77ea92", "value": "a29004d57b0582196965b9344e0eb7b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4f4984-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685520600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520600, "uuid": "1df02b5f-634a-4dde-ba23-d59253240aa7", "comment": "Malware payload (Formbook)", "value": "8df850063d06f8256e0ba97a0b5100da", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520600, "uuid": "6596b678-1b70-4851-893e-05c7c17c1195", "comment": "Malware payload (Formbook)", "value": "1a7cb176a2a06673ab935e620b6931eb7d2ffc2af157ae9cfbedb6b7f3bde072", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520600, "uuid": "0b8c3951-38de-4a5e-9f67-c3efa24e482c", "comment": "Malware payload (Formbook)", "value": "a199f4615695658dea2a2ed3b4f563cfa698b653", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520600, "uuid": "817ede96-41d4-4391-88b1-24cd89b8556d", "comment": "Malware payload (Formbook)", "value": "6a0a62468abdd344df01c782b10ef8342b26fcae9089e3b3ac92323d3673dffd7a7d32186d1d6aa866c2317bddd52ca9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520600, "uuid": "adc421b9-1ed3-412d-90fd-584b726ddb73", "value": "T1ECF41251DEBF5B0FC5B67EBD2B708070A9FCDA40943ED59EEA8A085FCC146316C91262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520600, "uuid": "bbff8538-e144-4bc4-adca-9ab609591378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520600, "uuid": "b2fcb626-2c16-4441-a55c-02f1e88abb62", "value": "12288:uRAMTihh6xhZ6OrkSCAdqOxKsLg2EbtHbdXnhAJwbPH0xcGK+:vMUgh8yk2LQ0g2EbtHdmJ0PUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520600, "uuid": "96590ca1-c6a8-4f80-b931-7727727eef54", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520600, "uuid": "bed5a17b-395e-4ecc-83cb-c3f29cf97b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520600, "uuid": "4fc4aa61-ee5f-42f0-87aa-3e9f0bb471e6", "value": "DB_DHL_AWB_001833023AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a71cbf0-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533942, "uuid": "77cd134c-8045-4022-93ed-93eb9a6c433e", "comment": "Malware payload (Mirai)", "value": "97a14463ad2c1eff75af95f855646acd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533942, "uuid": "73b36190-5544-477c-93ef-2560a615e1b4", "comment": "Malware payload (Mirai)", "value": "1b00c607dd87d816fed225e6a23433aee07676588f998406f1ac4ded40c2678c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533942, "uuid": "15837c53-684b-48e5-8c18-c955ba173040", "comment": "Malware payload (Mirai)", "value": "98b159ab022aadc723309ccfbd5f820bc7dd41d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533942, "uuid": "8cdb9b65-c921-4b66-b582-de64068c9d6c", "comment": "Malware payload (Mirai)", "value": "457a3266a9d8665ea895143f4a46c52eabadefdb3a9e2c51cd944152321a98f6bf3ac0dd5ebaaeba5a023a38b6a951d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533942, "uuid": "8055a386-755e-4875-9de8-76d4a8e7c41c", "value": "T101438C77E41A5E64C4490670B4608EB41F13F5C843972EBB19AAC275A487FACF911FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533942, "uuid": "e15f22a3-6d69-495c-a9c0-97e5c217cbff", "value": "1536:MGafjn/9Js5lmFhq17f5KYCNvnpSNpPooCLx3DWS:1Ajn1Js5gFWDAYWSNpPoosDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533942, "uuid": "2ac25651-87b8-45e0-a717-02a09fcc5a15", "value": 60132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533942, "uuid": "a937f155-bf2e-488b-b681-601358bb4e90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533942, "uuid": "25ccea0a-9e92-4ac3-ae45-48ec7c56ebfa", "value": "97a14463ad2c1eff75af95f855646acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeb840b-ff56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685498402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498402, "uuid": "943f05aa-a701-440a-bcc7-9e52c97c9138", "comment": "Malware payload (CoinMiner)", "value": "4aee9140f40798773b516466f397893a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498402, "uuid": "283eeea5-85f6-47a3-8e1b-65f960e8dbe2", "comment": "Malware payload (CoinMiner)", "value": "1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498402, "uuid": "1edfead2-5de6-4278-9de2-c00a3a6e22bc", "comment": "Malware payload (CoinMiner)", "value": "e248178106a73dffcfc834f86a0c5f57e994fcb9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498402, "uuid": "653c46d7-2752-4470-8e4f-938ade60c467", "comment": "Malware payload (CoinMiner)", "value": "4d9a9f46a81c33ee4e97853b3d4cef8ecceab0b9f1a09afacf4a3ee697ee6634f1baff4b4c954da1a06501cf0a4dbf8b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498402, "uuid": "cda090fe-85cf-4d26-924b-a504285a500f", "value": "T11206237257C1BFF9F7654D34D88A2A040DD02FFB969890A8F8C475EBA2B8530D995CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498402, "uuid": "dbc595ef-e21f-43c2-a846-00ca5bff9838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498402, "uuid": "f489a369-f26f-4f8b-befd-ae537e5c1376", "value": "49152:YuTiUKYwesC9m4Ysks/YQmd3g9gOa+smNaA5ZbDAIG:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498402, "uuid": "5301876c-e90a-4a60-b6a6-d46db4a7aeab", "value": 3857920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498402, "uuid": "f0d8590c-c4d2-46e8-9299-22bae54c2d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498402, "uuid": "dbbda444-bdfa-418c-8764-44a15d084f02", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ddd50e-ff7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685513966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513966, "uuid": "e8c8af14-3478-45e9-9b17-9a123ea6b175", "comment": "Malware payload (Formbook)", "value": "84ed99aa697d4253df761cca7d4c2334", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513966, "uuid": "13905b19-7077-4e60-b1a6-635dfeed18a4", "comment": "Malware payload (Formbook)", "value": "1e7fb87cf1590c576f83a7d53ab647076d64417277867c3d8f1c19d85d444dbf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513966, "uuid": "d1655168-7c64-4d31-ab85-214eeb095614", "comment": "Malware payload (Formbook)", "value": "e3adf9376f6b7d019cc7c1589eef986ccd76a7ac", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513966, "uuid": "d4c8f47a-44f1-4ab5-b533-92f8f8227ed6", "comment": "Malware payload (Formbook)", "value": "66ab0ac75473010212ef82a778d737feb72ae3a26c5952e42bfceaa426995369b108229279e1468ea95cef605ae4bdda", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513966, "uuid": "7cee6c97-8a01-414b-b1ef-5da329e7dd4f", "value": "T1855423AD1F32A21188A42E3D13B8AAEC61F72245FFAD74C76E413754FC415ADDB6C884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513966, "uuid": "1db707c0-be07-4529-9fdb-6f1b300c3bce", "value": "6144:zhZlzAdqk9Xcj1K9CauZBpcSBSVsT/MFQW81fOMd/e7wARDLRo7yuO:zhYt9X9CauZB2SBOUSY1mMk8ARDlkyuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513966, "uuid": "bdf7b02a-ac2c-4a43-86f8-4aafb7564ed9", "value": 284594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513966, "uuid": "b4efd151-16cc-4050-8472-c9b58b63989e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513966, "uuid": "7114e149-5b11-48db-a567-89b03d46e370", "value": "indent- 40120517.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c78d530-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685520550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520550, "uuid": "e8bf6206-e858-4301-bdfe-5099ba1ba30a", "comment": "Malware payload", "value": "84c585cb3ee2c73faa4be1f21db24aaf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520550, "uuid": "17431690-b445-4c0f-81b7-6e297d39dcbb", "comment": "Malware payload", "value": "1f638a94c7425ece6b51870d19b6feffb9c990b8a803ce201d6144436f394522", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520550, "uuid": "685cb9d1-ba36-4be9-b4dd-f8dff9a06559", "comment": "Malware payload", "value": "c1e5ce404b89c3dfb7e6c041fb5fb7b0eb96d0da", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520550, "uuid": "e129717d-3a7f-4e53-a243-6c79626fe6dc", "comment": "Malware payload", "value": "2b1fc48c849bd0d680fa21d471921ea3325430416482c01c4be2093e22d8228174f9e70bdaea33314cffe38aebd4d388", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520550, "uuid": "4cd705ff-13e4-421f-a7aa-aa5942660c86", "value": "T110F2E85AE79B02A98F511372231B0E899ABCB22EF35555B1746C833433EDC3D06766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520550, "uuid": "f0aff902-c20e-47a8-b2ab-9f85642e46f0", "value": "768:VFx0XaIsnPRIa4fwJMlJpNayNDWcdFKvNKQGBHZQ9LhCrl6wvr:Vf0Xvx3EMlnNDev/GB69LhCJ6wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520550, "uuid": "e7d65eed-2ab5-4397-8852-e3ce92d9b1e1", "value": 36725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520550, "uuid": "e3b33451-4b92-47f5-87ff-f86411d83d6c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520550, "uuid": "92ab4034-debe-4a29-8679-d782dcb9203b", "value": "shipping documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeeb41c-ffb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1685540420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540420, "uuid": "f536c81d-595f-44bc-a101-4942ae498151", "comment": "Malware payload (DarkCloud)", "value": "75f11ea92cec5f07f569cc1c44f8f7bf", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540420, "uuid": "57e02dee-8072-4da3-b621-0f46c839c67d", "comment": "Malware payload (DarkCloud)", "value": "1f86f42e9b3f949288c425fb5e3a57a6977a0c529e129a84a9c1935e4a2a2482", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540420, "uuid": "f1655ea0-b9ff-4bd8-9705-6d5da8ae7051", "comment": "Malware payload (DarkCloud)", "value": "42bd1f092fe5239d8769d7d18bd78c3014a6dc77", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540420, "uuid": "371d6b11-3322-4920-b91f-948de456a7e3", "comment": "Malware payload (DarkCloud)", "value": "e35330eb93cea24f372b9f1aa7b3e2396735ea3bcaa81706606b2c93ace6ca346df58375461760b732c926758b044ab9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540420, "uuid": "d661b495-501f-43ae-a1f2-22e22124ef5e", "value": "T16094230237E081B7D5B357B2B5281BB16BB4A75BB0A56317F3A01FE83630953ED196C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540420, "uuid": "b783603f-18b8-4ef5-9e64-5d18b64c9db2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540420, "uuid": "afed6889-3012-4b6a-a3ad-85364de1381c", "value": "12288:FYUsTtxKPYcLBdmJ+7ro4HejtiU/ErSD9Tg0NOe:FYUsxESJ+A4+jUM9tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685540420, "uuid": "258e66ac-b242-403a-8d78-fa15a07ebb65", "value": 446688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685540420, "uuid": "91c469c8-b265-439b-bf27-b90325eea501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540420, "uuid": "d9a14280-1031-4f0c-9def-9098841b35c0", "value": "Original Docs.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107ab581-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685512665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512665, "uuid": "337c2901-08b8-4345-89d6-01c9e1c54e18", "comment": "Malware payload (AgentTesla)", "value": "ea4a5870ea5b2417a6ac0bbc7cc44be3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512665, "uuid": "efba2108-a1a1-4291-af97-5c6b2c0726c6", "comment": "Malware payload (AgentTesla)", "value": "202494911805344069ceb189e70db6f89e17f55febe24dc4f42b3736c5b457a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512665, "uuid": "9d14e0d3-7f41-4a34-8fd6-063909209bb0", "comment": "Malware payload (AgentTesla)", "value": "5e605904d1b0c797aac2b798319bb0c145a1b646", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512665, "uuid": "61f637c6-cf9d-4471-bb9a-6e8336603beb", "comment": "Malware payload (AgentTesla)", "value": "fbff308bac0c5e43ea1891018baf99a416d0f22fad11eb0e0202a32cbda23e7b9d4cd31d92905e73212ec96009a3654d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512665, "uuid": "40abde26-cedf-4644-966e-250183800cc0", "value": "T18B05F158BA26368FC457E9B58E341C74EAE8E467432FD257E00719AEC90C9B6DF500F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512665, "uuid": "fcf0ddd4-e723-4d23-a1a9-7b63e33151f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512665, "uuid": "68e9dbae-8d5f-4dd6-9f3e-7512df41f17f", "value": "12288:zAMTihh6xhZ6OrlZKZXzlKwkHaG0M+NHG12wQ0l2qaMMJfiRoCJqJ7gwJBT3qrb+:0MUgh8ylZKhRC5J2Qle9JKRFJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512665, "uuid": "420a5a97-12cb-4d58-88fb-392cf0e03a7e", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512665, "uuid": "7d01a2bf-38e4-4ca7-8aa6-8362360e5b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512665, "uuid": "5ead90a3-d783-4622-a5e2-20bfed738bbf", "value": "DATASHEET-VALVES MA9881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698d8865-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685520116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520116, "uuid": "e66fcc85-55a8-4c4d-8005-b5588bd91899", "comment": "Malware payload (STRRAT)", "value": "5d5932a62a46406559afc555b3b95b82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520116, "uuid": "78644e15-bc17-47ec-8d32-de3d7489859b", "comment": "Malware payload (STRRAT)", "value": "21625ba6d5ba253335cd16769dd8ee27e1c6a2fb9fb02fd357bbff7fe697485d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520116, "uuid": "90c6dc52-e4dc-4137-a583-53afaf609742", "comment": "Malware payload (STRRAT)", "value": "1210710840b72b1559791cc498bd2cef2b18be87", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520116, "uuid": "e12cbdc3-35d1-4245-aef5-006fdf1ce2ea", "comment": "Malware payload (STRRAT)", "value": "48cc0bbc0cd02417b928b9cac661e1899eebb2ca6ebe378ee575441db0f380e48a2f1dea1c25266bab7665181e49a4b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520116, "uuid": "f8e55ea0-8add-4d0f-bef7-610934ea7ad2", "value": "T1FC745958B9C70B1F867E5814B19E0EA949A2C54D090F93ABD5A3AFCEFA23D7C04071D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520116, "uuid": "5aff8843-da36-4345-8dcb-f09a71286365", "value": "6144:6xYZDc/nDOs3+LI24JPwMspRU1AyUZlbHmx4bcc3iGlZwKjPCBhzlu7LYUu50dXH:NZDsWAJGyUvbHRc6dc3YASlUQd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520116, "uuid": "7470e60a-4a2c-4940-b7c7-0d8a8dca5fee", "value": 351971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520116, "uuid": "411e3c4a-7d6d-4320-a77d-4f1d9a237b66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520116, "uuid": "77770e0d-df7b-421b-ba7d-b64567ebe2d6", "value": "Purchase Order RM23050289001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14fa1e8-ffe5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685559831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685559831, "uuid": "39acd370-b600-411c-ab53-e31fdf4a9654", "comment": "Malware payload", "value": "a12d326845a96a03867b2b70ca8f12ee", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685559831, "uuid": "60d2b93a-a1d8-4a9d-bced-bd76e06203e6", "comment": "Malware payload", "value": "21ff46a6fc9173fcc147d7a5c603032c662c6c1f1b05c1bb1e30e20e168bb056", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685559831, "uuid": "635843f3-0aeb-49b5-9659-98cb3b63f9d8", "comment": "Malware payload", "value": "3b1264d2e156a09142847b6a18f70a3267c406e2", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685559831, "uuid": "962adeac-65e2-4336-b77d-5522f63d9d14", "comment": "Malware payload", "value": "89289eb8fdc7b957d322b9a350228fd50d7b28dcdb86cfe8cb02d1eb90906ced788974581486dab58ccf9cf866987ea4", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "DarkCaracal", "colour": "#8726C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685559831, "uuid": "4878e000-9909-4e20-84e4-80ca20ef92c6", "value": "T150262326F7B18537C1722678AC5F57AD1D26BF001C28A48F3BE42ECD5F3A781261A167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685559831, "uuid": "477127b7-2810-4d44-a81d-2eae663ea078", "value": "61a969b6362c5a896bbd9ca2a9ad934a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685559831, "uuid": "4b11a04f-fc61-4ea3-8379-a37f085d59a8", "value": "49152:cbVY1yAdICj03tywdG0UhW45SG/kTQGKZE+59eJQIT2TKyP:co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685559831, "uuid": "956c8826-216c-4255-a0b5-53559973318c", "value": 4639832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685559831, "uuid": "14fd7b95-1289-4035-8774-3c717121b34b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685559831, "uuid": "70b6dc32-29ac-4d60-b921-b3ecbcd7dfb3", "value": "Visualizarpdf-print-31052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13b3008-ffa0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685530222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530222, "uuid": "62a9dbca-64fc-40e8-b205-a33d5b21fa37", "comment": "Malware payload (STRRAT)", "value": "b8d24c365dc8fc48012f8056299f9984", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530222, "uuid": "cd0a7ee3-75c0-4825-bfa2-e36994a3ba0d", "comment": "Malware payload (STRRAT)", "value": "227364d66f1e6519ba9b02ef769913f496a8dd5ed5e1f0aea41aaa3aa1da5086", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530222, "uuid": "504063c1-0b57-451d-9cba-4c4d41f80a86", "comment": "Malware payload (STRRAT)", "value": "3f19d69de13f795578aaf8d18e59767bb6e9df56", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530222, "uuid": "7a15ded3-068c-4d0a-b39f-67b4e910fc2b", "comment": "Malware payload (STRRAT)", "value": "67a23801f0b599f161dadad56dba99b8991a83e54e42fe89370e5dbdd629aa332dc412878a648379714905b1a94d4229", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530222, "uuid": "a55aa22c-6d85-4c31-b0a0-90f57e9cecee", "value": "T17663028D7F51B079EB27E9322058A5DA4C56C587D58F386FC8F0E35F0A2AD7A83121E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530222, "uuid": "9909404b-ed27-41bf-94ab-233fc4668faf", "value": "1536:8EpOyxsFomBgQgLg4egadFXnVGvd9F7jyIhRtH5M9yomOiQOoz1rFKm:8EpOyxY9OVU4/UVGvd9TpZJnOiQDz10m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685530222, "uuid": "e83efcf0-e0cb-477e-994c-eb071efdcff4", "value": 72280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685530222, "uuid": "1c314d9d-6c73-4266-8f5c-ed9f01759d8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530222, "uuid": "34927163-8194-4fb9-b5ab-c30d62ee2666", "value": "pago.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1f904b-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528170, "uuid": "98cf2546-9198-41b6-8494-47f43c0f4c64", "comment": "Malware payload (Gafgyt)", "value": "7f8e9a833d7e2f1fa363f06a361d4349", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528170, "uuid": "1056dcfd-e5f3-4ff0-8af5-da7e7942494d", "comment": "Malware payload (Gafgyt)", "value": "22ef26575edf4ea37a7cf4895859717e650eb5c4be148f3069af169ab3ff2b9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528170, "uuid": "1009a942-5eb2-4846-b2d0-c79593590f0c", "comment": "Malware payload (Gafgyt)", "value": "a4119374ef190876e30fc3fd9546ea8fdeea71a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528170, "uuid": "68dcbdfe-3830-453d-b4ac-9e548fd6ba68", "comment": "Malware payload (Gafgyt)", "value": "47a1950207672fe38eed5f9ff998986890890c3e496a0ba63fe22ac1a37f42ab72f480af174c82c2d81d3805503f66c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528170, "uuid": "e2a47ccb-d9ea-4d81-b110-18ad91f6921a", "value": "T1DAE3F801E9504B6BC7D3ABBEF74562CE77719D982F833306C71A79B027D06A96E2D210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528170, "uuid": "21452463-c6c2-4e55-9f91-921969b537a7", "value": "3072:x/f1bl++t0OTbLa+zOvIvVu3E9cQ2BCpvUKSLvmeVa5ts2aPPYuAI/lsrYXA+QXF:x/dbl2zVys2KPYuWMXA+QXfEPQA5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528170, "uuid": "8a81188d-eb4c-453a-a007-9bc808ee796a", "value": 146059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528170, "uuid": "1efc57f2-0c9f-4973-85c6-5d998cf9ceff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528170, "uuid": "679f089d-9625-4c90-8b0c-92b781e7005d", "value": "7f8e9a833d7e2f1fa363f06a361d4349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ac08e0-ffb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685540353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540353, "uuid": "0f71454c-97d0-4223-9b6e-d1dc6a71dba3", "comment": "Malware payload (Formbook)", "value": "2099520bdd2450bb040c5343910228de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540353, "uuid": "291a30d2-fb39-4e72-a65c-4f52257fa964", "comment": "Malware payload (Formbook)", "value": "23167788c852b1f093cfcaf4b9421b1c62a195c4425cef2c9fc066b42417d8e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540353, "uuid": "d96268bb-6f7d-4fb9-9e3c-3dd922a18a96", "comment": "Malware payload (Formbook)", "value": "7b2154522e5696a71840feaac92c41bdafca61d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540353, "uuid": "ce3e9d53-e3be-4199-865d-d4e993986d39", "comment": "Malware payload (Formbook)", "value": "6e934ad3ec05948f270869d81aaca6876edd007c1a665f8d3ae1ea385b1c3b8a5f75daeb60f7eb12d304deda25326b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540353, "uuid": "5349d600-b4db-4735-baf1-0c672bb492f0", "value": "T10CF4F1298FBE462AC97F77BDA570503052FCD6081827D3AD4B42347FDC2AF70A9611A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540353, "uuid": "26e13916-451c-44ea-8310-eb1eb0f606b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540353, "uuid": "aa1fc833-9acb-4dc2-aba7-5fa43b01385e", "value": "12288:bf5vAMTihh6xhZ6OrVXjTj6JMki+t3an1/Ys032XPXs8wFHojozEPKlO/1Zx7G:OMUgh8y9GJZi+t3+1gs0m/s8bwEKi1Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685540353, "uuid": "177173bd-6546-43bc-bdd1-22bb44385a8a", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685540353, "uuid": "60d1fcdd-66af-4cb7-b0d4-2e8ca01c4497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540353, "uuid": "59c69294-3b53-4325-8b3a-9359688d37f9", "value": "PO-371240523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9869a1c4-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685520624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520624, "uuid": "a2c7fb3c-0f84-4113-8a01-bd41e87445b2", "comment": "Malware payload (Stealc)", "value": "f01ac5aaa5bdac8a668a93d13260be6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520624, "uuid": "ccb9058a-d60e-498f-a543-214823a98fee", "comment": "Malware payload (Stealc)", "value": "2436911de6028f64f426467d1d1b8cd3b50e3c84fca97ac7a2239ec9a1e394b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520624, "uuid": "af203ffd-d4bc-4c0c-94d2-645e7b2bfeb2", "comment": "Malware payload (Stealc)", "value": "4099d0550a40caf7eaa8a2007649435d421ef9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520624, "uuid": "84d93a84-063c-4701-9b21-d0f03656ef58", "comment": "Malware payload (Stealc)", "value": "f81c783a4a5a03c4b5d1994dc54fe4a8225c07c354b5cbf426fc23f6e6d9721a109e2efa869b237dd12327d9224008ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520624, "uuid": "f0abc27e-5531-4351-a534-c0f14c437994", "value": "T1F8549D1273E19831EA674A714E2AC2F86A2FF8714F5567EB335C5A2F0D712E2C672305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520624, "uuid": "980aaa2c-60ad-439a-b088-df35bb5fb604", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520624, "uuid": "acf0cebd-bec6-4bcf-9e7e-7098f5e0535b", "value": "3072:3vgom4GTQshLL8sjRWqIW17EaCOjkJeWNrKVTSEUPdgoUfKRHrRb0I5lHiIER:/gf9TQsjiejkJJNrASEUPmoNbt5lCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520624, "uuid": "6a037d75-0430-4461-944e-65bbb1e54eae", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520624, "uuid": "1afed763-90d0-4cb5-b779-8497e2fb84d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520624, "uuid": "8e324f25-16fc-4851-a93c-5c69b947925c", "value": "f01ac5aaa5bdac8a668a93d13260be6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e40f2c-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685498851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498851, "uuid": "66770222-c229-4bda-979e-955c0bb3c171", "comment": "Malware payload (njrat)", "value": "1b9adef8eb82cb1a0d1f84fec2679f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498851, "uuid": "239d58ca-ee04-4190-bf0d-d78637b64a1a", "comment": "Malware payload (njrat)", "value": "247bb8e86d0899f1c9e0f1aa7daa3d3a840457490bae16a21a4bf7ab24bade6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498851, "uuid": "f19960df-6fae-471c-966c-e3953b906843", "comment": "Malware payload (njrat)", "value": "6365fcf5a9f0b5cecbb9c762fdf8d93b589e915a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498851, "uuid": "c19069a1-2ad8-471e-b85b-575322b01a21", "comment": "Malware payload (njrat)", "value": "b513799f902187044c5b9135c175bde10efb634ffdbb26b2cb2d5f81b34775a58c7d54413c77ebaca32489561c6ed4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498851, "uuid": "b0e0f15e-6e32-40c3-b2e6-b9a06ced8079", "value": "T1BAE22BADFBE64466C2BD1AB50571950013B4D007E523F77E4ECA24E62B3B6D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498851, "uuid": "6c904557-cbcb-4f91-98c0-88f7119a6826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498851, "uuid": "adeec849-9c63-4a80-b508-7ae2cc391213", "value": "768:L8u2fOVvZVYzxDCPGe9+vCiEpvgmHQmIDUu0tiALj:C+6ifi6/QVkbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498851, "uuid": "73881a8a-5145-4dd1-82bc-b74a42c6a2ca", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498851, "uuid": "63fe10ed-3eb4-4b9d-b7a7-c299f19112cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498851, "uuid": "9eb5d77c-70df-41c9-af4d-e7c2cec1bdb6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d0a1a9-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685533129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533129, "uuid": "5c9ccc2d-b234-4e67-b135-29a5da1d4562", "comment": "Malware payload (AgentTesla)", "value": "8de8ea0fcf96103de081ec9a9c4670a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533129, "uuid": "2af8ba5a-7e0f-4f07-aa65-c7082fa25a1d", "comment": "Malware payload (AgentTesla)", "value": "249e2e5540a7b11ed47e3bf2b0458e827d73e1c893035814d59e5a5770150ae9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533129, "uuid": "d3501ea4-9484-4f69-abd0-3a7d5f5863db", "comment": "Malware payload (AgentTesla)", "value": "34acdabca7bb6d49a77fa1af5db9ba5fc3d117a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533129, "uuid": "dbdafbfb-aeef-4ee4-a265-eba0990080e0", "comment": "Malware payload (AgentTesla)", "value": "7a4316d6ff784052ae1d745a602816f2f0c93666749ff9b59519dc38214e026371fb25330cc7b4e29a9652b2af3c63f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533129, "uuid": "6733667b-9a2e-459e-a85a-d9f5a89ee6ad", "value": "T175F4F1289BBE062DD97F7BBDA570503053FDD5015827D7AD8B0238BFC82AF309A511A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533129, "uuid": "d60b0a58-43ff-48de-b37f-19203e3cedeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533129, "uuid": "cac2e4a5-eee1-430a-bdd5-b4130b159e10", "value": "12288:6fXxAMTihh6xhZ6OrPyz+pBfC2c6lms555HS9vy9ApTV38EoGbk1dp3bx:5MUgh8yTzfhcykAsZ3Rzk1d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533129, "uuid": "b677b9a6-dea1-4555-939a-1f33cb6fb2e1", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533129, "uuid": "24dac9bc-635a-4bb9-84e2-985883638e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533129, "uuid": "c3578e7a-e9c5-4e52-8bab-0b811bfc0de3", "value": "RFQ 60000178910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4127caab-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685528209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528209, "uuid": "ea2cdff0-2ac1-4115-a82c-908ad083f016", "comment": "Malware payload (Mirai)", "value": "042c19d89908bda45a3c081d1e8e6807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528209, "uuid": "731f5906-f33f-4c7f-bb51-53c70e364d35", "comment": "Malware payload (Mirai)", "value": "249ff5bacb32a0a8164839be79309cb1582874b2a7deea938a6eaa61b5b15f13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528209, "uuid": "9087e8bf-ffc2-4634-8ff6-cc632d9956c9", "comment": "Malware payload (Mirai)", "value": "fb30c74f5e0fe9654cab635668e25131f11e547e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528209, "uuid": "c72948b8-7696-4838-87ec-937e893f2a68", "comment": "Malware payload (Mirai)", "value": "86e93cdc781eb05e6e26a6bc2556eef0b4591fe4b4f26b4d1fd7a86d16262bc7e226b59ad32f57d1c23371353e06e15a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528209, "uuid": "51701e01-eed7-49a1-a93f-4aa6002e36b5", "value": "T150B319824610D573F1433EF402AFE62600B2EDFE1A57C566D3897DFC86364963781BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528209, "uuid": "627e2bc1-7164-4bed-8811-3c602bf6a3ad", "value": "3072:UG8lqs3gvZepjPJa3sPuCYXzvylb3t+Z0Ua3hgp6W:ls3gvoRv16zv8b3t+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528209, "uuid": "4a87c30b-02cd-410f-b303-7acf699693c0", "value": 116498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528209, "uuid": "fa6f1698-a3f9-4489-a3de-b5e947ed6ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528209, "uuid": "951e7b41-fc2b-4b9e-a1bd-a9224f5a3076", "value": "042c19d89908bda45a3c081d1e8e6807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8de93a-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528176, "uuid": "e8bce046-77e9-4dbe-b34c-361e06256e40", "comment": "Malware payload (Gafgyt)", "value": "68c476f4c5d2c875ad19f2c8314e900d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528176, "uuid": "7e3004ab-3dd4-4299-a70c-f6f2ef9f725d", "comment": "Malware payload (Gafgyt)", "value": "25a634938eb82fad612a3d71e076f1b18c8b91fdbae82a134f71659fc66b73ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528176, "uuid": "32020771-9fb3-453e-854c-22a7bf0dec06", "comment": "Malware payload (Gafgyt)", "value": "890ed685208eec4a4ef1aaa0bb9a26bc26a2b136", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528176, "uuid": "68544862-bdd1-4185-b63c-47f82bd14ca3", "comment": "Malware payload (Gafgyt)", "value": "a318e90e4604d0c8015cb7ef1bbda14c5411c52c536e5c69188d3cfc0f309245b001d99145b3070037420e71898c1733", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528176, "uuid": "d81912f3-75c9-4b72-bbdf-f76272296fd4", "value": "T106E3D83B22232F93D4C70EB601E25334B8BDCE5D3C664BD3AA897E691E3659134853D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528176, "uuid": "22d8a8b1-c2d5-4d9c-b385-ba414fd3116e", "value": "3072:4PhvIxw5jQfUTaU2NP9ayT/3M7SUE/70cEIxcHgyps:4JAmclhAST/70cEIxcHgyps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528176, "uuid": "20ef6038-3176-4429-ab29-e04d63c50c9e", "value": 152204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528176, "uuid": "330adc9b-0bde-4861-9332-34857dee5c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528176, "uuid": "2255e4f4-63d3-4398-aaad-85a3dab78efb", "value": "68c476f4c5d2c875ad19f2c8314e900d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f872ee0d-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521644, "uuid": "63eb3530-650c-4641-9d00-b2ca724ac624", "comment": "Malware payload", "value": "ad67b92da516a626e6fe78f2cb529746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521644, "uuid": "c5cc28b2-2def-4224-8f75-7a079efccc9d", "comment": "Malware payload", "value": "2629ae2ff9439776fb571eef38e20281eb191be08d2aa2eb11bfccb2751c643e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521644, "uuid": "d4571a54-d50e-4aa2-88e6-05d17567a178", "comment": "Malware payload", "value": "680d13df6a571915b385dc4a66c56f4d6e420fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521644, "uuid": "7c59040d-a443-4076-8d26-2427ab01d70d", "comment": "Malware payload", "value": "b5626e589e71896c6e5d1129e91118996ae4059c8db7267403ba92df1f000a0fcc5331affd854712c750fee333a4328a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521644, "uuid": "a792122e-2498-406d-97f2-da1a9ccc6a62", "value": "T1B6E533431ECD41E8D3CD0C79D5071DCF76F6C2A609989C295EC56C88AA97FF6B06B222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521644, "uuid": "474a18df-7cfe-407f-9db3-513b23dbd828", "value": "8034d78cd5a5788746d6b0a217a14d62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521644, "uuid": "bf8314f3-a121-4f5b-ba7c-f4505a741180", "value": "98304:Y3k+genqRjpeH57l9GvjyGWnvP6BvMby7:H+0ubX7nZby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521644, "uuid": "096f2b01-961e-4631-80bc-8206e6214bd2", "value": 3280896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521644, "uuid": "0f43c806-8e31-4946-9597-414ca7773ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521644, "uuid": "f85cd21c-3eb1-4795-bb26-df514be74cbf", "value": "ad67b92da516a626e6fe78f2cb529746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043044ce-ff8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1685521664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521664, "uuid": "c6e9cbd9-f194-4abe-9161-6f66fa07c447", "comment": "Malware payload (LgoogLoader)", "value": "3e9de2f8ed5f45feacbc96508e41c432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521664, "uuid": "f91280ed-3c92-4454-8b9c-350b0d34c9fb", "comment": "Malware payload (LgoogLoader)", "value": "266e9a091eb3607b816ef19a9d326d52e9ad39f7843c804739eeac2ab0b21a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521664, "uuid": "7b70b020-69c9-46ce-8540-106396ca211e", "comment": "Malware payload (LgoogLoader)", "value": "883c4dd0f3691115749d65b61afb4cfb0b66de77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521664, "uuid": "832b6a05-aa7a-43db-b662-a7772527be89", "comment": "Malware payload (LgoogLoader)", "value": "75dcdc26025a0ba2b6a9dbca691a4ea27fc5831de8b6cb3438f1ad231bf7edbe29191a38727b17459cd151ee415091d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521664, "uuid": "1e030d18-2dd7-4a17-9914-7715d968822d", "value": "T15DA512853799C493EB1C42355A51C2B4A3A17DB8F524D26B39CC7F2F3BB03862966387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521664, "uuid": "97da1434-96b1-4f8c-82bc-244e95a6eb07", "value": "49152:VnoyoWrAnzcL+gh12wNQ57HTFEqu0nno2q:Vnoquzc8wNQxTFEqu8o2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521664, "uuid": "7719cfdc-c26a-4698-a906-3b5748001402", "value": 2090864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521664, "uuid": "bc944f8b-cc56-4713-acb1-f1279ee3b0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521664, "uuid": "6c9a9979-f8d7-41a8-aba3-be1d22307268", "value": "3e9de2f8ed5f45feacbc96508e41c432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a003de59-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adwind)", "timestamp": 1685520637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520637, "uuid": "0ca12c6d-2fca-43c0-86c3-67da3b81b418", "comment": "Malware payload (Adwind)", "value": "6e6fb26ff6028ce18e7fb2956c9f934a", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520637, "uuid": "5f4e378f-6809-471d-b8d8-3cd2b4cd4d6f", "comment": "Malware payload (Adwind)", "value": "2827cf7e0e7863202288f9735cfadde1dff2e6b271ba3ce50080a5b32cd97261", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520637, "uuid": "d1099c3d-f084-4247-8eb8-1b44274341e4", "comment": "Malware payload (Adwind)", "value": "8671bbe30e60569d8089323ceadad83088db0eb2", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520637, "uuid": "39e7db84-3045-4067-9316-c1831885322a", "comment": "Malware payload (Adwind)", "value": "41359a917d888929487bea175c71dee02a2be3be775ee602f65c9de5581c21cf4ade242b760a4322e292ca6b7d4f77ea", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520637, "uuid": "0d5c1685-63d1-4a4a-aeec-7e68b3769464", "value": "T13F63F2AA7D95D8BDEE0F81BA773EE8165864888DE143D43D865A124D1E309E133C9EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520637, "uuid": "28deb763-5e2e-416c-ad4a-23173476effe", "value": "1536:EDEJ5JDLCStQ5yc38E5a3Ptb7Ex+2e9ct5UNPJVvZ129UpmePF:lPDLUP38E5YPtbieIKLpkUkwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520637, "uuid": "9450e13e-6270-49de-a245-b2de1f1577b4", "value": 72297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520637, "uuid": "f935ecb1-541d-4989-8081-472be2b1be02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520637, "uuid": "e6d3c0d3-9e61-45b1-9995-4a73ba630b30", "value": "Pago.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22213576-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685531593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531593, "uuid": "45e777fc-fb53-4e05-9ed6-ff9b587b665a", "comment": "Malware payload (Mirai)", "value": "f185e331d79691b0b7b851c124b64cbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531593, "uuid": "be594e43-1162-47a6-aecd-000f1890b040", "comment": "Malware payload (Mirai)", "value": "290c0a2d0ee3e0db1caa826ae216f335caa03b085dccb42ae04b535e0a43c4d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531593, "uuid": "d23a106a-1dc4-4225-b723-aee3df2642b4", "comment": "Malware payload (Mirai)", "value": "009f2a6ec3be6425409d435a52a2b69ab6614c1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531593, "uuid": "690c538b-6a92-47fe-a0d7-d496069d9a5e", "comment": "Malware payload (Mirai)", "value": "a33a7dd8ae7163b2a5b19f57f12adf4b7ef79367f5c510c271dd14fb9b02a8a47979ea65b07dc238344060c617e49b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531593, "uuid": "23c8962b-6f79-4ce6-83ef-c1131edaa05c", "value": "T11D436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531593, "uuid": "c174f55e-ab61-4062-8991-d3c4a348e356", "value": "1536:JeESt/basV2rcZhG6+KN7TqOflSR9zWOIaEjrqMhs:JeESt/basVTgW7TqOfQRVtXESO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531593, "uuid": "23030562-0bde-4b29-ac57-23d7a4c95b9e", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531593, "uuid": "6349df71-879d-4f99-b728-473e07a22769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531593, "uuid": "2b22a08a-23c3-49bc-9042-79feb80257aa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0c4bdf-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685519857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519857, "uuid": "c6ee84e1-1cad-4ff9-9003-7360f0343215", "comment": "Malware payload", "value": "827fc2c4a5b7ed656523c082a4840b5f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519857, "uuid": "60d91c53-8d68-48a1-a3fa-8965761566d8", "comment": "Malware payload", "value": "2a3ae1c47b86a21e50bbe296d9cc303f4f8e306ba5560ce589102ba9fc4ceea8", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519857, "uuid": "33198549-46f3-401c-a2e7-e00b38355979", "comment": "Malware payload", "value": "ed577ed9e36c8670c25c6c11757e8b711773acaa", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519857, "uuid": "5342954f-f642-4e75-9748-4bbaa62f4048", "comment": "Malware payload", "value": "87a8b65b8b88df1ca68e90d90ec7962f855227a2a5b42e5c7241d7f583a199fe4eeda846ecea3a9d1d8036025c1f3809", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519857, "uuid": "1580c357-f9f1-495c-bb6a-be5ef062ebd1", "value": "T18A94F153F489CE4BE086C7B9BF9378490B0DBF169ACD74C62054771EB735A825A8324E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519857, "uuid": "cb1fca45-96e4-42f9-baab-9f3e4a436fe7", "value": "6144:D7aFJkKXiDU7w5115UWx1Qr0OVgG+VkNs0O8xrtSaFmb5htvtvhh:D7aFiKXKzHU8OgG+GD5xr8dht1vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519857, "uuid": "c79b74c9-8c5c-4eb7-9092-070631c490c4", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519857, "uuid": "9ae95aff-d1e6-41ec-a105-46ec0a7b4f3d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519857, "uuid": "7c57b6ef-00cd-4e46-8d5d-8e08aeb5e796", "value": "NEW ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338be9cd-ff8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522602, "uuid": "0e46230a-36cc-4ef2-aa8a-f94dbe2a2010", "comment": "Malware payload (Gafgyt)", "value": "76bef833ad63ec4ee71a6e4512151585", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522602, "uuid": "50854713-1392-4c9e-a569-5e41e13261f7", "comment": "Malware payload (Gafgyt)", "value": "2b1a237bd434163c3c2f8785cadac742b95209ba104bd8b62beb37a6072b8fa3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522602, "uuid": "1b8bad08-f98e-4cdc-9bf6-716a5b420053", "comment": "Malware payload (Gafgyt)", "value": "cdb186d1426cc771dba9677b452eb86260f4aa18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522602, "uuid": "245ecda8-1011-4e66-9e4c-d0194ea9672c", "comment": "Malware payload (Gafgyt)", "value": "0f4c5d8b0dbda9d7bffb50b5248cf28d561f584d665c95d0eeffea25b012885cb6b468ca8b85c29de7cdde93082e17fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522602, "uuid": "ce281865-17d5-4111-bcbd-0a99282a0447", "value": "T13DC3F945F845875BC2D327BAE74E438C37355E6897D73311AA38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522602, "uuid": "3c27dbf3-4721-44e5-9b4a-85ef8e5f6a3f", "value": "3072:FDrS5Njub7G5Q3On0Ts3wZRmBoHQuQekQnYW:xSnu6Q+0Ts3KmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522602, "uuid": "4de7d3f3-ec21-4cd0-ac7d-5e6dcf89e953", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522602, "uuid": "ff04f418-42bf-4176-a0b7-a97de3282bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522602, "uuid": "a32269b3-85cf-40a0-b36e-ad31ea471d0f", "value": "76bef833ad63ec4ee71a6e4512151585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a73688-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685512810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512810, "uuid": "a4ad2e0d-2fd3-4d35-b5fb-525d7305e063", "comment": "Malware payload (AgentTesla)", "value": "ff8ff717216939449fa5f8c656da3e0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512810, "uuid": "05200c27-bcf6-49cf-b037-13641d6e18f6", "comment": "Malware payload (AgentTesla)", "value": "2b4b71b54f825d8b95aabc0a9097d390523781be85f1e57cd05f6aa7687bfded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512810, "uuid": "fc89936b-8b3b-4d5f-80fc-4dbffe19b5e1", "comment": "Malware payload (AgentTesla)", "value": "15761dd150a0bdf702fc27aa4fccd0ff19168f63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512810, "uuid": "55797062-5039-4cd3-8c71-43aa3fd4b229", "comment": "Malware payload (AgentTesla)", "value": "c951fef0f2c9abdd21faf4468f9ae1c0a4d4f06b5d2bccf6725aac4608cc6b990c857ce656c0cd7841f4f111ac97d501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512810, "uuid": "c16f3246-ad7c-4d47-9fb6-6a80ea619f1f", "value": "T1B1139326B796C94AD95917364DE2C2DAB726FC516F57830B3244B32E2EB0A90CD0371B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512810, "uuid": "f5d6a55b-9dbb-4c8e-af2c-f75024389659", "value": "768:KoPk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJD18XmbPWtjPhm8CC+pUp:nPk3hbdlylKsgqopeJBWhZFGkE+cL2ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512810, "uuid": "22c7e592-130f-4ae4-9ccd-59acc624bf99", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512810, "uuid": "f79aae7e-1f89-4405-8818-fa303a3d6500", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512810, "uuid": "a27b7adc-2b1d-41ca-9656-b6e3bd40ef9c", "value": "PO20230247.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9966f05a-ff56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685498292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498292, "uuid": "9fa6222d-668a-48bd-bd7b-586240b3e0a6", "comment": "Malware payload (CoinMiner)", "value": "8916ab2bc4b11ef747f4bd8e4725610f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498292, "uuid": "68e614cc-0fd1-44d0-be41-768890430ca5", "comment": "Malware payload (CoinMiner)", "value": "2c1b910ffea3bb60564419c900f5d60a140c771db14ec580804cb788376df20b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498292, "uuid": "0b06c2f5-8c54-437e-97cf-d7a5cb5cb358", "comment": "Malware payload (CoinMiner)", "value": "a56dd31ecf31f1e3e5a5fd2fe1eb90c9d3e518f4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498292, "uuid": "5a226924-24fa-43f7-8722-dcbf1cdcd2c1", "comment": "Malware payload (CoinMiner)", "value": "56054021ce925099ed4cdcc1a11682a454c5ca0f328b2690debd8804a0b65c264e28d996c4eff7db68f2f18e0b9b17d5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498292, "uuid": "b2247035-6618-4926-88b3-8df6caac3802", "value": "T11854D021368DC0B7F45B64B489F9CEB699AA74342B6F61CBBBC0562C4E243F19631743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498292, "uuid": "a842ea47-1f8d-45b2-9d8c-e86eec714366", "value": "9bdbe8a3e1a8a51bbfa2b084f3532ff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498292, "uuid": "7c504387-5524-47af-bae5-2e0a52a4b551", "value": "3072:B++Wgy2CaiRmTnlU+EwzLQZZztDpy/SdAkMt7+3wEgeABn4VP8xYasNoOafMUotu:B1Wg4RmTlEwATx2XrzV49NNe+SUTkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498292, "uuid": "90c50abf-3598-4a92-bd34-53548d33c747", "value": 296696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498292, "uuid": "372f8e04-5239-4ec0-a4d4-80d971af9a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498292, "uuid": "8bcdd7b3-be5c-45b5-bd02-df2b3aa1d261", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26f0abc-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1685521178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521178, "uuid": "c3ed36b5-611d-4061-a4e2-5ecb12eb9999", "comment": "Malware payload (NetSupport)", "value": "1580bbb26ed8e813b2cdeb50733b6900", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521178, "uuid": "0bdbc41b-698b-4e27-9a5f-9689b7fc622d", "comment": "Malware payload (NetSupport)", "value": "2c30b4590cb25ef77af2e680cf0ae54a294c2769797b3afaa69b13ef0316e3f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521178, "uuid": "1c292f52-dc10-4afe-8eb2-cf25ad1c2bcd", "comment": "Malware payload (NetSupport)", "value": "83b86e8f21d173472077c5bcb6ee5e9c7569a845", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521178, "uuid": "4a68688a-8fa3-4047-aa09-bf910e9df14f", "comment": "Malware payload (NetSupport)", "value": "e2e8a2547e986b936bce7bb8dfbf2a3f22d371cf796f15ce505c9f3ade509cd6d38ae1b187ab8a3e93bf988f2221eb4c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521178, "uuid": "b8adf39b-6f30-42e1-9904-8e66a1751054", "value": "T17E2311F85BE366A4291230AF532FA488A0E605571C08FD097C5CE5109FDD53CBA79AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521178, "uuid": "0ede5254-eb10-4201-88c5-643820953e69", "value": "768:wOrp6d693mwtm2z+N9rvfAJ+4ryULXG78vr7Sa9qS:f4I1Nm2ojAJfD9qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521178, "uuid": "39d18ce3-2d02-4904-9f9b-62dca912f7cc", "value": 49238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521178, "uuid": "65ff1adb-b743-4167-a5ca-d65e528e36bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521178, "uuid": "bd363891-05fd-49c1-ba9d-189222a2d51d", "value": "scan620462076210-.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca1b551-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533999, "uuid": "b62ce716-4271-4a64-80bc-fe0dc18995a4", "comment": "Malware payload (Mirai)", "value": "afada58fb6a67f908eb84c944e7c5416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533999, "uuid": "39ed3d9a-b0a3-471f-bd9c-53c1cdb43108", "comment": "Malware payload (Mirai)", "value": "2c63a6d8f5bb309a8a674d47cfd8dd3d9451dfa759023b1a7b5a52df5ead923f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533999, "uuid": "90e862b3-72f2-4740-bbc3-fb74bd8b7c55", "comment": "Malware payload (Mirai)", "value": "75f5fdf119b327b7c4dba026f3faf51c924a0668", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533999, "uuid": "3bf2fec5-1114-421d-b238-bb49c968a64b", "comment": "Malware payload (Mirai)", "value": "089a2a296eb43a170f74c8e388ec6e204b6027a5f9341f652949435882069ab7f1784ee8c87bb536913d551acc9df4ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533999, "uuid": "1253d824-335b-432b-a77d-b5c08f54a370", "value": "T1B4435CC19583E8F5EC160A752137EB738B76FD3A1028DA53C398A932AD41B42E5573EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533999, "uuid": "7ac3366b-28e3-4449-be0c-130e313fe23b", "value": "1536:o77N1k4XrwOUXI5OUg0WDDrybivdV3GLmW7jSMfCzW:U7XfXrwOUXI5OF0WLy2vfS17tfCzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533999, "uuid": "c678f712-63d1-4824-b2b6-1c188d533bb8", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533999, "uuid": "bd0391dc-dac6-4cc6-a3b3-70ff20a119eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533999, "uuid": "6a6f8756-6306-4aa9-ba06-ef84bdb51dde", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268043a9-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528164, "uuid": "06b5d573-1b0d-406e-8a17-ddcfa880a679", "comment": "Malware payload (Gafgyt)", "value": "808ff5132ce619f0429b0de3a5cb9df6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528164, "uuid": "31a36318-acaf-4f91-890b-184d5b659cdb", "comment": "Malware payload (Gafgyt)", "value": "2c8a8d856614e75272e6e925240d82a07390d1d2245d9b3fb16cf60d115d1833", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528164, "uuid": "8def3607-5369-4baa-88f8-803dc3933a47", "comment": "Malware payload (Gafgyt)", "value": "09bb135df83e4858b3c45b4bb0a747ebedac9d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528164, "uuid": "4401e36f-19e7-44aa-b23b-ad76a4cd9f1a", "comment": "Malware payload (Gafgyt)", "value": "f32d4b99da404ea3dec11bbb744df377060aa8434cbfdc34382aa5df7fb1ef91585621ad74254203c699eda5bb8d698a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528164, "uuid": "c7824aa4-a408-4d78-a3b3-f59917cca750", "value": "T1B7B3E749E845C1F2D4931BB312ABF93B00F4AE29662B5A67B71AFDB4C7734433211396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528164, "uuid": "e7469923-5788-4cec-b803-07bfdd56dbe9", "value": "3072:BiYBIu/ZiwtNQkOcwwpu9maZ7W6lxg+Z0Ua3hgp6W:BiYBIuLtBYlZ7Jxg+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528164, "uuid": "7da3c161-0d71-467c-b98e-f59b7c11ce27", "value": 117650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528164, "uuid": "8a1ba078-6d4d-4373-b593-1c323b556228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528164, "uuid": "622e1584-e795-4624-a97d-89e1979f4f6b", "value": "808ff5132ce619f0429b0de3a5cb9df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9537d0-ff95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685525200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525200, "uuid": "8fd7eb66-1354-4fba-ab60-2fcf3fecf10d", "comment": "Malware payload (Loki)", "value": "59ed8fb12afa93b7e89a6d5282a617f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525200, "uuid": "65d8e416-85d2-4ceb-94b9-350c1244e750", "comment": "Malware payload (Loki)", "value": "2e3e5642106ffbde1596a2335eda84e1c48de0bf4a5872f94ae5ee4f7bffda39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525200, "uuid": "36837523-0b6c-4f77-a5ea-947dfc97eff9", "comment": "Malware payload (Loki)", "value": "bed1fe37a52df48de8e343c75fd7acba3f8a0396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525200, "uuid": "17f413e1-2eba-4250-b8d9-1bbb1aba651e", "comment": "Malware payload (Loki)", "value": "1c1fac2333df51ea67de3e0df491b435ee6d47ea46fa145b739ba567e14cbf5d2bc104913d444cb2a66b5ccb0ae391a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525200, "uuid": "d4185cda-890f-4943-8ad2-d20cb51caaaa", "value": "T10444ADCD76C64A35D5626EB7CCA1C53102677D2A341AEE654CCFB2F06432F3902A1E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525200, "uuid": "7642dad2-de99-4e76-849e-2912780b2fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525200, "uuid": "aacee50a-25f4-477b-944b-82aa21b5c1a9", "value": "6144:Lh3VmiQjFSs/Y6hpDuaTYuOBHGwJKOJVIkF9:Lky6O3BmwIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685525200, "uuid": "42d5a293-39ed-48d2-a0ad-f0dae4dbae42", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685525200, "uuid": "32979654-e02e-4cbc-965a-2613f57c9b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525200, "uuid": "7b8242e0-f4ae-4a84-abe4-99d3711ee9a8", "value": "59ed8fb12afa93b7e89a6d5282a617f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fe94b3-ffd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685550733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550733, "uuid": "15d0557a-7f62-4919-9be2-cc9bb2c2a3f3", "comment": "Malware payload", "value": "61af7475b436f4c65ce250e9eac0d0cc", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550733, "uuid": "21a79f92-1a2c-4948-ab71-653a8ba8be75", "comment": "Malware payload", "value": "2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550733, "uuid": "34b6cdf5-45a1-4767-b4d0-8c6b48028c98", "comment": "Malware payload", "value": "8e48d0f29aa494d97e3b47faff4fa5e45ab5053c", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550733, "uuid": "28c375e3-bea1-49b7-9c8a-f8372b1b4053", "comment": "Malware payload", "value": "c8e3ce8a433966688ac8ecc797e11660fc435561c383aef279feeb8888b9f3eb62d9d7f7986ab9e144a41371d7fba95d", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550733, "uuid": "d9c055bb-0535-41bf-86fa-3b7702a97214", "value": "T198A1C17B9F0E9ABED265FD041188ED0FC6C4C132261F6D83F60755A678ED81882BB5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550733, "uuid": "1267cf7d-95c1-4105-bafa-2fc9fa844186", "value": "48:pAq7YPNc/BmjBCblkVmfq9mfCj5mfy09YFdOddkca0j0KRv3rpRsjFKV34Y2ifov:ip1oBmsJG9XlSfRzpRmFmSNCZV4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685550733, "uuid": "616721e0-8634-4099-bc20-8e397270df43", "value": 4911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685550733, "uuid": "34bf61c2-1e16-44f9-95d0-36e14359ea4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550733, "uuid": "2a4974fb-5332-41bf-8b12-8d6485f721cb", "value": "doc_B285_May_31.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439eedab-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685528213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528213, "uuid": "cb79b736-2434-4e3a-a9ae-8d788f7f61a1", "comment": "Malware payload (Mirai)", "value": "03f2b4ef635f5aebf4c994e305123f23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528213, "uuid": "9f495d3a-c214-4b52-8d5c-5d7f4ea2c7ae", "comment": "Malware payload (Mirai)", "value": "2efc991c56f8c9fb0c2262a15b1ca570fd3b5ff4283e1deb0a30bcda47030b4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528213, "uuid": "53b507c9-3246-4fbf-a1ef-35d38027b6ea", "comment": "Malware payload (Mirai)", "value": "780379606ee1d116bc87aa8ec2d82011aad705b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528213, "uuid": "7e4017fd-02e0-4e62-8ef6-d0e8474b4f21", "comment": "Malware payload (Mirai)", "value": "43fa77fecfcd6ceeb7fc48fd96aa38cc29dca3f5a007b3df9a8fe6e8532217f2e183b8fda7de93eca5fb2052eb4b7ae3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528213, "uuid": "500c579d-21e5-46d5-b578-cf33e29637f4", "value": "T10CD3C587B851CF57E84B9A364ACB4731B7B5FF1D1A4202327723B9529A371D13AB2B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528213, "uuid": "ff73f8da-2db6-4a81-ada0-83306f29a384", "value": "3072:cbBkfMcUuw38V3byl4/zUrRy2HYDDG9BrRtDmLc0IZcHgeQs:nVUuzul4/z6y24DDiBlJmLc0IZcHgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528213, "uuid": "707a902c-9d72-48a4-82df-647aaebc3757", "value": 135970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528213, "uuid": "0c1fdda1-de7d-4e4c-a9ce-6358dd0a3a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528213, "uuid": "d659daf6-4451-4747-a207-c3e0a7b84cb1", "value": "03f2b4ef635f5aebf4c994e305123f23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5734c0-fffb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685568927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685568927, "uuid": "798786c2-95a2-4452-84bf-64b6685a3b43", "comment": "Malware payload (RedLineStealer)", "value": "75297d5e45ef9f4080cd28c50b4f1c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685568927, "uuid": "093fa3ad-4c5b-4ac5-9e08-0a633028bf60", "comment": "Malware payload (RedLineStealer)", "value": "3034b00c17091f1fa24153d832e2a94569a895760393cf30b2f432d73ff97b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685568927, "uuid": "28e7ba55-f1bd-4027-874b-022cba2f9bae", "comment": "Malware payload (RedLineStealer)", "value": "61f1ba481fea604ba4a279e7412e3650d91b3c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685568927, "uuid": "6f633187-c577-4def-8299-46b078ff3fc0", "comment": "Malware payload (RedLineStealer)", "value": "cd67f8e5b7b20fcf46a1d81f9876ff5bc01de1c46d710b57706d264940f461da830dc3ee382632d1ab91cc00efb8f695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685568927, "uuid": "9c4b43a0-7af6-4afd-8190-622c7f415df5", "value": "T18134AE1273E1A831E62746719E2AC7F86A2FF8704F556BEB235C5A2F1D702E1C632705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685568927, "uuid": "90997d05-b837-4983-b9a4-8f41b352781f", "value": "40fd4f2059ab60e0d9ac2492cbb9eb32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685568927, "uuid": "dc1bc018-787c-45c7-81aa-90b0ae3cc65f", "value": "3072:7zs5rGYF5cGQ/AnDX4wCR+JYUQ+6+u7/xGfJwmdcUg9e+J0O8lHgTBOIW1:85ag9QupSUQ3/UBwmdcUg9eDWTBOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685568927, "uuid": "fd37870f-cf16-44db-8c87-7be7bf67d4ef", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685568927, "uuid": "b9f830b2-2ec6-4849-a1dd-4107a6896293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685568927, "uuid": "6b6fc2d0-a217-435d-a623-beab2ee1d9d0", "value": "75297d5e45ef9f4080cd28c50b4f1c6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa556f6c-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533969, "uuid": "9f3f3fb3-e394-4261-b58e-90aabf0b79fe", "comment": "Malware payload (Mirai)", "value": "28df79a23ac4205c419c846fadf79c64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533969, "uuid": "435bca4c-4ac4-40a2-b672-8cbdc9a7b10c", "comment": "Malware payload (Mirai)", "value": "30371a9676f8bfd9063bd7ccb559dbf5c7e62a665d8d9a03bd6c398a56542a9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533969, "uuid": "790ff865-6a67-44ed-9e65-8eef2999deb7", "comment": "Malware payload (Mirai)", "value": "54009385e947d3eeadb6e9a1a567f8b9a4ca8c88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533969, "uuid": "715b34b0-9f49-4933-bfd0-c6dca702cf43", "comment": "Malware payload (Mirai)", "value": "34b1067d244077116f0b9b3ccc36128e05e676e3eda79fc7ed9d388b3758e79f7c44e9e48b02ed3558c4ccdfbd1ee526", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533969, "uuid": "eab5eacd-c696-4345-a260-fcf7b713f94d", "value": "T1E7136BA28CA41E14E185C535BC360F32F357A910654B6FBF16A7833D8887DADF2473A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533969, "uuid": "feab5582-4d79-41db-a325-77d086897082", "value": "768:svHLLck6cB6/ALceV/36cDK5AiC1kVK35S5aUoko++eCdgNJJfiwbuqI:svH8YM/hU/l0BK35S0DkoeCdRwSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533969, "uuid": "cffa3f13-b15b-47fc-941b-06d093b13e99", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533969, "uuid": "b8e2cb95-34ae-4a3c-86fb-b7998129ff4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533969, "uuid": "f9847380-2da4-4a73-b0f1-75db8b2dd27b", "value": "28df79a23ac4205c419c846fadf79c64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddee4ac-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521600, "uuid": "c4472f9f-bcd4-4fc5-873b-97078b3a84ee", "comment": "Malware payload", "value": "f748cc6d4d8c59fa99c66431703b6c4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521600, "uuid": "abd13953-a3f4-4812-b0e0-3428f68b4eb1", "comment": "Malware payload", "value": "30be6ac7e649948f362084b37dddbb4dbf5d20a6dff52f64b77684de46a9117e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521600, "uuid": "31286056-3c62-4728-bc00-3dc3057dd4ce", "comment": "Malware payload", "value": "5ac58fd2a048d52daff29fdf26bad84d5a085181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521600, "uuid": "f5cb2e32-7754-49b6-843a-a5b030a11304", "comment": "Malware payload", "value": "3cf29f76928d072b55af415236f8a2b037b85afb608e9c18b3aac5835c3e664f731b4c546e8ae805d46a931352a53c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521600, "uuid": "370cfb6b-4d21-4063-9896-37d6e875d309", "value": "T1387612320572BCFE876C389490052B452CED5C676359DFACFA4404EF25A1738AA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521600, "uuid": "a1887f53-add6-4c90-9146-432c23736a76", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka67:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521600, "uuid": "d87b5c51-6b93-438c-8ab2-b23f1db884f4", "value": 7303843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521600, "uuid": "dfbd7213-52d2-422f-b3d3-1635dff7cf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521600, "uuid": "6880a22f-2f6c-4429-ab6b-087e12b567b2", "value": "f748cc6d4d8c59fa99c66431703b6c4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3486f078-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528187, "uuid": "1e4aa4c2-e5cf-4405-a339-ebe0d929582f", "comment": "Malware payload (Gafgyt)", "value": "62824235f52571439da47ef76f463025", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528187, "uuid": "5b3cda25-dbdc-46bd-890f-2912bede8978", "comment": "Malware payload (Gafgyt)", "value": "31834092e098329d0c24f8c71844fb29829e58b860f6c6b4d41307937d046dad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528187, "uuid": "60b209e6-185e-41c1-a864-2ccbfd64d713", "comment": "Malware payload (Gafgyt)", "value": "7ca7d8f04bdaff89fbc5c742f8ba5aa593981b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528187, "uuid": "794d639d-9bf3-4d04-b03c-9e1a383b12cb", "comment": "Malware payload (Gafgyt)", "value": "226185129c7685094a9b642848b34609c15f4f84a9b8cf9e4aee27f8678150cfc670ef4c3c386f808188c2371a116e5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528187, "uuid": "ce740da4-45cc-49c6-9b5d-16a97d80282d", "value": "T1C3F3F70195508B5BC6D39BBEF745A2CE73726E986F873306C7197AB027D02AE5E3D201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528187, "uuid": "ce6bd909-f5d2-4af8-9d53-adefdbdf1e8b", "value": "3072:Sy5vlalsWQFtfo9S8pohPKkNDGPp1gFwqLM6rzH0aMjAw8E1WRWTbqAob1uzO7mV:S6bO6rD0aW8RabqBuzO7myotqauUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528187, "uuid": "c2ef5b66-7186-4b78-8cbe-999ad419a5f3", "value": 160615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528187, "uuid": "3147bbbc-e575-4b01-8679-1ec741450b61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528187, "uuid": "01f1f9f7-8197-469c-9d7b-b7de1e3637c2", "value": "62824235f52571439da47ef76f463025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdde23d-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533946, "uuid": "db9d3e19-584d-44c9-a958-b17e4c93103a", "comment": "Malware payload (Mirai)", "value": "020393931fbc42c29a565c4c58584942", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533946, "uuid": "c5d38185-e2ea-409d-887c-1282ae564d3e", "comment": "Malware payload (Mirai)", "value": "31f1c0904e7095204d7a796b48a9e5258a7f4f07096d25b9da0343996049c089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533946, "uuid": "64e58e69-2ee0-4b29-b927-e8e9aa135ba2", "comment": "Malware payload (Mirai)", "value": "9879552ab6532730cae7162f6c52c47dcf06d87b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533946, "uuid": "0cc0e8b4-1140-4da8-906b-e2ae7e75103f", "comment": "Malware payload (Mirai)", "value": "6a1eff007d07888bc73ffcd092e9515351fa6f5a643b8c8eb9104a15b867f559d909535ad52aa6d46713ab759c395f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533946, "uuid": "b4ca862e-e683-4efc-aad9-c58869638e62", "value": "T1DD632A31BA761E17C0C1A47A21E74B65B2F146CE26ECCA1E3DB20E4EFF619406543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533946, "uuid": "36cb67d6-31af-4151-aea3-ecd177941ccf", "value": "1536:OUmY4Zcs1bt4HKH0d4zMUQcAt758STtktI3s:jmNwHqzPAtV+Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533946, "uuid": "603c2910-d185-4c0d-a7f9-d1a4d3d53424", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533946, "uuid": "012346c1-0f65-4b30-a0cd-eea67672fb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533946, "uuid": "42c4758f-ea7b-449a-b642-ffaeb9d272b0", "value": "020393931fbc42c29a565c4c58584942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3689d5e-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533984, "uuid": "cf90bab8-541c-42b8-9fa5-74c00fea0945", "comment": "Malware payload (Mirai)", "value": "b4e081e157e40ab224556a9aadd98c25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533984, "uuid": "3c740d95-63e0-418d-90bb-7753cc7b643f", "comment": "Malware payload (Mirai)", "value": "325f7a1321429322a31b19dbf5c989b07482045af0248add23535c124b234da9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533984, "uuid": "d4c2ca44-7eab-4b3a-91df-a39030c5be65", "comment": "Malware payload (Mirai)", "value": "74067272a86e67d501e34fef63edd9e72e7c1358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533984, "uuid": "44c236a9-ce61-4e55-b357-f4886ed8e779", "comment": "Malware payload (Mirai)", "value": "8e29b62d1a62c94a09df7b8d175d0c7a4fb8f6aa4c8b88b0caac775ef3cd1c3bc1e433cbe4001cfb27972a56b5fdba60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533984, "uuid": "bc07ee77-ed33-4c19-a3c5-1a094e84f231", "value": "T17F331996F9816663C1E016B7FB4E428C7B2603F8E1DA7303DD159B3037DB9A90EBA451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533984, "uuid": "04d4587b-d993-4ca0-8c1b-03644b4ba80b", "value": "1536:mEQAijHkGoZNTHno8rdSWLdC/Hu13HMCSq7o/vGq:mEQAijHkGoZNTHno8rdS+dC/HU3H5MGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533984, "uuid": "4b2134d5-4603-48e4-a30c-deabc0db823f", "value": 50912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533984, "uuid": "865d49f6-e803-41fb-b928-590575d8de13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533984, "uuid": "e43a9304-6603-4241-b06e-6af0650d3f1e", "value": "b4e081e157e40ab224556a9aadd98c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd049715-ff9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685529732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529732, "uuid": "c859ca6c-df7b-4cfb-b794-307358bf9b10", "comment": "Malware payload (Gozi)", "value": "4615d39098ea0f0d9c93e3f97d5c0994", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vipbeed-com", "colour": "#871C48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529732, "uuid": "d0166094-d323-4739-b8ed-1e7328b8adcb", "comment": "Malware payload (Gozi)", "value": "32d55ac9da58cbb16197ce7b05be244984d37677e2bd4cb076d8523c025cb6c9", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vipbeed-com", "colour": "#871C48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529732, "uuid": "5d6f3a56-c8d1-4fec-bceb-6c914d678924", "comment": "Malware payload (Gozi)", "value": "ff3c5f1cc3867af235bbf54dbf555c20d72f7415", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vipbeed-com", "colour": "#871C48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529732, "uuid": "6404e10c-518b-4da6-bbd1-2a1f50aef54f", "comment": "Malware payload (Gozi)", "value": "99a95218b549aa612f3ba8a95f72e3df19bfce43fb8b6c05c543786410feebb0232bee9d6ee34ffe204887fd9716b759", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vipbeed-com", "colour": "#871C48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529732, "uuid": "2dc5a741-1e7c-4750-9675-5814c747791a", "value": "T19C4353D62BFAFE56516712B33796C2A5F4198C81C6D89CCDF6407C64F4AC600BBB848E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529732, "uuid": "ba0f6bb5-93f4-4071-9b2b-09bf4b90a5c0", "value": "1536:U5T+JD5U4Yi3iDxlOJQfuvlHY6/6DekJlLy41xqdvFJ1T9pQ:S2UQ0o46/6De4Pez9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685529732, "uuid": "08dcae3a-2656-45cf-b57d-6b47db92a481", "value": 60296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685529732, "uuid": "f2121b2a-085d-4446-bb72-84a0832dd9f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529732, "uuid": "8de1a82f-c7b9-4e2b-bc0d-1a8a9b990b7b", "value": "1 Total New Invoices - Wednesday May 17 2023_1062_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827b49bb-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685520587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520587, "uuid": "186b8fa5-5800-4cce-bf5d-0cee2a674cd5", "comment": "Malware payload (AgentTesla)", "value": "604812af0731b9fa77bb621cdc05fb7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520587, "uuid": "490d8792-d312-4b8c-9d4f-9de090c71a96", "comment": "Malware payload (AgentTesla)", "value": "33573afab9f6b783130905565301d3975caad02fbbe1b8113c4ccdb02df6de7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520587, "uuid": "e86e00c3-0b7c-43f7-b8ff-429cfa0f4eee", "comment": "Malware payload (AgentTesla)", "value": "d166f389f06c792a4e28cc123f6099b1569e97b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520587, "uuid": "e8a35741-a449-48d7-958f-cd098fa7c105", "comment": "Malware payload (AgentTesla)", "value": "4005b85bdfc8af599db5624dba435b177dd4a8130e5152e82487b2a5196b1d5771d13dc10062466934d8bb7ac3f531ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520587, "uuid": "24e14114-bbc4-44e6-acf4-2d8665094fb4", "value": "T18A24AF5AB50375DFC94BC972C9D90C289B61AFA32727C247A04B325D990E7EBCF140A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520587, "uuid": "9172f6aa-fae2-491f-b18e-f8fcfc5e4e65", "value": "6144:Tqw6tqd+I3m7Dw7nuM6dRf45XpzUQR2n/7vj5:W4d+I3m70DyQ5XdUQRg/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520587, "uuid": "413fc572-f35f-45b1-aaaf-91c86e32c060", "value": 219712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520587, "uuid": "4f639b41-1eb7-4033-8619-c54747caac67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520587, "uuid": "377255ce-7dde-4a21-a626-2d2769e79bad", "value": "ZiraatBankasiSwiftMesaji31052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a741f830-ff7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1685515066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515066, "uuid": "4469bb14-da11-4795-b826-10993d1c770a", "comment": "Malware payload (Gh0stRAT)", "value": "6a5b8d421e055ede3b2dcbedb9d834d7", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515066, "uuid": "ea970f0f-a9f9-4a0e-8733-7ed32983b2aa", "comment": "Malware payload (Gh0stRAT)", "value": "33a8f5100c1888a055f3ec238ec07e1adb4023b66f17469f1f7eb5679fecf889", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515066, "uuid": "900184ff-de02-4e3e-846f-7c4149712335", "comment": "Malware payload (Gh0stRAT)", "value": "92fc4058baf9a6d33ca3232402c7bd5511000c11", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515066, "uuid": "2b10501b-93bc-47c6-b302-775ad1267075", "comment": "Malware payload (Gh0stRAT)", "value": "ba21815e96c71eec091f2a4ee6d2bfed12a44e29cc884b92fb8e6db20bb912ea7f8b6cd12948d3d5521b9ccbbe48dda2", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515066, "uuid": "2a5b2edb-825b-4897-8dc4-e91847ec4725", "value": "T19D549E0276C244B7C743A5316AEE3377A7FE96258F29A683473CFE1E7D38542912431A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515066, "uuid": "02418c54-f5e6-4960-b5fe-4d8aca1e87c8", "value": "95ae7d6a24929573b30af7d0da35ccfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515066, "uuid": "b2ee35f3-73ea-4af7-8fdf-a4e0392a4bc0", "value": "6144:G9hIq9bEO1QIbgTApqQCsGQZt+3Y1tMmbWsccC6g6v66666ES66666E6kD66666m:cIquhLMpqXA+3Y12wWncC6g6v66666E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685515066, "uuid": "1757b2ca-880c-4eb2-9e56-34a264d2ee6c", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685515066, "uuid": "a170479b-5920-4c6b-88d7-9c508ba8b398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515066, "uuid": "73180f73-6ef9-4b7b-9386-b0f46aea6570", "value": "08328899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7a143b-ff8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522589, "uuid": "6bf81d63-eb83-4cb0-a10e-71a4ac2b0e3b", "comment": "Malware payload (Gafgyt)", "value": "ce28f8379b0297c61891c45f43f6c625", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522589, "uuid": "a01732fb-5d44-4cb8-9df5-bc44cfaa0b5f", "comment": "Malware payload (Gafgyt)", "value": "34dcf89479a3998b3ffa3464e08a2eabf4286d15d44bbe67831f2871a56b4685", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522589, "uuid": "6946e398-b9ae-446a-8bf9-a8e5e28d84ee", "comment": "Malware payload (Gafgyt)", "value": "365d4fac1ba8c86713862d136e70b4bf6dc52dfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522589, "uuid": "447f3892-7ba4-4ef8-b183-0ccec6edec9f", "comment": "Malware payload (Gafgyt)", "value": "61858ebff5bf40e0c75ca3c8bfd84ed7e8d9b025ca5f5f7ba333a0cfe3ebeca5ea94fb6165dee3a2f96fb1ca55c01d4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522589, "uuid": "a0237462-4281-4931-bb2e-dbb008a6389a", "value": "T18FD31905F4608757C2D217BAFA4A425D37221F7893CF33256A28BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522589, "uuid": "c8565631-cfd8-4257-8542-4fa0f15b7f5b", "value": "3072:CdHpf5wyawRCzQArASotpCy3kpkYzftmCQA9FX9aH:yHPwyawRC6pCy3ezftmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522589, "uuid": "b4a77f40-05f9-403b-b718-e68e18a9cfcf", "value": 139577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522589, "uuid": "3f9f3179-938b-4ab2-927e-3eec6ed4da1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522589, "uuid": "5859e7ff-5306-400f-8ccf-5e4b46e3df02", "value": "ce28f8379b0297c61891c45f43f6c625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0e577f-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685520605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520605, "uuid": "15eedd44-81f8-40c7-b260-17ab78591ed5", "comment": "Malware payload (GuLoader)", "value": "d29a4b56d81e0420c808dfa9b26a6677", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520605, "uuid": "3ddeef0e-b491-4ff7-8f71-1e5d462f7f42", "comment": "Malware payload (GuLoader)", "value": "35aae85c0cde6d16697e9e430938d89152f970d9ca6f0601d4a5ca9dbe50af78", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520605, "uuid": "e503beae-3511-40fc-885c-b62082e1f59f", "comment": "Malware payload (GuLoader)", "value": "e6ed697990b40e8a690077e52d09ed068686af54", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520605, "uuid": "24f21df5-1fb0-4f09-b8bd-d3a402802720", "comment": "Malware payload (GuLoader)", "value": "a8a3e02554c1c61ee10dd7c23f9c47544d58524340ce2a487753ed15961233c6a7b0b0dfbb6d64a13312d871d6a55392", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520605, "uuid": "39e71389-2a1b-485b-952a-8709c62c27a3", "value": "T150A4D12A6F57CD32E3492074D674EF3DEABBDC141D1B821387F9E82BB025B16995E201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520605, "uuid": "709b3b3a-4514-4f5c-be2c-3d0b78da8ea3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520605, "uuid": "78ac3957-e2b5-4871-97b0-0ebe0e35835c", "value": "6144:imOPQGwvUsu5x1rmMiKJzPU7Ldb2IXvckRgqqYg+l5:TRu5xgK5M7LkIfrRhq/+l5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520605, "uuid": "ab780baf-bec0-4a66-9cf7-cd685b1b4f64", "value": 466290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520605, "uuid": "7970704e-929b-4f2d-a3e2-03f31de1c50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520605, "uuid": "d43a308f-cef7-47ea-9db1-58dc1de47628", "value": "DHL 0079488601.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a200136a-ffbd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685542545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542545, "uuid": "8b6e6858-694d-47cb-8d18-eea1e7ff14c6", "comment": "Malware payload (Formbook)", "value": "72933fef6f009866d6e415f3663199df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542545, "uuid": "74f64835-7859-4076-9978-f805e3b9929e", "comment": "Malware payload (Formbook)", "value": "392a3c13cc6f2803845bf0dc6bba16c5d56d0ee46aaaedab6c4de842cce50429", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542545, "uuid": "fce64621-3211-439f-be24-3f4f5b85cbf2", "comment": "Malware payload (Formbook)", "value": "e57eeafb3fc9709da7444f42b6b1a2802aa0a899", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542545, "uuid": "b682d550-0e57-45ff-bf38-038ec8e7f7f4", "comment": "Malware payload (Formbook)", "value": "f80a0356d282d7843cbad66e1078b123633a19819e47c803a9c8c70cfe671aa864648c2893dd493d97605448b4eb433b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542545, "uuid": "fee69394-6355-48c2-b476-02c7cac5a693", "value": "T12AF4F1289FBD052AD97F7BFDB630503052FCD5045822D3AD4B4278BEEC2AF70995126A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542545, "uuid": "b21aefde-37ef-4ff2-9247-366a67aa1432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542545, "uuid": "c8e5c4f8-2b0b-4c22-84bd-5d34951a60ea", "value": "12288:lftAMTihh6xhZ6Or6dXBeG4qQP0nVv6ZDgqD4C5NCl8D3CPhe/3zrqUC4LAam:QMUgh8y6ainVvqsq8C5NCyTf/3XEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685542545, "uuid": "42b4c259-6aa5-4598-9cef-04e2e5d1fbca", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685542545, "uuid": "7f333a85-87da-45bd-82dc-d1b2b2c47bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542545, "uuid": "539f5a85-bdb5-48b9-83d1-2a785f652ce7", "value": "72933fef6f009866d6e415f3663199df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd83228f-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521653, "uuid": "d0267391-cf4b-4ef4-949b-11cef9eef320", "comment": "Malware payload (GCleaner)", "value": "89e8233b2e70f8dfa7a80086de5dd498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521653, "uuid": "c36658fb-d98f-4dfd-8862-6c90e9a5c35c", "comment": "Malware payload (GCleaner)", "value": "395261bae6b3a5d633562ab4a23307b2f03595765f0c078cc3a824627e38f52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521653, "uuid": "080f65e1-5739-4678-b161-3a17e08703d7", "comment": "Malware payload (GCleaner)", "value": "82cf8977235fe74d7d67653115940adf42904865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521653, "uuid": "6a6a47d9-300e-4930-97eb-29e5a02d2274", "comment": "Malware payload (GCleaner)", "value": "0576db9e087c076338d5d44cd8274633b305cc8156eb91414dad7dcb8428852983b3dc71e54e9c0a50da577b30c53d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521653, "uuid": "0da409dc-11c2-4673-817f-0648972b9169", "value": "T143648D4352E03C50E93B5B729E2FC6E8771EF6504E593B69212ABA2F09F11B2D173312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521653, "uuid": "cc391f42-4432-4f20-9dc5-843c9226db94", "value": "d4d619a3c5b6358079da73c25b60ff7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521653, "uuid": "fc6a5cb0-f016-467b-9927-3259a5bbe897", "value": "6144:G/qPK+DjGzpHOw+uPNHXDrTiFr5yqKC65:gqDjGduwTVHzrTidCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521653, "uuid": "2bcea9aa-57b9-45a5-a89c-67dca8afc6ff", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521653, "uuid": "32857917-a170-4439-b78b-edca62d6f0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521653, "uuid": "99bc748e-52b7-4653-b2d5-9b238b62ccb6", "value": "89e8233b2e70f8dfa7a80086de5dd498.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2de8d11-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adwind)", "timestamp": 1685520642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520642, "uuid": "fb82d939-c8b6-4f27-a34c-62bfa9ff402f", "comment": "Malware payload (Adwind)", "value": "21d4eac22848040db50222ffd856f74d", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520642, "uuid": "be9844cf-ca7c-4dbd-98e5-9e5f75f1373e", "comment": "Malware payload (Adwind)", "value": "3a55138d4ba6decc5047aea525b402584f1cc0ac9149f3f296b10e795fca8ce6", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520642, "uuid": "3dfdabd8-d4b1-41e2-9742-05beca92d521", "comment": "Malware payload (Adwind)", "value": "aaa535ca49c0165d980c26f2d71629d8b54bb23d", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520642, "uuid": "c7d0e2a2-aaf0-4515-a03c-dcbb7c742d38", "comment": "Malware payload (Adwind)", "value": "1ed137a3fb0ef04e23fc886b5858af8148926c308f2d3f6f034ac56381aa573f945fba2d79136ef679ca8c6d0fd9c54d", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520642, "uuid": "834b79dd-7c78-45b7-a8e5-be7ff2c327da", "value": "T1EF6302A5BDE0E37CED374E3572609D5BDC168088D1DF826F12DCA5A31C70A89069673B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520642, "uuid": "1215611d-a147-4a33-b996-90e02058648d", "value": "1536:TyMEy4adXf+zc6NbssIhP5XsZMDPW83+zKjqDrWiVvTpckvao:TyMEy4a5v6ZCNsgvgKZiVvnyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520642, "uuid": "cbbd8ca8-8d75-49fd-b480-98d383083fb7", "value": 72285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520642, "uuid": "2e2a7e19-e686-4372-bf8f-101a2540665c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520642, "uuid": "6f796663-ff7b-411f-8e40-961401f99715", "value": "Payment_Advice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea560a8-ff77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685512501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512501, "uuid": "d53e986a-a2d7-4532-a0dc-4804fc56633e", "comment": "Malware payload (AgentTesla)", "value": "cc3978f671dda966674c941cf21df293", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512501, "uuid": "40a41d0b-957a-49a1-9c17-20d47d3ef1f3", "comment": "Malware payload (AgentTesla)", "value": "3b3d92018cb4be5a3223c8b556bb8a1c817e0cbc2188b6500cbc2d4dd6d13658", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512501, "uuid": "422a26c4-4ae8-42aa-9dc2-00d2fdff8909", "comment": "Malware payload (AgentTesla)", "value": "228eb6ca5e07f49747d3d3198020d54440b91dbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512501, "uuid": "e1c113d0-b81f-4346-b59f-c53977b4befc", "comment": "Malware payload (AgentTesla)", "value": "151f3b19899ba3ef19640e120d8afb0768873e28444882b203278f7fe0d24070daba3215e04b437eaeab9c9679d2acf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512501, "uuid": "70643b31-581c-4426-bdc7-8a573a69d52a", "value": "T108E41255EF3F1A0BC0A6BEBD5B3480345BFDD585803EE1EBDA67086FC8185346DA1622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512501, "uuid": "b20c6740-4551-475d-a8c3-d214f764a4a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512501, "uuid": "d6ee8e7a-0d2e-4efd-8bf8-f31f332554e7", "value": "12288:1MAMTihh6xhZ6Orhfexega/PzkwXe42WegArTQPY0cdowNRD:pMUgh8yhQRaQwOIYUBgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512501, "uuid": "15155db3-4db8-45f4-835d-2847cae2f3a1", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512501, "uuid": "d37bbe3d-0d75-4829-b155-58d4c6047b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512501, "uuid": "1afc1661-de8a-4e23-924b-7a48068e132e", "value": "Packing List and BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729dd83b-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522279, "uuid": "07df814e-3c0d-49f0-af98-d0e5e05e91c7", "comment": "Malware payload (Gafgyt)", "value": "09586cff92901d9e8b4991ac971a5151", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522279, "uuid": "970fb77d-5268-4230-9372-e4bc9d2be652", "comment": "Malware payload (Gafgyt)", "value": "3b85886dc281d9fd4bf8e2266b691fd4b9689ac12f5f275549523565f3a38323", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522279, "uuid": "6458b92c-88a2-40f3-9919-ed5e4cf7acef", "comment": "Malware payload (Gafgyt)", "value": "6eb3bef735d52f6a2987292faa9a45ebf4b61042", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522279, "uuid": "e8f710f7-96bd-4046-9851-353bfe5028d3", "comment": "Malware payload (Gafgyt)", "value": "d83c0b3d926e6a3dff92de9f8580c691e9c4017cf564419b5cf4cfe996140cd6746128a37d03150b7eff013b22ab0121", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522279, "uuid": "b18216b6-d19f-4442-9fce-72a8eeb0790b", "value": "T101C30905F901875BC3E227BAE78E438C77355E6457DB33156A38BDB42BE1B982D29230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522279, "uuid": "f393a772-e54a-4cb6-8114-9892963ab139", "value": "3072:TGGhNnu3jGOEHgsRq053bhISOMmyVUQuiXfQd6W:/ruxEAcq053pmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522279, "uuid": "d8744910-9f00-4331-bdfb-a2487a186fce", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522279, "uuid": "d8cde126-8b52-46f1-8d4e-2c79c15f30b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522279, "uuid": "d81221b7-234b-4960-b708-0fea386c22b6", "value": "09586cff92901d9e8b4991ac971a5151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99634d31-ff72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685510318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510318, "uuid": "2db3a412-95dd-49e1-96cf-05dc951f0e42", "comment": "Malware payload (RedLineStealer)", "value": "57ebbca2cea4cc68ed5e9ef73ce590d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510318, "uuid": "fd79aa1e-e59e-43c0-b79c-b579946f3ee0", "comment": "Malware payload (RedLineStealer)", "value": "3d8eab0992f3f1b56586649b05ef135e48e0aed7482cbb5e132f9efcab3e6a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510318, "uuid": "49becd57-b744-4a47-a1e8-7b6f7d29931d", "comment": "Malware payload (RedLineStealer)", "value": "fe41b1e40de8d71b6c3ac3e0c41b3c810cc2b396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685510318, "uuid": "84ef3497-fc9e-4e13-88b2-3e1363213d9f", "comment": "Malware payload (RedLineStealer)", "value": "9b70d847bd698ef6307e38c421c13ef57946a0677f5e0285beeb21fdb91f5e5458b54bbea59d203f15492fa624175ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510318, "uuid": "e2bd6347-0c23-4af7-98c9-515c5bdbbb3a", "value": "T12A3612AB61D83379E01EC43C45B3E919F2F6A55FD6D48A7B21DEBAC05F7140069C2B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510318, "uuid": "ac73f2ca-2d78-42a9-a269-9ca3e60770d6", "value": "f9644890a52aa13e3e994733d15fcb99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510318, "uuid": "9e811d07-b2a0-4df5-932e-d5cdcbb9001d", "value": "98304:wMXX5FfnH75zqYyYqwfdQ0EA00fFmD1BNvEtzTdOMOct91nu7VbTA68jqRNGn:wkHdqY+gKRYfoBBN8t9ONQ9I7VbX8jqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685510318, "uuid": "4dd83cce-a1dc-46fa-b663-443e8a9843c0", "value": 5303296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685510318, "uuid": "4e171ebc-ce04-47ad-a55e-d7673b5b9c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685510318, "uuid": "a542a06f-d1fa-44e2-809b-50eca85a0a30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbaab85-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533924, "uuid": "fd106b03-c470-477d-8f4d-51d9c85bba75", "comment": "Malware payload (Mirai)", "value": "e9f15015de679ed7d7b2e6c4c34a2345", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533924, "uuid": "7442a29c-a02c-438d-b1ac-75b683418bcc", "comment": "Malware payload (Mirai)", "value": "3ddb393c458586338cb6e96c50df64879ff07b44a252b2a6b60d6109fc00a40d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533924, "uuid": "96e51c06-3514-4fc1-b820-3c2d449a26a2", "comment": "Malware payload (Mirai)", "value": "9ad4464aa9b2558f32cfbf5500fe89d3f332ba2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533924, "uuid": "8280702d-d70a-447f-858f-a13a96f5a144", "comment": "Malware payload (Mirai)", "value": "6df8dc9bc2f9c04ba6f6d06bb0a68accb963f724441baf77df990dcb09b34cf443ff126e3bd66963603ac7c247ce6a29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533924, "uuid": "e5132477-59e1-42ef-b8fe-1978a8c71d52", "value": "T12453C85E6E618FECF7ACC33447B799216359338633E09689E29CD6105F6024D681FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533924, "uuid": "6a56bbc8-d75e-446b-96d9-6b21b3b87c11", "value": "1536:lq5RThRNhRhR/RuhRF25t0KQ0oaeHkncHnK:0txQ0ouncq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533924, "uuid": "c21df0c1-7e19-40f3-9d82-eb61d1eb04ae", "value": 61292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533924, "uuid": "245267e1-a077-479b-ab45-8d2fbc37c192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533924, "uuid": "58f9170d-b14e-4379-b0cb-255a46bc2a57", "value": "e9f15015de679ed7d7b2e6c4c34a2345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0818e2-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533888, "uuid": "decaa052-9283-495d-94b6-52980860a696", "comment": "Malware payload (Mirai)", "value": "83f26bcb018b10bbecbe65b6308aeedb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533888, "uuid": "2e322fe3-f8d3-475e-a395-1745c3d7e00f", "comment": "Malware payload (Mirai)", "value": "3e2afdd784bfde9ee1b34fd08917817aa9a95a537ce0e9ae9f2ce117688236b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533888, "uuid": "97ab858f-22b9-4b28-aca2-eab6c8eaf5bc", "comment": "Malware payload (Mirai)", "value": "af8d79228f5221f3945574b826116a4dee36089a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533888, "uuid": "bedd4bb4-06c9-4cca-a330-2823bc44b392", "comment": "Malware payload (Mirai)", "value": "4fed07877632bd42da6f72d16b26db76c000caf86a3a5fb8a2e2b511b20c509b14dac9c534b5bb5e6c2d64550c7839f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533888, "uuid": "a822c658-daeb-4c1d-8e1c-e07027b2ea05", "value": "T151E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533888, "uuid": "c4d960f0-5fd1-4b54-8ce1-081750531b56", "value": "3072:CJLce3pCsx7naLHbz4N9GUJURIJ1F2EXkkTM/9AIMY:CJLc61naLHbz4NMUJdH2EXkYM/9TMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533888, "uuid": "9d0cdce2-fc44-419b-b75c-ee7aa2748532", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533888, "uuid": "fbfb95e8-c1ff-4f70-bf0d-d3457c195640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533888, "uuid": "aec7b388-a33f-4b9a-8dff-dd30cef012ef", "value": "83f26bcb018b10bbecbe65b6308aeedb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d228d5-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685533531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533531, "uuid": "f4ee9abd-7869-42b0-a7ee-ea0cf870ec36", "comment": "Malware payload", "value": "8a40bb6b14682736fe06bd11fb985f26", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533531, "uuid": "0ef78a8d-d035-4354-903d-c3aed1165b52", "comment": "Malware payload", "value": "3e8138c2e3df4bf31ffd49d89f64916a72c02c612cd080cdec44fdafcae42854", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533531, "uuid": "f1347390-d8ad-4253-9f5d-18588323d72a", "comment": "Malware payload", "value": "44e58314a51239eeabd15870c142e7ae7179e011", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533531, "uuid": "311783a6-311d-4a95-8b0d-de037701fb0a", "comment": "Malware payload", "value": "1c4f3f106c40c3cbc4cb8550c0dc2726052c9b5b6c0533154f2942b0c433ca8597f6d25bd54383138750d10ee3a0e3f2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533531, "uuid": "781306e6-c9ac-4e3f-8f0a-b08049c2cf4d", "value": "T17EC15D39216C3D59CAAE50F4E2EA7ED50BBA370785CF7014F244D6F1260B2444E37D15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533531, "uuid": "202bf916-6c1a-49ca-82b2-2244415aa8a2", "value": "96:k/lUQKr4IyQRlnbrMmimYUQl+Xa4SW0KImPdwKNKmnpErpjkUW2qr2rg6UCmKR/X:2KQKZvnbg46+K4VOyjKYcd8r/6U6XH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533531, "uuid": "81cbc087-9873-49d1-b20f-fd2f62286384", "value": 5890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533531, "uuid": "09aaa5bd-95be-4d4d-9e65-bbf52b96400c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533531, "uuid": "5c7e558a-18e5-4344-b914-975edd7a7575", "value": "invoice_107_2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8f29d8-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685498509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498509, "uuid": "790d494f-ce97-4b10-a5c1-2d754e9e3bf9", "comment": "Malware payload (Stop)", "value": "c2e7878ad4e96dbd12b29df99e700479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498509, "uuid": "c3f55d45-8a0d-423e-9283-c46d2946e42e", "comment": "Malware payload (Stop)", "value": "3ef6d70a98ec59cb7af96103dd564931b8f811d67aab9ec0a0ccae4f49c9963a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498509, "uuid": "c6e488c5-2d84-4137-923e-744b1282f05b", "comment": "Malware payload (Stop)", "value": "24651727469af70e07019e9519bdd92c63a8755f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498509, "uuid": "6b7c8c0b-ce76-4959-9a4f-810bfa24e727", "comment": "Malware payload (Stop)", "value": "29aeec39b2c8abdfafb59d34dc434379205e92ff6fb67988e8553d2bc4f0d4b474e97119f545c0c358a655fe7cc95969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498509, "uuid": "01b0cf2c-00f9-4b51-8ec3-1d4c0a1c0344", "value": "T1A2F4123172E1F172D7AB58751C32CB68AE7BB9375B2646CB2F14272E1E701D086B2712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498509, "uuid": "87ebfbfe-3839-4b0a-86cf-1b1a7b22b516", "value": "27113c217d53f26eb8f070c56bd3d296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498509, "uuid": "c247ee0b-b9cc-481f-8eef-7222faad4793", "value": "12288:7O9+40Eqqh1QsJuPCG7ldiLCE7D4mJIjl+HGGp7vzDHeWaiOtBeL3s8hp1VS:yPMiuqGJdi+wDikmGp7vHeWeebs8hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498509, "uuid": "e271f4f0-4a0d-4b0e-805a-8232f98127a9", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498509, "uuid": "e51586c0-a89f-4cd7-93fd-1607d1ba470b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498509, "uuid": "9a14039b-bc2b-4bbc-b993-7c01de3b04a1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6576be4-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685520674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520674, "uuid": "efcab301-def4-4ed6-b29f-ed4a165d153f", "comment": "Malware payload (AgentTesla)", "value": "99e96210616953775adc30ba4217a6ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520674, "uuid": "3441baf8-7c3f-45e4-a7bc-2171dffb9c70", "comment": "Malware payload (AgentTesla)", "value": "3f2b7f883a7641b4c761e3db118dfedcd1db00b92c6bd41e10055eef97d0cbb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520674, "uuid": "c6c77494-627d-4ee2-a217-24446085ff90", "comment": "Malware payload (AgentTesla)", "value": "db97f47359d5f7ea7e00bf2110fe8b5b968e5a80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520674, "uuid": "70f9a524-2195-49bc-8740-d9cd2b5d430c", "comment": "Malware payload (AgentTesla)", "value": "7a3d034b073cb0e232bed43d4bfa1c22d0cafb99ab37c9347ab34d2aa8f3ad0d0d66f9da2e02b625569463df72a9d5e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520674, "uuid": "7ac508b4-7c84-4736-b4ca-a1fc5d8c6cfb", "value": "T1EDE41259EFBF1B07D5A6FEBC1B30507066FCCA80942ED1AEF5A7052FC8459342DA1222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520674, "uuid": "aa0ea268-7898-423a-a3e9-83657eb135ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520674, "uuid": "b1a23431-aa16-4f7c-bf82-a16cfab86165", "value": "12288:2bAMTihh6xhZ6OrEJIQmE/Wq5xyViMqVmEPdpNs2H+rf98QLyK1UlfoPB:xMUgh8yEiQmEOcs4dVmWF+rV8QOK1Mfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520674, "uuid": "6e937277-91dc-4a0f-bdf5-9b36d78a35c5", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520674, "uuid": "242cacc4-0ba0-4467-8d26-85db0ad0335c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520674, "uuid": "387ae352-e467-401b-aedd-eb37d22146b7", "value": "EML_MCLADEMAF310523000315PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e15f4f-ffa1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685530262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530262, "uuid": "b1cf22f9-bc51-4f11-89f9-1f0574dda6f2", "comment": "Malware payload (Mirai)", "value": "3d40b75d43c34ea663cf2817f420b25f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530262, "uuid": "a94ff362-c266-45cf-b13e-8c151baef105", "comment": "Malware payload (Mirai)", "value": "3fd74cc4b72d3b720be6e81c2f105ace80f24bac1b8a3aa6d3a68fa5373b7977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530262, "uuid": "afb61490-09d8-4834-9fad-2960cb2fc962", "comment": "Malware payload (Mirai)", "value": "b0893f128094185b2ecf2d8837918d08d9acffda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685530262, "uuid": "ffb7992d-cbbf-4c62-a123-27df672c751c", "comment": "Malware payload (Mirai)", "value": "bef2c1966b2c9903d863cbeb0be6158affc18cda1de1ed2157b52fe9d94792e438480e4a96ed72a53f2c4ecef8a37209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530262, "uuid": "e2511d5c-15c2-4d1e-84ac-3c76027d9b00", "value": "T178234A032592D1FCCD6FC3F4176AB972E13B713D0135A64A5BECFE211F4AD601A6A648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530262, "uuid": "1e43ce2f-5d88-4e21-98b7-778f9466f5b9", "value": "768:5gplhuslrXelfl66UBsnCixj8BJRj8eu299I3rXSL1XI2OJi3UnUkYIlV:klhuslrXelfl66UBsnCixj8BYeu88jSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685530262, "uuid": "4dbb563e-25ae-4c01-a617-aead70c961c8", "value": 47328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685530262, "uuid": "1130307b-9bc3-4b61-af20-5e1863b25458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685530262, "uuid": "72360025-b03f-426e-8978-7fadc6633bbc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9f7698-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533620, "uuid": "61a7740b-bd9d-4947-8c8f-431004af4747", "comment": "Malware payload (SnakeKeylogger)", "value": "bf59013763e9cf99c0d1c97a62148a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533620, "uuid": "f5934043-d0d6-4b6d-9f12-63e723f50470", "comment": "Malware payload (SnakeKeylogger)", "value": "4051cb962adc56da0c94bdb3b81fe0a0cf4d4b5fc0652289513a3691513bc0b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533620, "uuid": "762c3307-b846-4264-a20f-00d805417cd2", "comment": "Malware payload (SnakeKeylogger)", "value": "92762b9327e2ad1ef715da78736361ef3bac0108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533620, "uuid": "184d7352-f5cd-4676-ba96-c79fa3366f7d", "comment": "Malware payload (SnakeKeylogger)", "value": "843c8f28be289b5d3836b1630ad93e0cfb83c6bc03204f20c3c1669c14cc76eee075acea1650dc59025388c3c20f4377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533620, "uuid": "5e747dbd-8cb1-4a14-829e-f10fcf60cc43", "value": "T19FE40156EE7B4A0BC595BEFD5B7040B1A2ECDC905029C19EE976392FC870633EC8116E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533620, "uuid": "76dc34e8-eedb-4a48-8484-ee494f91feba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533620, "uuid": "16259e0c-4d15-48b8-92e2-5770ecfb9bc0", "value": "12288:3mAMTihh6xhZ6OrSdcMxDAXsfJstdKmRNX/Xm9EMY2nVPyPu:JMUgh8ynMxDWAidKsNPKEMlVaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533620, "uuid": "a2f2db0f-2dbd-4e0a-a2a6-e5ae1b4cd7ba", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533620, "uuid": "4552e578-15a6-46dc-8234-ad6c379bf4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533620, "uuid": "6af33d3f-8c3e-4761-aff3-1aa965fb1c63", "value": "PO YPH002-0461C.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afdefc5-ff92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685523903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523903, "uuid": "a839a40a-6d8f-4563-a7de-3d4242901876", "comment": "Malware payload (Gozi)", "value": "f1db5823f292de1d9886d1edfdd201ec", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523903, "uuid": "c181f164-0b33-4352-af7d-da5a5c740123", "comment": "Malware payload (Gozi)", "value": "41d2b29ba6b694a265dd626c6d91d3b81f2bf0f41283194438cdc21233245c1a", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523903, "uuid": "a723f65d-c08e-4208-8bf8-93d3e730a95d", "comment": "Malware payload (Gozi)", "value": "17a9fc9ba43a38fa741ba325d807f9adbf1b7b11", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523903, "uuid": "e81ee4d3-dc6d-4c56-b071-23f1909a4fd1", "comment": "Malware payload (Gozi)", "value": "3833c7dd770141568da3392be168ff50f25ab6dde693669ca3288085c80dcca5e610a1e8fdbb9b2df7ba5f1d042d9e14", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523903, "uuid": "78ae54a7-caad-4816-bc6b-391c72142a0c", "value": "T10223C06E7148E88DE5C38FD2E2A07A52065DF373A6D81402347E0F563F90E98F79256E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523903, "uuid": "80baf829-f062-4404-a72d-d24e3a107edc", "value": "768:H8b2c87bOYR29C18lZPN1scbjuroSGzoqqT7BJShIhMYDaGrlW0bGiU:HC87bSC18PlrbjlBzoF7rhyAc06iU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685523903, "uuid": "3699680f-d2ff-45c8-a97d-65f557dc72e2", "value": 47443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685523903, "uuid": "4c36f542-554d-4ae6-9ee7-a47b7a0f8a39", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523903, "uuid": "316263bb-541b-459c-abb8-4c79aad32827", "value": "Fattura_01062318.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec32cd36-ff67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685505732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505732, "uuid": "0fd55b56-6b0b-400a-8089-f3eccac6f723", "comment": "Malware payload (Mirai)", "value": "33f22f16b1a734df44d7d03d47d5ff3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505732, "uuid": "fbe9efdd-a62a-4ce9-843c-2cd5351ea4f4", "comment": "Malware payload (Mirai)", "value": "436dcb9d1ce6a4c4404505311e9851ef534267625fe3a3c0840ddeb5f15c12f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505732, "uuid": "0ef64446-f856-4dbd-855f-1c1b7673d67f", "comment": "Malware payload (Mirai)", "value": "b5a710ab3e89883bb64843d8e895474646f85aab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505732, "uuid": "06eaf5f7-498f-4bde-851d-b7a274cd5f50", "comment": "Malware payload (Mirai)", "value": "59588155b4f95577e742f016660f4b5f40ee637d7562c8f1156fdf2bdb34e13383a4663345b601728bc182d6f233016e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505732, "uuid": "ca51d424-6c69-4b64-a50a-852f8eb9ed1e", "value": "T1A5640287FB227C0BCA010FF125EB4B8EA67CA79B43CB9091B6C4855F25F61C576A12C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505732, "uuid": "3bbc2d88-09d6-42de-882d-615a4f144024", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioE:p3lOYoaja8xzx/0wsxzSiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685505732, "uuid": "6094b60a-d35e-4f4f-8788-20fbafb90df8", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685505732, "uuid": "7b064e43-1581-4e16-9451-c0def5a19481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505732, "uuid": "3373af36-4aca-4172-8ed4-04ab80f146a3", "value": "33f22f16b1a734df44d7d03d47d5ff3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d3f015-ffce-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685549985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549985, "uuid": "b4cb8808-04fa-41f4-85eb-09024e9eda5d", "comment": "Malware payload (AgentTesla)", "value": "9c48034dc708c0466b8d7be27d742437", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549985, "uuid": "ca30f6ce-460d-4ec9-aec5-a40830592ec6", "comment": "Malware payload (AgentTesla)", "value": "43e9db6b9ba0f48665e26a37880216e9b9135177bbb280b1b0143d2295b9a53d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549985, "uuid": "befc2e32-82d8-4e46-aed8-75a20cf09e45", "comment": "Malware payload (AgentTesla)", "value": "0fde6408322ad46919e09d62394be784f1d9d4f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549985, "uuid": "9ab9c89c-ef09-4180-8e3a-8cf99c837a4a", "comment": "Malware payload (AgentTesla)", "value": "00871699adb1fc43398343005e67054e707576d42942f28c8bb1e14fedaa3a4d7e1bf930bd4e0607805a4eb04f78524b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549985, "uuid": "e809742b-2e7a-4e54-8eab-4898b2072ffe", "value": "T16EF4F1189FBD062DC97B7BBCA6B0143452FDDE051827D75D4B0238BADC3BB7099221A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549985, "uuid": "d7a9d6c5-388b-42cd-9021-8b32140b9037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549985, "uuid": "f7c4fcdc-9917-43eb-9c1e-eebb224f913c", "value": "12288:QfaDDDDDXDDDDDGAMTihh6xhZ6Ord8NqBLYmHWiR2mWj3rLT5Q:9DDDDDXDDDDDZMUgh8yd8NkMm2kglQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685549985, "uuid": "caa4fae8-3e79-41a5-8651-6be07a76f0e6", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685549985, "uuid": "d4bcb46e-1f66-4f1b-abfd-58298f13cef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549985, "uuid": "e387dac7-70ab-4368-ac2c-b7c6545c00f1", "value": "41570002689_20230531_05352297_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762afc04-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522285, "uuid": "712b8144-aa16-4baa-97ff-61f6c7a04cd3", "comment": "Malware payload (Gafgyt)", "value": "d59365607b254395bf0f5f0ffe0f363a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522285, "uuid": "0fc3f8df-88d1-40cf-8bc1-65f1c83927b0", "comment": "Malware payload (Gafgyt)", "value": "44829d7defe301655597bc5e5aab00bba97324bf290857672222c9835929f2bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522285, "uuid": "f0176809-c387-4ca2-be7b-2423604c61fd", "comment": "Malware payload (Gafgyt)", "value": "76bf13206a45961f1899e0ca06b39571abe3497e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522285, "uuid": "e21d5acd-35d4-4d7b-adbc-0db1882cb7e5", "comment": "Malware payload (Gafgyt)", "value": "a02132b589aa6ef9f849f8e5809508236fc79edc9e4957bccde67fc86a4f8f42b7bb9a7754b528c9e4bcab61bddc4356", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522285, "uuid": "28f7f7bb-70d6-47df-bffa-aa5491d9f693", "value": "T1E1C3193B6B270E23C0C9507116E31332B9B9DE5938B943D7AAD07D9C6F3A58834167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522285, "uuid": "55cd4655-4a9f-4cd1-8b7c-3283976cd399", "value": "1536:ivJm7TYtgc6RhSsN95fftvLItIiRdF/Mfm7ypwYujl3IdnuW:pNhSsNPq7lMfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522285, "uuid": "69cccae8-7634-4c86-9994-cb2a0a28dbde", "value": 126438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522285, "uuid": "9e91ca77-3db7-4f27-ac77-e9621b059ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522285, "uuid": "e2a7b917-0dec-4942-8ff5-3d4ccd20223d", "value": "d59365607b254395bf0f5f0ffe0f363a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a53c09-ff67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685505475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505475, "uuid": "cb38c4c9-b048-45e7-b5ca-798cda325d9a", "comment": "Malware payload (RedLineStealer)", "value": "ed1561c9851a479d7fe85248706a4cf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505475, "uuid": "2c0897d4-6d12-4274-b11a-c89b6087a1ce", "comment": "Malware payload (RedLineStealer)", "value": "4522fdb441ea6926faf2251d1730b7f14fdbeeba8533ccacb52b8c28fc7b3d5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505475, "uuid": "a6c13d85-a36c-4fec-a473-cc83244f8cf9", "comment": "Malware payload (RedLineStealer)", "value": "4c323a6dab8416cf49bc4f0c71d3cfc4cc11ace3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505475, "uuid": "25303d06-1639-446b-8132-573ec87ed30f", "comment": "Malware payload (RedLineStealer)", "value": "4f41d7fbebffc7dcb2b4c69e54853a61e75f2f15ff21c22b80ee325a967110e684fe2ef833ac929d083d4fc7748253ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505475, "uuid": "bd2b4d08-fdf3-4b3c-b474-75713e772073", "value": "T12854D021324C84B7F4571475C9B9EA7786A875351B2F11CFBBC166AD0B263F2AA32703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505475, "uuid": "0fde83e9-9487-4164-8263-c5f31059c6bf", "value": "9bdbe8a3e1a8a51bbfa2b084f3532ff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505475, "uuid": "f2490de4-6502-4752-b1b8-97499a73b32e", "value": "6144:YlWYi5FZuEwPkI2AIhO9drA348Idx9ZcjZMj2aiD:/R569PZ2ANZ84809enbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685505475, "uuid": "a998b0bb-cac5-4405-a176-a625237c501d", "value": 301816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685505475, "uuid": "387ea8aa-5335-4acf-994d-677312e761c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505475, "uuid": "dae91af4-e902-4924-982a-61cc0e775ef4", "value": "ed1561c9851a479d7fe85248706a4cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6d065c-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685533064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533064, "uuid": "c886fa0f-0728-4b51-bb39-e57f0ffbdc53", "comment": "Malware payload (Gafgyt)", "value": "308693b8fc514c7b316ac620b5b1595e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533064, "uuid": "76fc4f00-8e62-49b0-8fe2-f1549e449ffc", "comment": "Malware payload (Gafgyt)", "value": "454cad0234e9989c9996128856ce6ef8400760dff35a2945d511acb1344ffc90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533064, "uuid": "e6bb7d32-f885-4db8-831a-d3144ee2ddde", "comment": "Malware payload (Gafgyt)", "value": "058950377e119afb0dad9c54690c18118c77a75b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533064, "uuid": "108bd576-f959-4402-b708-da4d26cfe74e", "comment": "Malware payload (Gafgyt)", "value": "95cd602d3298c9bb921b558afbb77fe8784e5020dfbc4401a6bdf7b26b38372288f1aee5bb381079d828a43f2c8914a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533064, "uuid": "098ec6d1-0283-44f4-a467-eadd24e1ee09", "value": "T173934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533064, "uuid": "14841390-38fa-4e80-bf65-2128c7d2d76d", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3vphauH/UPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdvphaE/+Vog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533064, "uuid": "2f6e6c4e-7b8a-41ac-afe2-76d933c2d539", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533064, "uuid": "7ce32dbc-b1d7-4007-a4a4-ae50063ce40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533064, "uuid": "7f963867-2662-451f-bdc7-87edf9bf92cd", "value": "wznbins.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ce0674-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521017, "uuid": "7187a604-7a9f-48e1-ad12-4f3234d03c99", "comment": "Malware payload (Stealc)", "value": "f14001baf09dab718ffd089e009307bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521017, "uuid": "7fbcbb4d-a215-45d7-81bd-aca8ee289042", "comment": "Malware payload (Stealc)", "value": "4553f7fec69849b55236be3786be17ccd50b2186f177520e94861f172a44a691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521017, "uuid": "d634ffc7-a92b-4820-93a0-146372ebe334", "comment": "Malware payload (Stealc)", "value": "a049550ebe28f95d124c7d739e2e6241e05edb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521017, "uuid": "c327475c-08ef-416f-84cb-8aea8201a0bf", "comment": "Malware payload (Stealc)", "value": "c82b819eeb863c709ddbfe58f2b3f855d50e76dfb2554641dceb49de0f5c329ef31fddcdbc85d1bb214377a79df7c193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521017, "uuid": "ec8ac4f7-7f70-4c15-ba33-bb8060116972", "value": "T1F4642A03A2E17C6CF5264A719E2ECAE8761EF5504F5977A733189A2F04712A2C172FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521017, "uuid": "69070c50-7707-4f23-9841-0ad8bfdaea38", "value": "0a261f793955a0334411687f62dd4035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521017, "uuid": "c955914b-89d9-41f5-aa6e-26878d5f2800", "value": "3072:mlNKOMGYbCh6nJhpsrFsMdM8uaP63AhVsUFbU2PXE3/eOkLETpAcE6fpT:DOTuJnePM8uNAhVsUFQfkLLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521017, "uuid": "885bf483-3950-44ce-9efc-d24d7d9e26f7", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521017, "uuid": "535296af-b197-4711-aa7a-991c6c5d6cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521017, "uuid": "04c13922-7825-4d74-b8cb-4b149038be9a", "value": "f14001baf09dab718ffd089e009307bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a809d4c0-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685533535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533535, "uuid": "eb9cf1a9-36b1-4eb0-86a8-f849600e7ef1", "comment": "Malware payload (Loki)", "value": "47e540db3d4a739e9618175229628524", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533535, "uuid": "6b493815-c465-4b2f-b12c-53bc687b3a80", "comment": "Malware payload (Loki)", "value": "4627c2dc4ff8bf1b5cf50480d2bae9e05fd277887b8d36e44882b11e4a4c21fe", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533535, "uuid": "216c992c-f01e-4683-b0a8-799a403f3ab9", "comment": "Malware payload (Loki)", "value": "49ea959dd39a27797cbe87fad183222ba0ede8be", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533535, "uuid": "0ba33900-6785-41e4-bbca-32d2f54e7e03", "comment": "Malware payload (Loki)", "value": "2a4be4bb2e9c0f981366e338a8e6aba4766f13f8c4df534f7fc94e9b3a09ac922a8f3cbebca2704143f46b689ac30b93", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533535, "uuid": "17aa1a69-6590-49fa-804e-f74b0068d523", "value": "T17DE20B5AE79F02B48F511376271B1E89A6BDB22EB351507178AC833433E9C3D42766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533535, "uuid": "2aed10ff-2cc9-422a-9911-797b1743383d", "value": "768:cFx0XaIsnPRIa4fwJMmZrO6D+MLr758t/nafWy:cf0Xvx3EMm5dSMWtyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533535, "uuid": "75ac196f-1df9-4acd-a354-a9b7f3b8d218", "value": 33082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533535, "uuid": "bac359c3-c5b3-4b51-8ecd-b5d3678e293a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533535, "uuid": "6b624ef1-99a7-4550-9aba-d3bbe40c2a66", "value": "New Purchase List.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6153009-ff90-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685523224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523224, "uuid": "b5447fec-8e08-4e68-abe4-4211ce025f6b", "comment": "Malware payload (RedLineStealer)", "value": "a15dbd3e3c605d7578581d1cc025c482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523224, "uuid": "a41f73aa-87b3-451f-bf20-35074fa2d413", "comment": "Malware payload (RedLineStealer)", "value": "4636de70d2530da3e3b465768fb3b608af889229e175f23c725f7ee2438b07ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523224, "uuid": "0ee9bc1a-321f-4e28-8273-f1f9f3890f8d", "comment": "Malware payload (RedLineStealer)", "value": "2c248ab0c1586ae4dfa99d5c1af8c437ea21e858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523224, "uuid": "6a8b95f1-4f58-441e-bd45-2e29b313c7ba", "comment": "Malware payload (RedLineStealer)", "value": "f04bb9a36d68617e2f2ec890b08c2df38f58c619ed1b9b862fbb356a493e4f43f7a4b582f27e03cdf3e68c95cccb2a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523224, "uuid": "585a7ec8-6b9a-472e-b4a2-bcd9c0fd5b6d", "value": "T1C2D633F3069693E8D0F71BF2B5D370778219EA6949E00C712AF29FE0D9B52CB94164C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523224, "uuid": "2f2d20fa-f98d-4d0a-8f07-beae1945a199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523224, "uuid": "b8dba792-25f6-4905-a5a7-fa3973fcfcfd", "value": "196608:Ypg5wjlkPtqYDwHauuKGZFjo9Jhzc13Mpaukuue21/TabnMIPAf+mEMNJmB:Ypg5LtpssKmjo9JC38nsZ1WbnTgtvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685523224, "uuid": "57122e97-5892-4a65-8d33-12a5854452d5", "value": 13859840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685523224, "uuid": "2d79288c-e060-4364-9952-a3ac425e2b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523224, "uuid": "20a8cfe7-4400-428e-a7ec-8e37200d8e2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84e4ec0-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521590, "uuid": "36ba0dfc-83f0-4283-aed5-4ad3d468ad20", "comment": "Malware payload (GCleaner)", "value": "f65763d50b117ef9e37ccfacafd91ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521590, "uuid": "78cfa3d1-526e-4273-b66f-c6bec9cbd1e8", "comment": "Malware payload (GCleaner)", "value": "4676b676baae0dde1ae4ae0c6bc64797a3153b62761a9aef85750fa5d73b6c96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521590, "uuid": "d9e5d325-d9ef-4517-bbb1-84d1da7bf6ae", "comment": "Malware payload (GCleaner)", "value": "356393e6862d2b0ce1f7a3adbbf374e0864f5c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521590, "uuid": "5321563e-5f7a-4105-a083-53ee4c47bfdc", "comment": "Malware payload (GCleaner)", "value": "a0c3d1ad77b2abbc7e92b6a9a3847a71ffa75161c2768305ee6f91e1388321f4af235287c328fabe37433edb9a10980e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521590, "uuid": "e0fbe333-fca0-47a4-a6bc-72a101c8abb4", "value": "T1F1A53322E1A25435DB72D7342C28407E7DB73B1B982C86CEB1DC4D6B5732AD9A053B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521590, "uuid": "e2e2a3f4-48c7-4eac-9494-32e10e72bc6c", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521590, "uuid": "ef070e00-7bd6-4a56-b9f1-9cce25e053ce", "value": "49152:OigTJ1JvgckVp1LxvBXnnsFRfjkKFs8wuI:OigT1gBVp1LxvuLfgKy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521590, "uuid": "e483d5c4-01e3-47a9-a8e9-5be267f9ed9b", "value": 2093913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521590, "uuid": "4816a349-9063-4f7f-8237-13646a5ef0cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521590, "uuid": "93184f8e-ecf4-434a-9393-87df99df5a98", "value": "f65763d50b117ef9e37ccfacafd91ba7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c192144-ff9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685529220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529220, "uuid": "3de23a48-4fb2-438f-8e57-fad68201bb1c", "comment": "Malware payload (Gozi)", "value": "39fdc064f4cec537f761f279a9b4bae8", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529220, "uuid": "bf6dbac2-b996-45c3-aa0a-2dad350bab0d", "comment": "Malware payload (Gozi)", "value": "468d43e1308cfbce75402ecab024ce26ca0cf2837bcb68e40a85a780ec25f563", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529220, "uuid": "b4c2a7d1-cb64-4d0d-bbee-9153c9fcb063", "comment": "Malware payload (Gozi)", "value": "6a45ccbeb0b85c1eaaeac77db11dee869760d8de", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529220, "uuid": "31590505-7de3-4ea0-a778-88e80c6f0f9d", "comment": "Malware payload (Gozi)", "value": "b032668feefe5172ca7f0ecb5deffb183cf70d9dc012436d693c5343225ee284673e9f50ec68080f0875df238176813f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529220, "uuid": "b1049804-0c6f-4260-8866-ea1adec402b5", "value": "T1D92412E69DA99C7FE8F5C1B2912D39D200F8F1925FC2090134BC5A926740D94BF6BC9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529220, "uuid": "f6a5ca2a-2298-42ef-a001-0bbd9e7c4b95", "value": "6144:nnFzFG5sza9iiJwtHak/znyHNeEIwpgw/+:xFG5joiwtXDkvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685529220, "uuid": "17e714f4-8eda-4224-907d-ead39c3b09d1", "value": 210626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685529220, "uuid": "662c891a-0501-4cf4-b991-72a507443335", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529220, "uuid": "59c72671-dc65-479b-a2fa-76d3f694c467", "value": "inv_658677_18052023.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237ac717-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528159, "uuid": "029813cc-b83e-4359-ad07-8edd454da623", "comment": "Malware payload (Gafgyt)", "value": "2f5362f98bb6635c970572ae72e0c9a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528159, "uuid": "4bba7e8f-3d9d-4f8d-a3d8-a122647b9795", "comment": "Malware payload (Gafgyt)", "value": "48991fb76ab9b318bfb9ac481e3d5c605637d0371bdabaee635212eab51f8b3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528159, "uuid": "f12d9597-5472-44a4-b568-6a2a9a9a38f3", "comment": "Malware payload (Gafgyt)", "value": "711aea0b74ba0c3c77f3f7dcc7beb3375be29883", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528159, "uuid": "9cfb8cf0-bc74-41c3-903f-21e1f5144e03", "comment": "Malware payload (Gafgyt)", "value": "df6c2918748e9e742d4ee847280765cdd7520f7d2d2d2bd6702973ae2bfb2c8e46a7b8e4af385f86618f599363780eaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528159, "uuid": "8d33ab8a-cbae-43ab-84e0-dc482baf16d2", "value": "T16BD3D701F9104B6BC7D2ABBEF745A2CE77719D982F933306D71D79B027D06A96E29200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528159, "uuid": "95357975-14ec-4960-bf4a-d6ea1dc66ad2", "value": "3072:M9bKi+t0OTbLa+zOvIvJu3E9cQ2BCp7UKVLKiqAY99y7RS3RuTt8mXVHDLd/kQcM:M9bKGiqUNGRuBXVHDLd/kQcHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528159, "uuid": "922f0808-3b39-4911-ab1d-05c66b19b7f4", "value": 139481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528159, "uuid": "9452a892-dd30-4c02-8ebd-22e6618a797f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528159, "uuid": "8779ef6b-4695-4a78-bacc-f65cd5c660a1", "value": "2f5362f98bb6635c970572ae72e0c9a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ba865-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533910, "uuid": "8e1dc19f-c86b-4df1-b2bb-549551b755a1", "comment": "Malware payload (Mirai)", "value": "c09df10b8ecee8cf0d8cecf9ad0fe841", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533910, "uuid": "13e578c7-d214-4d41-99f8-11f3b2125802", "comment": "Malware payload (Mirai)", "value": "4a2ec637060578f85af390a47487eb4826313eb9b34ed0fc8054bc60c52ba994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533910, "uuid": "c1830ff0-fdde-42d8-9505-7c9ba175092b", "comment": "Malware payload (Mirai)", "value": "c95e18bd5eb8f88122800380990a67c4a5a0d3b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533910, "uuid": "a0ccb7d5-f48f-4f90-b958-e4c64a12e87a", "comment": "Malware payload (Mirai)", "value": "d2d40b7c1ab02da5a99023737abed4e8435c39d389aae50a4d926f100c45cf03e69f6f82e7476d07efbde8a13b3b7ca3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533910, "uuid": "b1cba8bf-ece8-4d64-8d3e-aaa1a7632d39", "value": "T16393D615BB550FF7DC5BCD370AE91B01348C964A22E8BB367934D828F64B24B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533910, "uuid": "ae43c5c7-ac50-40d1-ab16-7c165c0cf392", "value": "1536:WrbsPEiigJox62036FBdfbHbxEIZmVqGYc1QZ0WNP:WrbMDjf36FbbHqIMS08P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533910, "uuid": "43f4ec68-a358-45ea-bc55-a3521a2f2acf", "value": 88880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533910, "uuid": "061e97b0-34cb-4500-9298-e28ffee16e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533910, "uuid": "b2412be8-fb57-4ca5-9915-9e6028d12fdc", "value": "c09df10b8ecee8cf0d8cecf9ad0fe841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47fa522-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685511625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511625, "uuid": "3cd5fae3-644d-4fea-8a35-dfaa247e640b", "comment": "Malware payload (ArkeiStealer)", "value": "91ff158a97a75d49914efb44b11ab82a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511625, "uuid": "ba3d0537-184b-40d0-9a12-826ecd34baca", "comment": "Malware payload (ArkeiStealer)", "value": "4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511625, "uuid": "07c2dcdd-2db3-48a0-bdbe-675364a54a3c", "comment": "Malware payload (ArkeiStealer)", "value": "1e5b91b3a69eeb4d7c9286654bcaa36def7bb9df", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511625, "uuid": "b2617758-8cd8-459f-a61d-944eafa7db13", "comment": "Malware payload (ArkeiStealer)", "value": "bda5fb08c01b01b0faa84be5cbec6df38451431907a24a3f4c624bd5ffed10b04721cfef114c5fca7ce198a77e1ce780", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511625, "uuid": "08e69a41-464e-4d3d-9e6d-a9259502326d", "value": "T17093F804D480961AE0A8037FC5AA57FEE41C5E7893ED60C3EFD16F661AB56F5287208F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511625, "uuid": "04de5c47-0aa0-4a14-a9ed-8732583e813f", "value": "4c665f81387442ad965e3f4eba69f083", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511625, "uuid": "b19672b6-261a-4d40-9541-39e344b92f7b", "value": "1536:gWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUl3jy0:gWTHVn8TXvc4O3CFvlaSED1Pgj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511625, "uuid": "4608e578-efa0-44a5-8251-c1227b55bf62", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511625, "uuid": "237886ad-6992-437f-8a4d-1cbf198f8b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511625, "uuid": "53380db8-e360-4918-90f3-7972abc303b0", "value": "91FF158A97A75D49914EFB44B11AB82A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1134adb5-ff7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685513525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513525, "uuid": "8ac6465f-83d7-46f6-8502-5ea2499dfee9", "comment": "Malware payload (Formbook)", "value": "bd3017ea9d31a8d2e3b84066f8e08df5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513525, "uuid": "efd2fa6f-5cc9-49e4-92ba-ce4e1ba226e2", "comment": "Malware payload (Formbook)", "value": "4a95def53551e5b933ee45ca35a2dcdb99ca8dcf7fbe64ef0b3dbc7624403efc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513525, "uuid": "672de4eb-3846-4cfa-8035-6ed8b33222ca", "comment": "Malware payload (Formbook)", "value": "6c77818a4f626561bb5c8c98372cf4888f675923", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513525, "uuid": "c2e60c56-83fb-4e84-8e1c-7419cfced8a6", "comment": "Malware payload (Formbook)", "value": "1a5e923d64e36d02109e62ed4887665f2f127aabf31b07b8271bef4bedb92a4d698652d516dd5ae188c28f9f3b19db93", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513525, "uuid": "d68dc829-158a-470d-8c35-782b628c8308", "value": "T10215335CEB903AF254CE00D2755B4B8E6041DB1B9B7AEA7CB38B4A1712ADDD427104EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513525, "uuid": "bed1d6ff-eb93-45ac-bcb5-b9ec05c0b6e9", "value": "24576:i80xtdBy/DHh1dL0R8fr17srzATofDzfqf8nbjva:i80zd8bHh1dYR8frRsXDziC7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513525, "uuid": "1542dcbb-0075-4771-a9a3-65e2f4355472", "value": 958625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513525, "uuid": "93ed554f-52cf-4cbe-a1be-6035a7c7c594", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513525, "uuid": "356b0f4c-7367-4025-9c91-445784912910", "value": "Receipt878673 PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a8cc6f-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685533179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533179, "uuid": "418d9e9c-23cf-43f1-b7ed-f9aef21377ed", "comment": "Malware payload (AgentTesla)", "value": "bfa589e600c815a898e5acc64d026aa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533179, "uuid": "505c7d90-e7c7-47c7-820f-399c0aa33481", "comment": "Malware payload (AgentTesla)", "value": "4ad393f95bb4d8d63b58c3b2f0d487d63e0758b6420f59f29a5a666e98c375da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533179, "uuid": "5f9b56c7-90bc-49c9-96fa-44bc9f2c4f75", "comment": "Malware payload (AgentTesla)", "value": "9083f4a691d131580669e384dfb9243fc1d57636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533179, "uuid": "f978b5f9-106d-4e54-93e1-feb3d41988fa", "comment": "Malware payload (AgentTesla)", "value": "9e8f3d0c0b88285b65a8de21e8f140b0c97a8fabd5155c60e635b4274f5fd2aebfb01797ad4b1e996d777435981efdb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533179, "uuid": "6aaaec65-f346-4e5c-839c-58191789e392", "value": "T186B5F1963780C596DE9C42B69252C1B02365DEBAC508D64B7BC83F6F3FF57920822367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533179, "uuid": "28e0e169-5234-451d-a52a-570755a8642f", "value": "49152:jnoyoWrAnzcL+gh12wNQ57H5I1GGfgIjqKoeL:jnoquzc8wNQx5GLjqKoeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533179, "uuid": "2b77651b-b211-46b6-93f8-5202d8e1dda6", "value": 2492416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533179, "uuid": "82db5af8-cfa9-44cb-87bd-2ae77979ab2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533179, "uuid": "d734ff90-75bf-4b57-95ef-3aa499670bc5", "value": "MACHINE SPECIFICATION #30523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6cf541-ff87-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685519233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519233, "uuid": "8abb4458-04cd-47b8-8be3-053c540fa719", "comment": "Malware payload (DCRat)", "value": "befed138a635a6ab7395f50f5d9e7662", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519233, "uuid": "57c079fa-cb3b-4383-a2fa-1e981d11a26c", "comment": "Malware payload (DCRat)", "value": "4c087150a0e17c46885efeced99be0b2a3f0f3d6209154aabd3c3871f1ec77d1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519233, "uuid": "66682149-fb43-431b-8caf-98d550c41257", "comment": "Malware payload (DCRat)", "value": "e9c8cbbe31b674f74f7056a748ac51c74b4311dc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519233, "uuid": "2142ae84-66c6-419a-8ec8-f04f88b055f4", "comment": "Malware payload (DCRat)", "value": "ec744412e0c0adae858b5f381c57e777869efe101f3fc9baac1eb30383f129f7a17ed1705bc573649cc3e51585c8360d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519233, "uuid": "c4b64dd1-33ae-472a-a5e3-078132e41146", "value": "T1F1A5221135D68436D172183009E8EAB969BDB9A14F659DEF13D40FBF4B343C1C63BAA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519233, "uuid": "12373d6b-c8c3-425d-9a67-77789249c18c", "value": "89b3a6f6fa95f20a6ae4cdbb8278d185", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519233, "uuid": "ca29d64f-d8df-4009-96d1-42cff491f5a7", "value": "24576:yqgkC88oOyh+i5Q/39MJ6hzCrU/GHHUTB+8oeebf:ngkC8FOyU8u39MJ6hzHlI8ojf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519233, "uuid": "39a9482d-b026-4bb4-b1ce-c18903001418", "value": 2235392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519233, "uuid": "a8b28996-eb79-4dcd-8644-1dd2ca9cdfa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519233, "uuid": "a1acea08-d380-4d57-a470-b98e6265ff65", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863d04f8-ff77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685512433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512433, "uuid": "73738048-8b57-45bf-9b0c-91970dcde683", "comment": "Malware payload (Formbook)", "value": "5c8a312144bd62a52834c90a7188fd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512433, "uuid": "ae3db154-807f-4058-883e-6e223f35369b", "comment": "Malware payload (Formbook)", "value": "4c3bf7999d35b0d04557e6887c768432fc819560b012a82ad029d8da1bb2af87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512433, "uuid": "95b0ab4f-cc2d-4437-b45e-f2a3c51717d7", "comment": "Malware payload (Formbook)", "value": "c01c5d00efed701142683b245cb06d6fe418e700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512433, "uuid": "6748d608-19d8-42e8-99cc-df07897cd96f", "comment": "Malware payload (Formbook)", "value": "3cc7c7f9351a31568b28e9aa76bef07294ff7dfaf2cebff5e27fb10b3f2ab2e2e102b00a5b2d94a72e39b994c9fea936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512433, "uuid": "7c586b15-7416-4968-9afc-aa88d6817014", "value": "T189F41212EB7F5A0BD9A77FBD5F308130A7EDCE40842DD19FE85A582FC8995346C91121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512433, "uuid": "d118d547-d7d5-486b-a6aa-7ec8ae40d8ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512433, "uuid": "211a2da0-4272-4ae7-9af2-702489038bc1", "value": "12288:PVAMTihh6xhZ6OrDO6Ba7EoWLcwcZ1vFzcXpd6xUUpVsI1AmK6r8:WMUgh8yDC4cntzc5d6+aV5AmK68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512433, "uuid": "e1773910-95b1-4704-8d91-887489c30a9a", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512433, "uuid": "42dc171c-e9a6-45ff-8ba6-021723ae306a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512433, "uuid": "c2132e54-4265-4d07-8071-53552fcfd7a6", "value": "New P.Order.contract-8763-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9c8637-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533892, "uuid": "aaf36606-73eb-4a7b-b35b-217be8bd97bf", "comment": "Malware payload (Mirai)", "value": "f639116f1f25d3a06926c4040894d25a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533892, "uuid": "4218790d-a43c-48bd-96d3-af71c57e8aff", "comment": "Malware payload (Mirai)", "value": "4d3898a4990ee3aacebe68cc6ca7fd505ba59e9a39bd56bf14fee1f3fb19821c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533892, "uuid": "34f0fec3-941e-40ca-8586-541a18a12cf8", "comment": "Malware payload (Mirai)", "value": "1cd43e3e2e50a3920c71ad54573476f54721f7fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533892, "uuid": "5cad9f8b-5220-463c-9643-3fbd5a23618b", "comment": "Malware payload (Mirai)", "value": "7f6db1b6dcf71ae1e84c7a72fc71a24472fb0bb880a07748dbcf123fe082d38e842b9b57f504194aec284e35f1a7da52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533892, "uuid": "a4602921-71dc-4a18-b98f-7944dac1047c", "value": "T100438D36E96E1E74C08641B074748EB56F23B4C893972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533892, "uuid": "0791fa63-4d7b-46f6-bd7f-cdc16f03fdd3", "value": "1536:9aa0brW/Od9hlCRDei1KQXACspfDCMx2+Wp:9v0brWGd9XJicQqpfDQ+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533892, "uuid": "1221ba30-6a8d-4817-a639-ae2f437a8fec", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533892, "uuid": "7c2d5a05-d500-4edf-a2b6-c8105ab60c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533892, "uuid": "7e0c42ad-db30-4eeb-9ad9-619f6db8ec9b", "value": "f639116f1f25d3a06926c4040894d25a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e3ab00-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533956, "uuid": "813cac4c-7c40-4153-8061-d2c7567c05f4", "comment": "Malware payload (Mirai)", "value": "345079ff522f7df4ef00df13d220d4db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533956, "uuid": "60cfad5c-ffb7-4fc2-9588-cc8f2616abe5", "comment": "Malware payload (Mirai)", "value": "4d97727af184c5077acf63e6e329e24cc5705f4ed1adf56d8d452fa620f8a514", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533956, "uuid": "e201c138-7646-4d80-8e5f-75b33d0f1834", "comment": "Malware payload (Mirai)", "value": "b9f9b4ca95653676b168d69519680fa8e8c259eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533956, "uuid": "2f5203cc-5cad-4b52-9bc5-8cf40311e3fe", "comment": "Malware payload (Mirai)", "value": "316f31e864aca2a4a7e7e86be604ec1398ca510833883b0fc428e0b9adac758d9f8bf2ed39275b37fcd9574f51e569b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533956, "uuid": "9db75f15-c27b-4d6d-b2e0-89520242b162", "value": "T177633BDAF801DD7DF81BD77A4453090AB530B3D502831B3B6397B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533956, "uuid": "46010bca-4084-4232-bb35-3e8379515173", "value": "1536:fAgVFBxENseDYrly8VhyCO1sxyWbxdJiLU11i+VQPK:fAQFBONPErlWCO1GySx/o+VOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533956, "uuid": "8121ce8a-2255-40f2-a3ce-89b3d582446f", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533956, "uuid": "b0afd306-145c-4e78-832b-4f29fe028a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533956, "uuid": "8211c968-4c77-4c33-9575-29ea81834941", "value": "345079ff522f7df4ef00df13d220d4db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83de406f-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521019, "uuid": "232cfac5-4a49-4091-9aee-3e5b41c318a9", "comment": "Malware payload (Stealc)", "value": "2463ffed93698137eb11e380df9fbe0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521019, "uuid": "95861208-0a06-4298-93c4-9cf8a4543942", "comment": "Malware payload (Stealc)", "value": "4dd6fde9841930dedc4eb00d48403ab5e836bec4dd9f7c7f76dc46b1cfdb65a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521019, "uuid": "341f2220-429e-417b-aff0-361facdeef0c", "comment": "Malware payload (Stealc)", "value": "5b45e1bdc240f34b0fa3513a66e275a04558b76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521019, "uuid": "51d499b1-988b-404e-b013-cdb01ce9bfa3", "comment": "Malware payload (Stealc)", "value": "d11b2b45e2f9f012d2cca5e32e283be2997c351d73143b8220c33cdcbf4ccbd527997bb9a3d26e1cf58534d72b5eec3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521019, "uuid": "eeb53691-0428-490b-94f6-72683ce3645a", "value": "T10A642A83A391AC67F5264A319E2EC6F8771EF9534F5977A753185B2F08702A2C172B30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521019, "uuid": "ca5a7e7d-bede-4d36-a0c9-0e7261bafdaf", "value": "067710d045234604093d7ae15ed3e5e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521019, "uuid": "c0299b41-29d3-46e9-a531-16f7d5dbd341", "value": "6144:emzcViTlbx+w899VTNy75htrCy4hymS5Tj10:eZSBMw8xRyjdtmeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521019, "uuid": "ba79ed6b-eb77-4abf-9644-f942a2c24bb2", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521019, "uuid": "a39ecc4f-c986-4698-a54d-8858bc9280a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521019, "uuid": "658dfcbd-6ba2-41f6-9297-9c59ac04422f", "value": "2463ffed93698137eb11e380df9fbe0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f543069f-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685521639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521639, "uuid": "89550747-4023-48e8-b8c2-eefb26b98dd7", "comment": "Malware payload (Formbook)", "value": "3780b95f84bb196864914217bfccd6a6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521639, "uuid": "3ac00bf6-d15a-40cf-a5bb-6f4fafc4829f", "comment": "Malware payload (Formbook)", "value": "4ea5306ff4569c5ed362118b7a9b568451e03bc90c90299bb00d8bb7e319257e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521639, "uuid": "cbc745cf-7a87-49db-a0b2-b36033a3eb14", "comment": "Malware payload (Formbook)", "value": "a6f8adbdfe97648485e053460130a97d3fe537d6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521639, "uuid": "df32bc2d-0eb6-46d3-b4a6-074b016ae9c7", "comment": "Malware payload (Formbook)", "value": "7be2db709b90a977ff1626566ed2dbf9c755032d94789f4933256d036b36e48273a261b745d1d974caa43241f29a39f3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521639, "uuid": "8574c0df-777c-4dbb-b0b8-b6c5cbcc32d5", "value": "T12FA423C6B4960AA93D0587CC06F54C8F315659278D82A931DDEDEEBE30A3C4DA47E5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521639, "uuid": "9cbc1651-d62e-49f2-bf34-f3623ab6be81", "value": "12288:MANIZ/5zDqK+huPh0Lw+sexCWnyLBg4vpVHnT:2+Mh0cmHnyLBxnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521639, "uuid": "e108f09a-2cda-4c9f-9aaa-d0d2a5068152", "value": 466054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521639, "uuid": "e87efc54-2c49-442c-b63d-fff7c90f3abf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521639, "uuid": "8bebc48e-a13b-4d22-957b-d7b6c730a4f0", "value": "9002928172718.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9967a7-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685511635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511635, "uuid": "53dbccb3-bbde-4beb-89bd-4457ad180cef", "comment": "Malware payload (AveMariaRAT)", "value": "bc2940d8e9ec3bbea641ff71dd52f828", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511635, "uuid": "45d71ae6-32bf-465b-a1bc-b210db82e5d0", "comment": "Malware payload (AveMariaRAT)", "value": "4ecdd34915de61e6541df3c423f4821a82b462a00ce35b82bf7e255a29e6d882", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511635, "uuid": "6d45508e-9749-47d8-a52e-20c66bd130d3", "comment": "Malware payload (AveMariaRAT)", "value": "0449914418dfb0cc21ed8eb7878902e265e289b4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511635, "uuid": "cde2a163-d83c-448f-a4f9-fb37373dc478", "comment": "Malware payload (AveMariaRAT)", "value": "dc24068a2b40eaf7539bf823ecc7c3f1a50f1c27ab523de59f68fe61e46f3833decefc3a69b88ff4ffb95441c08659e3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511635, "uuid": "6714e977-f967-4370-935b-5c67c8703aa1", "value": "T11BE41260666D7F46E87AC7F988307A7043FE686B7072E30A1ED7A0C7B5B5F010641A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511635, "uuid": "fa1d4284-be88-4caa-8f67-33390f89c543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511635, "uuid": "1a4cbe62-efd3-4ffe-874e-9a2773e2d5f2", "value": "12288:8SUmzZBEP85c68kGeZKvpi8dgDEcfR9oxglRhS4GzT8Tzb1MhPM:R9BEP8OS+pndCJIyuGb1CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511635, "uuid": "861b0092-32bd-4f5a-b0d0-5911a369562d", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511635, "uuid": "be49072c-c874-4230-823d-0f0dcf4f6c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511635, "uuid": "c44840ea-e14e-4fe1-bc1d-6fc28f8bece5", "value": "bc2940d8e9ec3bbea641ff71dd52f828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c8f82b-ffad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685535404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535404, "uuid": "32b235b0-99f8-4112-bbc3-79b0464bd8b1", "comment": "Malware payload (Quakbot)", "value": "68ea9e0afed17600ec1030ca7f28a916", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535404, "uuid": "bd3d91d7-fbed-4770-ba4f-baa85a3a68bd", "comment": "Malware payload (Quakbot)", "value": "4f08565bb4bd62b4ca4e09bba060b0d18927f7c684ab4f0f757cb6cfef1aa860", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535404, "uuid": "41689fb4-a72b-4942-b3c8-e099b317df9c", "comment": "Malware payload (Quakbot)", "value": "88c1dae12a91ce684007f85137db86d86071a3c0", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535404, "uuid": "4d21ca51-1e17-48dd-977c-1274c9852172", "comment": "Malware payload (Quakbot)", "value": "ac92c1bcca9429cd353d32299c521f299701c452ff9c62d0b381546037ff8aca9595486af566eedb983a1f030b0deb78", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535404, "uuid": "c48db921-36b8-4d71-97cc-bffa80406f80", "value": "T19CA101BB9F498EBED259FA142094AD0FD9C9C235221F6D83F30744D578EE85C42AB9C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535404, "uuid": "2c67cadc-feb8-445e-a899-0e1225955c82", "value": "96:rExLYMzMYFWdCYFXlYFXaYFXoUYFX2sYFXTQTIFm3k07/yxJ:GU9ZqZ1ZYZMZTQiqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685535404, "uuid": "e73e8404-a774-40e0-a862-b148f98b22b9", "value": 4827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685535404, "uuid": "293650ab-b5e6-4b4a-b76f-ebbb88ddaaeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535404, "uuid": "527740a4-4e34-426f-80e9-0687f56e604e", "value": "doc_D704_May_31.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b7121c-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533937, "uuid": "14d9a48f-16d6-49c3-8e4b-bb7b5742c04c", "comment": "Malware payload (Mirai)", "value": "21da452a0ffe2df75d7c360fae7534e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533937, "uuid": "de43d9e3-29a4-4e6a-895e-0fceea14aad7", "comment": "Malware payload (Mirai)", "value": "506fb7a9d8990e58da1944e741c898a132da69225bdf58a9320818d96a0e41d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533937, "uuid": "e8547fb0-f311-4be2-918f-fa2a90413989", "comment": "Malware payload (Mirai)", "value": "1c66e56e4d82d19b00271f20a881144e249e1701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533937, "uuid": "8646c406-1142-4207-9bd5-9d53c2a3990a", "comment": "Malware payload (Mirai)", "value": "0ab3728f9f69cd1969c358161c3d57b2f8edaae112f7138d450c11a35b80378e126153f40af16cb4640252a9592cbb08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533937, "uuid": "5a1a6701-07ef-4ee9-ab7b-68b36627dac2", "value": "T180632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533937, "uuid": "4da6b4b6-576f-4625-bf59-93777cb3d957", "value": "1536:iNSlxAmiik110lOO//kWIj6sisI3AA8PNRu5AvbWd:iN/CbkZusisI3/+VbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533937, "uuid": "f327f49a-277d-4ef1-9cee-b20c204391b9", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533937, "uuid": "3288c67e-ca54-42d2-bf43-c5e2e2c3b010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533937, "uuid": "7a3abd91-1b4f-413a-93b0-83fffe28cf0c", "value": "21da452a0ffe2df75d7c360fae7534e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e4785a-ffba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685541128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685541128, "uuid": "b3d8690f-0354-4e1d-b1c3-926cbd85f05e", "comment": "Malware payload", "value": "bd802edd056c757b17b70b4d07d4b8b7", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685541128, "uuid": "a5946227-af48-4f94-8006-786b31752398", "comment": "Malware payload", "value": "50e056af7d47794090460ad3ee704ea3e1170e3da17ff98bf6913a584f6affe7", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685541128, "uuid": "136da8c3-a2db-42f1-999e-a2e597aec6a3", "comment": "Malware payload", "value": "b7a3c2189e6293376c9f92bf31c20f1a3f0fc32a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685541128, "uuid": "96d426e4-84eb-48f6-8070-4c7ea785b2bb", "comment": "Malware payload", "value": "f3fb1c0b1d628340100ea9c417ecb8d2eb8d551c9cbf6977c12f13c189366ec196b67e61e5b2d667df1f9f18d25a222a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685541128, "uuid": "3d71d2bb-1a7b-41bf-a634-721742de1387", "value": "T19411D0B76B5E5012C9B1C7521D47925ECF6081A2A4C40A10F4FD4E71EE3A117575FBCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685541128, "uuid": "099f7493-7fde-48ae-9caf-36c79779a763", "value": "24:KOVtyCizxsFTxnswvpdPNuR71q2z8JAh/:KOVtyCi9sFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685541128, "uuid": "accb6e08-1b67-4783-a259-6e1c08b15456", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685541128, "uuid": "c9e0e116-a5cd-4a1f-a557-6f8ab3c2da52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685541128, "uuid": "23896c75-d4d9-4ab2-a845-03fc4c523ceb", "value": "aLXMd4pT.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3efb6bf-ff86-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685519033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519033, "uuid": "cc6de4c1-10b0-45b9-8d71-f1554308cf88", "comment": "Malware payload", "value": "842583dd02e1dac3802b9d7753c1841c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519033, "uuid": "4c3017df-13e8-491a-b3c5-b033c98c1765", "comment": "Malware payload", "value": "51508ea78d651e6140cdb6d79436e331dab674e8ed754a15ca0bdd950f0843bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519033, "uuid": "25fd0e58-4490-4aa8-8627-7a1156c43bdc", "comment": "Malware payload", "value": "97b6669121de1e1e7b4a65b9a52d6a5dabff8f33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519033, "uuid": "f5be8e73-8f07-46a0-b833-f16d81b0f591", "comment": "Malware payload", "value": "40c2be3c1c2dddd8d6a51f945478b57c42f6912cb4befed32b0c3e0b2535f5a3ec2a9bc47ceba1149bba5e120a816e57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519033, "uuid": "7cf48f02-6334-4e2a-896c-e39308af1a4e", "value": "T1B9D43AC6E4401AF1FD74827651171C601A5B3DBF9488A89D70CCB5932AB38AB2D3BD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519033, "uuid": "2cc555eb-ea6e-4312-b4a5-e91e20f7a976", "value": "93d7bb032e5b4ede025420a3defb9706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519033, "uuid": "dce30ca4-6358-4e4b-9e3d-2bd0f2870703", "value": "6144:cVls9uaf5DSTi+rkZ5Ntf3HH94Z/FfwUMC2+e/z03fyKpTXbFweeJqd2pYJ4y00X:4+lD/vHH94lcsfhRr3hJaBpiakxpnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519033, "uuid": "965806d5-a577-4f38-a3f7-8352302a3e09", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519033, "uuid": "1ba42b3e-6e9d-465e-ad4c-57c2cd79892a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519033, "uuid": "67b9ff6b-6bcc-4f7e-acff-ffa942d3a67b", "value": "ToW2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0975fdb-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521604, "uuid": "0f26f839-791e-49fd-9cac-425dc0c40ff5", "comment": "Malware payload (GCleaner)", "value": "e8d3a4036d3e22fcb656ba42838d84c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521604, "uuid": "3590dcab-afb1-49ce-9889-df9a461ffc8c", "comment": "Malware payload (GCleaner)", "value": "522e2895a5a7ab266064ba21817778bcfbb30274ef65adf990f70122da4b217f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521604, "uuid": "c81e7d47-8bc0-4e42-a13d-852dc75b041a", "comment": "Malware payload (GCleaner)", "value": "63a6c199130a22d555c602b1d85c0c8e49e2fb82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521604, "uuid": "e547f66f-7a62-4da9-8a07-143e03879fcb", "comment": "Malware payload (GCleaner)", "value": "f68b289c94d86750bc068ed0d8f435915088954a5ab7543ad4d16953d2e8fef1a32b918d778101fb775a63d0be12c5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521604, "uuid": "2d6720dd-e5cc-49a3-97dc-bb755ab88421", "value": "T13E54E02239E08432FAFAA5304C70DB585BBFF9266931894F77B8226E5F316D14635383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521604, "uuid": "d5a75516-1d4f-4886-b6bd-ed83772d0277", "value": "27113c217d53f26eb8f070c56bd3d296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521604, "uuid": "9e2f7074-6ce3-4e90-beb0-7176278b7405", "value": "3072:DNCM9m4UdtgkF5YPN+7LcXKo03LWmzUtuXKoNhDsvBdu27MOyTEnIMujAYnj5wWa:99mGEYPGcXx03iUjVNhoJU9MujeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521604, "uuid": "b0c729c9-2d67-4776-9198-5703e47cf357", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521604, "uuid": "71af5b70-9a74-4587-a830-9cdb2da8dd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521604, "uuid": "9e920276-a2f5-416b-b4de-822d6f61d560", "value": "e8d3a4036d3e22fcb656ba42838d84c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a9ef2a-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685521645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521645, "uuid": "41c12a43-28ec-4e06-9c18-a3fc94d3fca4", "comment": "Malware payload (SnakeKeylogger)", "value": "0ac7d68551120386b4c8fa1c0ed14e92", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521645, "uuid": "5f6220e1-b8f8-4ac0-86c5-d59248a24198", "comment": "Malware payload (SnakeKeylogger)", "value": "5439da4a2c63ed9a513f6fcbf94067fdbe57395461b7fc05867d67c834b53c11", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521645, "uuid": "f545f771-5b5b-4414-a6cb-0ad0cec5c8d1", "comment": "Malware payload (SnakeKeylogger)", "value": "958b060eca0aa489887cb2f76a4088bf489f4e02", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521645, "uuid": "3a40abb4-661c-488d-9a48-bccf457492a4", "comment": "Malware payload (SnakeKeylogger)", "value": "67c04f14d00425af8b290aba32fb826cbfa98450a7beab1cd829abbab312541a9e570eded9a2d186fd7873cd9a30114d", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521645, "uuid": "f211e23b-44c8-42b3-9b98-3bee8bbdf2f7", "value": "T1B21533DB7C27848C2CDAD6359005C71CAB4ECE258D60880396716FF153B59DBA89EE2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521645, "uuid": "8c121a64-0ebb-41cc-8a01-63367d010e61", "value": "24576:/hGTIdIMXtbcupg+qqs6GdSyGeNHnpXWTW6/:/hi8FpFGdSfwnxWTW6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521645, "uuid": "b5fca463-4ab4-4faa-9eaf-0d9ed8cead63", "value": 916576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521645, "uuid": "cb2e38d8-16c9-4737-887a-2aef2332583c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521645, "uuid": "b7c42355-afd9-4dac-823f-0eb64a325d1f", "value": "Factura.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fd1ad6-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685498602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498602, "uuid": "7dec35f1-723f-4fa2-94df-2a6defe69122", "comment": "Malware payload (ArkeiStealer)", "value": "83c47ef5276c93ec4a265eab431052ee", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498602, "uuid": "8b001f1e-217d-48b8-9ef6-886cea5b71a9", "comment": "Malware payload (ArkeiStealer)", "value": "54c3132ced005758148cd36e63a125bfb4deac0378d3ed9b692bb0b61233785d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498602, "uuid": "ec697c10-2ec0-4a44-bdf6-ef559223696c", "comment": "Malware payload (ArkeiStealer)", "value": "540f8afd315758810f62c415a9c9a86658b0a912", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498602, "uuid": "8793b864-da81-40e0-830b-5b893e18d8b1", "comment": "Malware payload (ArkeiStealer)", "value": "26fa153b76a4ee50cd30f0c6d9fa35718188e9e21cf29892bc5eee345ca591e8ae51f53c124e03e1d1727373437a6239", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498602, "uuid": "81bdb278-a3e5-4665-8f06-b15ecab662a6", "value": "T13464D00352E0FC5CE7674B31BE2ED6E87A1EF5D14E69675A32177A2F08701A2C2A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498602, "uuid": "1b83280c-a311-432c-831f-30f11e4db249", "value": "b16c3db38ebd1039deaa7b416b1dd4fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498602, "uuid": "a309a434-26b5-4eea-9320-2b462dc77ef4", "value": "6144:5ZK2IHjLcW91gEESj+KgL7YlPXPGWGb65:yjLcYgEESj+KgXYlP/Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498602, "uuid": "dac45471-f42e-4d54-9529-d2a09e2c1698", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498602, "uuid": "e8e4cf8a-a0d9-4f3a-ba8a-e56c0dc97477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498602, "uuid": "61095a9c-c33f-4b15-895d-44c9280d5fc7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5347c354-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519649, "uuid": "15d4901d-e142-4bf7-966f-4e88fc0ab7ff", "comment": "Malware payload (SnakeKeylogger)", "value": "c8ea8b740b0d30380116fbe1108f4e74", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519649, "uuid": "742b3f64-6468-49ae-a6a3-a1d5e8a7ebc3", "comment": "Malware payload (SnakeKeylogger)", "value": "564b04babf3a9e21e6b6b3f5a1c7ea624e5036052382afc1ba15e206b6308f6a", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519649, "uuid": "9f7b2bcb-dba7-4f27-868e-66abd114254e", "comment": "Malware payload (SnakeKeylogger)", "value": "2dc4367341baa1b786cf607a9bdcecf50bae7ac2", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519649, "uuid": "4a82453a-0af5-4dec-9fdf-9bea077cb2b5", "comment": "Malware payload (SnakeKeylogger)", "value": "6b44cb0d47523f2f8c216500f22d0f3aa41bfe6a537be19730ad9eaf54d6041760ac271507a995750aa088902c19426c", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519649, "uuid": "8ee4b86a-4049-4629-ae53-a92c2ef0231e", "value": "T1E1E41246EB3F2A0BD166BDBD0B308074E5FDC595903ED5ABEA97582FCC099346DD0222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519649, "uuid": "0b40c864-7633-4c57-889b-684667df4f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519649, "uuid": "9fa59788-fbd4-46f4-8452-fdc9bbe569db", "value": "12288:dxAMTihh6xhZ6Or/M3MyKU4jEbDRLGlhLYfZ3JbSd9g64JFD:MMUgh8y3yKnEbDmhwrSd9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519649, "uuid": "0488e880-c25a-4588-8836-c753c4163e14", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519649, "uuid": "0df023f6-8df5-4ec3-a34e-7487d516b90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519649, "uuid": "a4a6be5c-8f93-429f-9402-912491d37a99", "value": "Clientes BBVA Comprovativo de Transfer\u00eancia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9b38e7-ffbe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685542859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542859, "uuid": "6e3904a4-8f2b-4c6c-aec6-300f46d45095", "comment": "Malware payload (Stop)", "value": "12ea14dfecc1cce10ce3dd045a56abdf", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542859, "uuid": "208c6a5d-14c8-421c-baa3-1c711413e1f7", "comment": "Malware payload (Stop)", "value": "56f05fbef05fca4cb517f793263ac86f2dd3c3c02184e8f2f1dd43f8525a2aef", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542859, "uuid": "af0db6f8-d8a7-46ed-88c7-df942518c8f3", "comment": "Malware payload (Stop)", "value": "217f16497ec60ae3d54ef2bdb892557b1a3cf984", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685542859, "uuid": "a1ac8127-66e1-4465-b691-f1ef05344c26", "comment": "Malware payload (Stop)", "value": "bebfd127fa7b70e355402a5480b72d251666338cdc58b76158d13b6e18e3dc9a103e279b4e6f089eca5fdd4a99337648", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542859, "uuid": "84ea92cd-b53d-41e7-a486-56f798a39ffc", "value": "T11705021273E198B0E9665A725E2AC6F46A2FF8714F5666EF235C1D3F0E305E0CA72350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542859, "uuid": "4bcae556-c49e-4e9b-b7cc-d331b8128531", "value": "ecf9944f3c0ca13331da7daf765c4c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542859, "uuid": "31fa2987-6ade-43d5-a5fc-3546aa837edc", "value": "12288:PJ5rJZe07c+t/dFlNPcNumUu28q7Tf7px/YfIznJujYdW:PJc07jPBP+uvT8STDDgGujQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685542859, "uuid": "87a53078-4871-4990-a67d-83f652402e01", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685542859, "uuid": "9d7249b2-734a-435a-b3a2-f37b98311e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685542859, "uuid": "8636a71f-4bcd-47d5-a38f-59f7a08b3242", "value": "NotJaffaCakes188Ransomeware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379cc33f-ffb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1685538930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538930, "uuid": "e09a6bc3-81b7-4c0f-b90b-8b67c3b91aa9", "comment": "Malware payload (QuasarRAT)", "value": "327bb4dfec8cfc425678b2a9afc6d592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538930, "uuid": "bd3c116a-e3ad-4c87-809f-39f4d983de4d", "comment": "Malware payload (QuasarRAT)", "value": "575a2f0d48c457c8dcc8d5ef5a964adbb50b48c7dda5d35592e1db58f8401a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538930, "uuid": "767b6582-58da-4456-a753-31834b9f7aaf", "comment": "Malware payload (QuasarRAT)", "value": "da7e52a4666e8fb50f04453e2966954f2aeb9174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538930, "uuid": "c63efd16-ba89-4b08-9211-4d6c8498a059", "comment": "Malware payload (QuasarRAT)", "value": "5183544a6ac05eada776ae4ea099b2167e571c6affcb78621237f28b199b81817f937d9fe9890dfe337b0665d2d15021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538930, "uuid": "fce1f8c7-d06b-4c53-b38e-608e45492465", "value": "T15A747D1373E8ED7BD1BD273AE43206194BB0D547B616E38B5B6899B92C133868D413B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538930, "uuid": "d358f52d-4bd8-4262-a343-8e1cef4eca06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538930, "uuid": "0399fb45-620a-413d-913f-b6cbf7b90121", "value": "6144:37qQ4i1FFiEK5zLuDl+BTlbRjlV4dFsiz7fKUB+q:rpliRySvIsi/fKUcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685538930, "uuid": "4379deae-67f9-4309-b9a9-b003db6aa034", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685538930, "uuid": "cc9bc690-a68c-435b-8faa-627b564dada2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538930, "uuid": "ac3b0c72-addd-4962-972f-d6e6a1d18579", "value": "bNcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7d1a90-ff7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685513845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513845, "uuid": "55318c95-74f8-4cc3-a6e5-d9d7d4c244e2", "comment": "Malware payload (Formbook)", "value": "313524e6258ef1bdb3a175c90a0b2455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513845, "uuid": "33dc2d40-b76f-4621-a06a-85448857270b", "comment": "Malware payload (Formbook)", "value": "57b9e598a2344a9f11ea57e9def885d0548034bbfd7020c697770bc68d12660d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513845, "uuid": "4f4a76bd-2de7-4d37-b331-857984ab4c78", "comment": "Malware payload (Formbook)", "value": "cea80ba15c62c703665c556316cbbc2a0a9a8bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513845, "uuid": "75dc1d18-e9f5-42f9-906a-a2aa5cbf699b", "comment": "Malware payload (Formbook)", "value": "fb8895d82be3ae3759bb0612341c66bb730275644682dafa8e7ea0dd4f5fdbf8188d168b25c2784be50a97b26ce9d698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513845, "uuid": "5cfcd093-190a-4cd8-955e-aae211e2f9d5", "value": "T1A66412C86FB0C673C4904A310676DA997EB16D266924624B1B40BB6DFCF22D1CE0F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513845, "uuid": "3c70ebfd-67d7-4f4e-8406-ba27b042385b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513845, "uuid": "9df22827-c9e4-49e4-8ade-341b293bd297", "value": "6144:AYa6F09XGjbm9UAuN3p+SBSV8T/kFQW81/OMdb27wAn7xRo7G5l:AYn09b9UAuN3ESBOEaY1GME8An7PkG5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513845, "uuid": "c9ad00d6-f5eb-4b39-b6d1-82b490e8c9c6", "value": 310078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513845, "uuid": "88b9cc4a-0add-49b0-8ff8-6b3398f9c23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513845, "uuid": "b32b38a1-5057-46ed-810b-3576ec427904", "value": "indent- 40120517.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bc054b-ff7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685514660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514660, "uuid": "e06962c6-3895-48d7-9933-1f73e2c5f665", "comment": "Malware payload (TeamBot)", "value": "e6261e3b7752ef0120b1f2cc206f152e", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514660, "uuid": "4d89110e-9b87-42fa-a7e8-805cb38e71f5", "comment": "Malware payload (TeamBot)", "value": "5842be42ecc0c04cee42051aad42fad0e5b339e7295da2ee6a1bf84ebd48332b", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514660, "uuid": "98225b22-5c7f-496f-9815-887f5ec924a0", "comment": "Malware payload (TeamBot)", "value": "16d0a720503eaad3201917856402acc9361676f4", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514660, "uuid": "3c640f64-9741-48d1-89f2-b1042643d2b7", "comment": "Malware payload (TeamBot)", "value": "55049f5c84a159884ef06fdaf4ca6fd3578374e0ded80b8d5772d2d079b8ae626565b9440bb05da402da980cc8956066", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514660, "uuid": "74defa3a-75b1-4570-9937-1ef096e88cc0", "value": "T1D9050212B3D19871E5264670CE3AC6F46A2BF8304F656BE7331C6A2F0DB81D1CA72356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514660, "uuid": "12106a72-81aa-4374-904f-5629936bce7b", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514660, "uuid": "6df66102-96f6-490b-873a-db4ca43fd713", "value": "12288:TBVSceNH+YsiItcvdVSfvfanZL7wkhNqdYz3tPo9zV1cMtiy:TBMfwiItyVKSnF7hodYy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685514660, "uuid": "c4e2783a-fad9-4517-bceb-631d46550a89", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685514660, "uuid": "7b591f7c-e78d-4912-bff7-614dfecd8a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514660, "uuid": "850b93d1-5163-4925-9c94-6939e0a32cd3", "value": "01575799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb7d960-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520952, "uuid": "99bf95e7-9e1b-4c98-abba-8b2fe14bb4e3", "comment": "Malware payload (Loki)", "value": "589b85f6134d42e0974286fcce22dc36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520952, "uuid": "f1093866-a3d5-42ed-a88c-cec2b893fa1b", "comment": "Malware payload (Loki)", "value": "585c45e49cf368bfa01201ff86fc2f8c350251d6d57bb2108bb9467122da19ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520952, "uuid": "ba3c7cbe-49e6-4ce6-806a-eb6b528dd933", "comment": "Malware payload (Loki)", "value": "167d4a264adec714e2251a9d2c277cf2b9e62b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520952, "uuid": "7f0d0566-3c26-4f31-aafa-ffc929cc9fdb", "comment": "Malware payload (Loki)", "value": "9075d1b471c7f22d7834aea7f0cdfc39075c5ca3737f3df3ed9f5106cc253a8b7c94674a2ecb57afdac2610309e6f6d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520952, "uuid": "58760c5e-6a8e-40bb-91fd-d65ab9c48bd0", "value": "T156E4F040B5BB0B2BC5BA53F5821072341BBE5A9CB8B2E71B4EDBF4D75561F014A81B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520952, "uuid": "137aba7e-ed2b-41e3-9096-988619f97407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520952, "uuid": "f7f60210-8496-4d3f-916f-fc772eb45ebd", "value": "12288:mM2B0xTGlxNqvNu2hZ+nUEsn9Cg3rtgG2CMrawPbCJqYFDPNgVNt09BUFdy3ZL6:mMLaVUH999CKtgG2RawPbCpDPm+9BUFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520952, "uuid": "4875f7c8-ab14-45ac-a5f7-69e17d4b1e61", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520952, "uuid": "a00ffd37-e9f8-4b40-b0e3-da4661fc7c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520952, "uuid": "20b4ec34-9e4d-409d-9cf4-28f4dafb2e1e", "value": "589b85f6134d42e0974286fcce22dc36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab03fd50-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685531822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531822, "uuid": "f01fb37e-b803-4244-8b8b-acc72e242817", "comment": "Malware payload (Glupteba)", "value": "dafe4c18cff58d6faf5dbcca253010cb", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531822, "uuid": "5d50df9d-012e-439f-9dc6-4f4c9f29bab8", "comment": "Malware payload (Glupteba)", "value": "59a142c587acfabfd84a5b123438414e6d1ba45d47fe21fddbbef9708f6c58b7", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531822, "uuid": "010cde9c-c0b4-42ce-b214-817f651c6fd1", "comment": "Malware payload (Glupteba)", "value": "c56a142a22499daf8bd8674d1aa99badc0bd5393", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531822, "uuid": "b17ae314-cd14-4367-beee-992855d92b07", "comment": "Malware payload (Glupteba)", "value": "3ad08316736ef2acf7c2c2555327a40e3ef43c39db3ac79b7afcbdeedb1559991ed9fdfc5ec77b5aec6b44f0fbb86d8c", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531822, "uuid": "933783dd-7326-41c4-80c3-b4c2455d2471", "value": "T16D163362B788B470E52395315E598BBC262BF4B24F056BDB135C671F0BB02D6EF72212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531822, "uuid": "7869d456-4881-4eca-ae70-54dcfae4f43c", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531822, "uuid": "efc26146-c492-48ab-99c1-634833ec2c43", "value": "98304:awIiW5BXwpgzrnL5Qug25GBYbiNS/DclH6lobSi+/hvIfKK:awkBXwpWrnL5Qug2Ziaclalo+TvFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531822, "uuid": "a1d8e83f-8136-4a7a-a1ef-702b3d7a8023", "value": 4367216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531822, "uuid": "a683cbb2-b846-4e5d-aadd-3db7e98debb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531822, "uuid": "b32c42a0-dd73-497e-9a4e-392cec0e11e1", "value": "59a142c587acfabfd84a5b123438414e6d1ba45d47fe21fddbbef9708f6c58b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81635e66-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521015, "uuid": "b084d7d3-19b3-47d1-ab2b-280f1fd71182", "comment": "Malware payload (Stealc)", "value": "53e8492621669e71b559a9387d2cb9d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521015, "uuid": "f74b2668-84d4-4aed-a89d-090c21bdc726", "comment": "Malware payload (Stealc)", "value": "59ef476d22088d1d523706cd72593913c35a0b7f52e6793aaf63619d3867e526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521015, "uuid": "66a03514-ed41-44b2-94de-d261e16d8a37", "comment": "Malware payload (Stealc)", "value": "4d05f01b21958b38664d41f5499f5b6957938eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521015, "uuid": "282584c6-44f8-45dc-b163-54d11cabeb40", "comment": "Malware payload (Stealc)", "value": "ed9ac99d05769072ffe4e7587b09d83da5a8da5b4bfbaebc017362a54973e689dc6a42c98ef4073d141c91e11ca026a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521015, "uuid": "c7dc3e54-094e-49ac-ab91-073e0e82cd0f", "value": "T13F642A1363A17C60F5264B729E2EC6F8771EF5604F997BA723149A2F09B12B2D172334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521015, "uuid": "e46eadd2-5659-4a72-b640-a694b9e144b9", "value": "f321b3f3cb07770b37ac8c5c955a19bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521015, "uuid": "c6a4d6d4-f7d1-455a-8150-30502c634327", "value": "6144:5uALyTpz6tKE+ZJb4+32SMVEnic2nMJSHMwW:57c56tKZVT32GFjJwFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521015, "uuid": "e1369bc2-d4f0-4550-9ca8-5b816b4f3a6e", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521015, "uuid": "11c698a3-e404-4b7d-8518-24c6f1d1e82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521015, "uuid": "75d56951-87e2-48a0-935d-c40845a3d011", "value": "53e8492621669e71b559a9387d2cb9d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5afe82-ffaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685534219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534219, "uuid": "f0448b4e-451a-4eac-947b-a82e57bf8107", "comment": "Malware payload", "value": "1131e6dae6363ffb403657bc1c91334d", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534219, "uuid": "b66d4d5e-971c-4ad6-a1a9-aea2b5abf97e", "comment": "Malware payload", "value": "59f866b9db3a1f39a341bc274f2c2feacc2bbfe7eaaf9acab5e594db1c2f4ec3", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534219, "uuid": "15bb2998-8179-474d-a503-1b5b650692aa", "comment": "Malware payload", "value": "7e15fcc93b80f372d6057d35766e18535f749623", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534219, "uuid": "c0081101-d810-41a3-a2e6-607f37eae10c", "comment": "Malware payload", "value": "b51132ba4d2185646b86392695b8f51906d0f5be9201ab93eb0760b362975c490e75ac75c9c09fe7c6cf0364c11c6f9c", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534219, "uuid": "183b02f4-bb51-464a-853c-ab371e3263ee", "value": "T181E302AA17E98C84EDD38371C8607854C4DFB5F289E6947630BD1FBA7BD474886D00AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534219, "uuid": "caa6c916-eb45-4ce5-9109-130261ca2461", "value": "3072:Xrjbl/jvoE+c0hV5/HdIZyo3RBQ+zaj4kkd9aSP/Lkz47Gc0TS:XxLm1hjmPzk4JaSrBCc0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685534219, "uuid": "5416103b-b619-48f5-8883-64992f4cab9d", "value": 147728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685534219, "uuid": "7dbe8c3f-3485-4cc6-bde0-553037a40066", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534219, "uuid": "ab527c82-8610-46b0-ac5b-de6d490e56b5", "value": "Fattura_01777150.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acd949d-ffc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685545512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545512, "uuid": "60d4aa34-c4d3-4307-a7bd-35bc4df0f5ef", "comment": "Malware payload (Loki)", "value": "f51a56d19e4afa6d1e6f4703d7b1a6d6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545512, "uuid": "cc6b0752-dd54-4117-8c6f-92cf5efaeb76", "comment": "Malware payload (Loki)", "value": "5b0e5103e523f7d75c0e8a9c6590ded69eff29f92d61d9412cea65361bc39d15", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545512, "uuid": "005174b1-3ee2-46d6-8ebd-6539c831ada9", "comment": "Malware payload (Loki)", "value": "7ce06e4faee22c86c5e35aad6914b32c02e8ab9c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545512, "uuid": "4a0929e4-b846-4a24-89e2-d6b4ebb0e69f", "comment": "Malware payload (Loki)", "value": "51b8614b90aa307ba4563c3ff2729a6595bb4e8c68b72a8c9b022d95d29f477897399ad9ae4e72e62facee2cbf5c1da8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685545512, "uuid": "3102735d-f383-4d14-9a4b-f3b9e4a5f05b", "value": "T13A94BF5263ED5008B1B33F04A9FA91258B3BBEDA9C7AC54E058C5A5E0BE3940CD757B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685545512, "uuid": "11b6adb4-f291-4d40-83f1-19de0c53806d", "value": "3072:9HGRwf6YFahNe4VTdRnTT8w4TWxrqsIgJdpe+og0S7wQzS18f8d6bb/g52r:swf6YFQrqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685545512, "uuid": "b7a1ab94-7ac3-4f17-97c1-15d8cbba38d0", "value": 421240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685545512, "uuid": "4d07fdc3-1d12-4036-b80f-98f5dfc8e214", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685545512, "uuid": "6f7dfe21-2443-4bad-a0b2-dab99cced7d9", "value": "docfacturas vencidas y datos bancarios.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6ee3e4-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685521003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521003, "uuid": "d638b8bb-8efc-4de7-a074-b72b64b864f1", "comment": "Malware payload (RemcosRAT)", "value": "11f6c40fee9bc750f99a7e400ea5904e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521003, "uuid": "75d55a21-45fd-4348-8ef9-094e66c95eee", "comment": "Malware payload (RemcosRAT)", "value": "5b1e8d8e1c47866009a79f371befaff9f673cb07656a0eb9509771dffd8f7ea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521003, "uuid": "ef9969c4-684b-4784-8941-060660777629", "comment": "Malware payload (RemcosRAT)", "value": "ee7e55c68d81d42f349ba8ad236a0b4abb730744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521003, "uuid": "b3a41df2-045e-420d-a65e-dc6ef02aa444", "comment": "Malware payload (RemcosRAT)", "value": "f13151fb852765ae257b729825c2a7881b0e29f8a10fe3b3dca118eb9c1948c1da9e14003676a4ac3e01b3e122835769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521003, "uuid": "a42c2d08-7729-4e27-9a6a-1824df9331c2", "value": "T11D25237A6293842BD5CB2B7802D433B959FD4BD8BC73EB2B1E1F65A0D705E1E408064B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521003, "uuid": "c3585937-f73b-4995-8752-9d5562ebca1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521003, "uuid": "a61f71f6-f697-43d8-9aae-dc296a9026ec", "value": "24576:yPLaVUH999wwreAv5ctgYx6UqDMuFp2sETT1Z34fJk:YBH9lrem5o3x6Uas0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521003, "uuid": "b180fca8-cffc-4f57-a4a0-afd1b5e12da9", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521003, "uuid": "d0b14306-57e9-4632-94b5-7e40c13d3bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521003, "uuid": "d9a06e9c-6fa1-441f-bb63-68872c45bad6", "value": "11f6c40fee9bc750f99a7e400ea5904e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5857fd29-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519658, "uuid": "62933e53-8057-4e58-8d5e-b994a71ebc01", "comment": "Malware payload (SnakeKeylogger)", "value": "55527664274374c53ba59af0a60a6de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519658, "uuid": "537cefc0-727e-4fa7-8850-408fdcf67b61", "comment": "Malware payload (SnakeKeylogger)", "value": "5cefb605e30bd3bcfc7eea4859ab2433a28c65ba1c195eea4a36406eff3939c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519658, "uuid": "2bd25e09-3d90-4033-bb6b-2240ebc8309a", "comment": "Malware payload (SnakeKeylogger)", "value": "6111cf531b9b611dd53dca71f9c9297b1d7efe68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519658, "uuid": "945a1902-0ffd-406f-9cc5-527eed2984d7", "comment": "Malware payload (SnakeKeylogger)", "value": "ad2a33777f70657f67612da131290709c90e88f50f86362ee66853736a9c5f4fddb2285b1e4603462a258219a15ff5c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519658, "uuid": "12b8d96a-0aff-422f-8b9f-3e5a91de9a61", "value": "T10F65DFBBC942FDF9DE6A1B709A72CD304D423CAB5A3C609C28CC3D6B33BA15195158B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519658, "uuid": "8aed2353-1995-4263-bda8-b3605bf64b71", "value": "24576:y5kLsttpGFVpslmKJ1e9PrqS4/dM1ispIlfdBYV3GAjRscX0B/R8RW1xiMI9XYn:e1tG9VL49RdBYd0BZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519658, "uuid": "8cd57db1-3f40-469b-abc6-b98968ca2ff0", "value": 1524224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519658, "uuid": "37848de1-aef1-482f-9979-b178be73a0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519658, "uuid": "6c815dce-b710-49aa-ab19-ca32304811dd", "value": "FTT10501909262401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4a3e0e-ff9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1685527883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527883, "uuid": "d42f210d-98d0-4d3e-b54a-a46d248231a0", "comment": "Malware payload (Gh0stRAT)", "value": "08f86429b9cd43cfeb4379418e5350f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527883, "uuid": "33d854a6-3f73-4a01-97cf-dccef6ee1ec6", "comment": "Malware payload (Gh0stRAT)", "value": "5d01444b146fdcd099631627115f1bded3269fec422a6a691604e7e6279817a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527883, "uuid": "809857b1-d4ab-47a4-8252-26fd6a9dedd1", "comment": "Malware payload (Gh0stRAT)", "value": "15965da0b459d890e8ef0186bef97afb9301718e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527883, "uuid": "21bce84f-829b-43cf-87fc-417158ab9368", "comment": "Malware payload (Gh0stRAT)", "value": "6f8fbb8727a32692366e6f1aad2e79d480e46fe5e292bbd883b4149f19a619d435ab6c19288b3f97d4072b0a81f06093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527883, "uuid": "edca9d29-cb59-46b3-a20c-bd6eb0c0eed3", "value": "T12B554B12F6FFE91FD4362031C42D6056F79B129A51B73DCA2A7D9C2894372B4BA52C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527883, "uuid": "ec9ac7f9-41f6-43ce-9385-d87a3f8a4b7d", "value": "eafe9ff3936187ed267e18955d5f6629", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527883, "uuid": "ca806f0b-1e5e-416e-9dd0-2c2f1deeacec", "value": "24576:W7qhfbYtE0c1dxUnh+rgERYIeUUVJH7pb8zI8:W7qhfctY1e+rzRYjUUZIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685527883, "uuid": "76b37949-11d6-4273-8b6a-1aa4617d853f", "value": 1387088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685527883, "uuid": "40671b8b-b18d-4774-a5f9-6765735be171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527883, "uuid": "ffe53999-1c33-44ca-b3c6-7dcdc1f223e2", "value": "08f86429b9cd43cfeb4379418e5350f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effe2902-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533656, "uuid": "e7944953-4891-44b4-81bc-15e166bc42f4", "comment": "Malware payload (SnakeKeylogger)", "value": "2450da56f784319418f97683fcc88329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533656, "uuid": "21021589-7b91-4955-bd9e-39117c476146", "comment": "Malware payload (SnakeKeylogger)", "value": "5e120295dbb1df0ffae200b49202256cc03f6f5414addf758a4c1b11d683774d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533656, "uuid": "8937e27e-03fc-40af-9e66-92093a97ca8c", "comment": "Malware payload (SnakeKeylogger)", "value": "2223337d34bd483ebc61a27f106af8ffe3ead712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533656, "uuid": "b392784c-70b3-4cf1-a177-ad2df2d51f9a", "comment": "Malware payload (SnakeKeylogger)", "value": "6baff24645f890425abfb4de7cc4255f42e0427654f4cc8c50566ad10f61df79954fea3275c0fff03f71e956ac22a1a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533656, "uuid": "13e814b1-da92-455c-841e-68d8f094afd6", "value": "T1DF258FD1F1A4889ADC6B0AF1BD3A643024E7FE5C54A4810C569A7B2B75B3352309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533656, "uuid": "4b30002a-b4c7-4c5c-a5b8-b6308d2508a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533656, "uuid": "17caa6cf-772d-40f8-bef6-880c371a69ca", "value": "24576:QDDDDDeDDDDDZMUgh8yKIwat2TL0SbkJAtrO2is:rMRh8yHM1bhDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533656, "uuid": "9c0d0579-30c6-4552-8348-5f9dbd790ac4", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533656, "uuid": "801ee3fc-a5b7-41ec-b442-1969c9e6cf9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533656, "uuid": "570b081c-3ccd-474d-a5db-4c0bddb52faf", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e349ac-ffac-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685535389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535389, "uuid": "311c18d0-4a42-4fff-b16b-8a49ed0f278e", "comment": "Malware payload", "value": "d3353e637724ccfe1fc7496f0e83efbe", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535389, "uuid": "df548fd0-55b9-4109-bece-bf125500b2bc", "comment": "Malware payload", "value": "5e3a716548b126776f271be38ed43fe8e09a5904242ecc1f0e98c6823330024b", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535389, "uuid": "39a2d4ca-fda7-4be7-8e57-7e4d3a59c95c", "comment": "Malware payload", "value": "52842ff64bf94cc22751fda59d1fa1dd54650321", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535389, "uuid": "aaf5d25a-2cec-4c14-8f4d-95468edc446e", "comment": "Malware payload", "value": "c7992297822e433d59363a36425e97013bb83bb4ffc7be6ad48de34c689e92a33533fb789e1841b32836d14c354a6599", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535389, "uuid": "c66e7d98-8945-482d-b7f1-ac738817e259", "value": "T145C39E9CE95EE88CE5F5A7F3A275F0E8C20EB3238EC918B6655D0FD75003C19DA56182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535389, "uuid": "d297ef40-880a-45d7-a1e2-e51f32d5a080", "value": "3072:pNhF1u5bIaY8P3QYYYYYYYYYYYYYYYYYYYYYYYYYYYYYVqPcO3GZ:Hf1u5bIaYs3QYYYYYYYYYYYYYYYYYYYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685535389, "uuid": "ee760805-7811-461a-ab24-4f40ffa6720f", "value": 129649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685535389, "uuid": "ea8d3c77-9cb4-413d-ac3f-ace6f4f1c42a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535389, "uuid": "07415106-170b-4a90-a0a9-690b4f96dcee", "value": "hd.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80f6754-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685511631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511631, "uuid": "d519a2f6-f032-44d0-822d-a0ca479cbf84", "comment": "Malware payload (njrat)", "value": "692de58080d2a79ddbc8a50858292195", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511631, "uuid": "207c0a59-be80-4fdb-ac50-bdd8a2818ff6", "comment": "Malware payload (njrat)", "value": "5f35a45b7edd40613b11e19ffc3c895d5c874294102cf93e9f43c8b83a80ce9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511631, "uuid": "fc4897e1-78ca-4f23-ba71-9dc1460443ee", "comment": "Malware payload (njrat)", "value": "07739420dec6bf19b430dd81befa39b88814c360", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511631, "uuid": "4e3bb732-fab8-4876-9ec3-6bb257bf9db2", "comment": "Malware payload (njrat)", "value": "653349d67c1eb3e19e751f3a7597f7315ccf9a5256f4b4be0e784025d5f5cd1b8264675913ffd046133ac3480df1144f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511631, "uuid": "96ce95f6-c67d-48db-8965-6a4ca40761a7", "value": "T13C04B30267EB834CF1F26A48967B0572063BBA55A93EC35D019D614D5BF390884BBFE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511631, "uuid": "89cc9960-5e9e-4a22-ac6d-81eada4ecc62", "value": "3072:zbT1AJM/EaZ8ok36/EI4+ZQSU2bokXPXliq3kJIAsKLvbT1AJM/EaZ8ok36/EI4N:zbZ0M/EaZ8ok36RftbokXAbZ0M/EaZ8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511631, "uuid": "8807d488-a7af-4e9c-a8a0-8cf203de8183", "value": 174056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511631, "uuid": "10547858-9056-4d45-ad75-0efb63b44f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511631, "uuid": "00062fc3-233a-45b1-a19d-5017978d500e", "value": "Solicitud de cobro juridco.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f22908-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685528267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528267, "uuid": "8c6b0f80-684a-41ef-828e-3d650bb9d827", "comment": "Malware payload (RedLineStealer)", "value": "284ec034bbfd5b9ba3d076f279cf6634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528267, "uuid": "6c7f6622-806c-4c67-a1a7-d221cc9198f9", "comment": "Malware payload (RedLineStealer)", "value": "5fbaf64507e41ce20d5daabedcd4872e44a0ddd4b1dd51a24e723e4ba63be2ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528267, "uuid": "4a85eb03-5ad3-4109-95aa-c3940900af40", "comment": "Malware payload (RedLineStealer)", "value": "cb8a1ca446ef5c7ae292e5c85e389a60dc871b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528267, "uuid": "5708131c-55a4-43b4-b4a3-b6242f15f1fd", "comment": "Malware payload (RedLineStealer)", "value": "9e811865de1b123ec9ff3dfabe766efb1b1955b1c91e3af49aa89737e9b28779ae8ff31c28f4f3de6bdcc8a16afdbf57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528267, "uuid": "235681a8-c55b-4857-bb23-48c0a1baa615", "value": "T1DFF41243A7DC5071EC712B7469F71383093ABCA38574871F3786798E1CB2A91E83676A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528267, "uuid": "0015854d-e76e-42b1-b16e-b135a5e0793d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528267, "uuid": "9821f239-3fe0-4f12-a1e5-a2b5e5733827", "value": "12288:5MrQy90Y56OfIEkDM28UYLz+qVX9Ml1oQ+RW0A9FPoovOhRWN2mP77af3AInu2:9yB6OTM8Ul6MlaLW0kP2zWN2a7FSu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528267, "uuid": "4af12c9e-8695-49dd-8aa4-c8a547d0c93b", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528267, "uuid": "49096b9d-6307-4922-8262-eb02fae1dca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528267, "uuid": "836be0bc-37bb-497a-8d5e-7c80e90f37d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1632882-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685531833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531833, "uuid": "39f0a99a-cb9e-4ace-95f2-a9d2fb46bcda", "comment": "Malware payload (Smoke Loader)", "value": "af24520768216580f887b29c1a7c900a", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531833, "uuid": "96f58610-b8b0-4337-a679-bd781c7af22a", "comment": "Malware payload (Smoke Loader)", "value": "61bb445b5986840c291ec769d672ee12eb458c754166a8e8ad3007a188ed4062", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531833, "uuid": "8a76283a-24a9-4171-8d43-6ae7f52335f2", "comment": "Malware payload (Smoke Loader)", "value": "280f2413543e86ddcf0aff96cc6e1a9050b0422a", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531833, "uuid": "42a9d392-638e-4294-82b6-d449bac5d7ec", "comment": "Malware payload (Smoke Loader)", "value": "69b4bd66c356ef2f7649f41dac61c4cc92f91a93674e2cce758fb449c168e725d0166676f046d4e56f08b65202113c10", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531833, "uuid": "33283a3a-8b17-4248-8e8e-d204bb580c6f", "value": "T1F7549D1273D5A871E6674A718E2AC3B86A2FF4714F156BEB335C1A2F0E712E1C672305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531833, "uuid": "2a9d4051-7a09-41ab-bb8b-13720f245e6e", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531833, "uuid": "c2053c15-1a82-4e4c-b323-3e64fdebd7ca", "value": "3072:qeoCgY7B5I/YaCqiuQce0DmUGuN8ciqIvzbaXbjrDvQg7g4dMFToI5j:lFJQ/YHUlGuWci9zADvRUDTo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531833, "uuid": "380261f8-e52b-4cee-9743-87ce9bf045e3", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531833, "uuid": "4057c107-037d-4373-a42d-75f9a6afb7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531833, "uuid": "5c209fbc-79d6-421e-b7ea-a238d5d761fa", "value": "61bb445b5986840c291ec769d672ee12eb458c754166a8e8ad3007a188ed4062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74050eb7-ff97-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685526146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526146, "uuid": "d42f3f6f-c3bd-4fb8-b403-9fb8282e2d05", "comment": "Malware payload (Gozi)", "value": "6bbf8487b26d03fb08537b36507e1b11", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526146, "uuid": "e197e5d6-40a9-4474-bc7a-4e87d4f79aab", "comment": "Malware payload (Gozi)", "value": "625325b33d56cfee25e82886176b1d85e6161c1b7645347b6a8fc5b7cc7e18e9", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526146, "uuid": "4c77973d-3fc0-4d37-9a59-bd35aa793010", "comment": "Malware payload (Gozi)", "value": "56b6cfec286434c56ae5a9bed423ca9441f0d9bd", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526146, "uuid": "bed75621-2fb5-427a-a28e-328413cdced6", "comment": "Malware payload (Gozi)", "value": "ff4575b1ad48480882e041a79ba17f3657907b51691ea681ec40d3836143cb0e5a4b35c07ba5edee12a1089a67ebf5d4", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526146, "uuid": "175cb802-02e1-41db-a27d-1dbe6e4187c5", "value": "T100029E47FAE76C89C546D4B1ECC482EF0DA74D87906BC1C66968562193126F49F231F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526146, "uuid": "0ccf9024-3b5d-43ea-bd8f-f8e9a071f9c7", "value": "192:5THSog7m3d9o1eTdZevhQhxwWKWGhY1eSYZrC5UtzD9inAyoiv2pBkUCq:t5g7U9xxwWPw5WGGiVC5Uvin/EyUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685526146, "uuid": "47d15ad5-e67c-47af-b1dc-f3232d5191ec", "value": 8829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685526146, "uuid": "98db345c-f1b9-4eaf-a007-0489c35d815e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526146, "uuid": "40cc73e0-d5be-4f96-8b14-17f4bb520528", "value": "Fattura_31_05_23.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f6d6ea-ff79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685513421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513421, "uuid": "d1fdcc4e-36d5-4cbc-98a2-b016e8265fcc", "comment": "Malware payload (Loki)", "value": "6a0226121465d952589d6e5d2d2ecc4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513421, "uuid": "c66d0e40-4154-44f6-a401-b42dca3e2f42", "comment": "Malware payload (Loki)", "value": "63f608c4ceff4910f778d487fd45f6d906c830c1757d7f637bf531a44d178404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513421, "uuid": "b0b3cd1e-140c-4aee-b68c-1d149dd80f7c", "comment": "Malware payload (Loki)", "value": "db2b1470a9b2ec48b171053acc3833084397a6e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513421, "uuid": "90216cae-08e9-4d05-9bbe-9cc047138007", "comment": "Malware payload (Loki)", "value": "fc9c5c10b8589ab97777e04f8a6f773911d521cd679e903685177ac950872034183701ea94ef44081490d11d1a965c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513421, "uuid": "6940ee60-037e-41f9-99af-e6c6d37701aa", "value": "T1EA033A85F7419861FC630E3030678E400E75FF127992A25B768E721B5FB33C279B65AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513421, "uuid": "244de73b-7389-43bc-8aa0-f6469fb91850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513421, "uuid": "130282fc-564a-4f32-89f9-66c5aba78a1b", "value": "768:S45uJ3AVHxZIE6ne60FqDbrkduPpt5RgppshD9:S45uJQ9I0FqDbQuBt5O89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513421, "uuid": "849a47c6-0c5b-42de-bebf-5727d03a6b36", "value": 40160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513421, "uuid": "8328a74a-224f-4651-b3e4-3f218b6d00d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513421, "uuid": "d6e2fc16-637a-45da-8fa8-aad02aea7358", "value": "6a0226121465d952589d6e5d2d2ecc4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff3f1f8-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522301, "uuid": "568ad4f6-a0bf-44a7-b218-625dcc30217e", "comment": "Malware payload (Gafgyt)", "value": "d20383932e3318414f45df75199b907f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522301, "uuid": "fe9f3f9e-d26c-4b2e-9145-4321a0285493", "comment": "Malware payload (Gafgyt)", "value": "65c3c126d7a6ad3a6ae8d9450b4d122630d8ac76bbb847a13e6e7525af0b63cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522301, "uuid": "38adb182-013c-4556-9064-593f851ba6df", "comment": "Malware payload (Gafgyt)", "value": "a5a1abc098f19c47e15c5a3269a883b1e7b4a7ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522301, "uuid": "a58ce528-d7e7-48b1-8680-37208d787abb", "comment": "Malware payload (Gafgyt)", "value": "9201e0442fb4e8efed542e895a43bcb89bf5ac36e63702592d102441a1b272b6dc428cbfd50e3a851c0f970911341760", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522301, "uuid": "a32407ce-4a7f-4121-a64a-38d2b7153181", "value": "T198E3962E3E21ABBEE16886310BF76F70C39529D636A19346E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522301, "uuid": "3cb27974-4bc5-4069-8502-26d58dd6e627", "value": "1536:mVNs7K397V+nT57Abf6l6T6B6v6N6/6AePe1ebeZe5/s18c2rKA49xXAQTI/e0hv:vMQhWTXAQT4NmFj/ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522301, "uuid": "07168846-f4c7-4de2-b349-d3e2d7331bc5", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522301, "uuid": "990536ee-e09a-432b-bc32-bb2053d26450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522301, "uuid": "91571038-809e-44cb-8636-811996742326", "value": "d20383932e3318414f45df75199b907f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b758a80-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528199, "uuid": "58783670-b78e-4b5c-9fc6-ef6ebe50aff4", "comment": "Malware payload (Gafgyt)", "value": "7a2cabe7d8f30fd7c6acac895f3aa913", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528199, "uuid": "de9be3c7-fc44-4bb0-8a68-81d0d66e6e05", "comment": "Malware payload (Gafgyt)", "value": "67bc6472c9a07e9c65bf1e13a9b83db162f5a182bffc371b0f79101caf7e7367", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528199, "uuid": "ae04b31b-08ef-4066-a37a-907b52843d78", "comment": "Malware payload (Gafgyt)", "value": "87389101f34e49795855831fd32f282c9b6cd9ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528199, "uuid": "05dcc944-6ab1-48cd-92fe-408a253dd4bb", "comment": "Malware payload (Gafgyt)", "value": "a3e2b62ee25a8bacd1dc1ddeb8468b4d6ee769db337c3ddefa6cb6938de855f17d4efa3a1cc2d40268de112061454f0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528199, "uuid": "a1241428-15ca-4538-b272-15d42e034776", "value": "T137D3A5AF7F280397C48786B0396B73F00FEA9D611391A1C6A15ABE406F721747D267B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528199, "uuid": "2310093d-fc6e-4eb6-a4cd-e965562044ee", "value": "3072:+5YzVdfzfBD4DqOxEA9Hu4UmUWi60c0IZrRgeQs:WYzVdfzpD4DqkEAkOi60c0IZrRgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528199, "uuid": "4c0b305d-e46e-438f-9e46-7294277f9168", "value": 141079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528199, "uuid": "30a113a8-bf30-44d1-b0c2-ee967da0b082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528199, "uuid": "922a4719-3179-4722-bc07-fe675d741348", "value": "7a2cabe7d8f30fd7c6acac895f3aa913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cda8bd-ffd3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685551842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551842, "uuid": "77401cd7-f119-4d0b-be88-6d0e7dedf971", "comment": "Malware payload (AveMariaRAT)", "value": "5d278b330412fc5f0b05a6168e4663f7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551842, "uuid": "75af68f0-bb6d-46e9-b2dc-98232eae2fdb", "comment": "Malware payload (AveMariaRAT)", "value": "6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551842, "uuid": "bcf97043-4a16-4898-a6e8-cfcc42a42698", "comment": "Malware payload (AveMariaRAT)", "value": "afebf776b4cdcfa12dc38d7aab0190820a956057", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551842, "uuid": "f35323db-1cf0-41f2-bb1e-16cfe8f2b2c0", "comment": "Malware payload (AveMariaRAT)", "value": "934c0c7afedae3268f883ac6787dcf516d73d35b62b67224618746e68d7b9ad17877d553359c8ec8670777ba3e932dc4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551842, "uuid": "7724293c-4a1b-4a1f-ab72-d9b2b0069503", "value": "T1E724F150B7E0C027E89345352C7AC6FF6AE1BD128C649257BBD03F1F39329829A1D792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551842, "uuid": "3127ca6e-5053-4503-8262-3cae0352edfe", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551842, "uuid": "1596f9d1-4afa-40ca-82b4-16f012e7e505", "value": "3072:2fY/TU9fE9PEtuFbzrF+aj3dFzFNqdTGi7Gb2QmBAZdWlqLGCZM4fNmBvqNxHFgz:gYa6XzrFrbDqVGd6AZdwINmlq1gqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685551842, "uuid": "a38a4f15-008f-4df3-b551-a206150100fa", "value": 220601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685551842, "uuid": "b9da539c-6a75-4d91-96b0-1a712a3da653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551842, "uuid": "818f5bc6-034c-4215-84e5-38e0b4ee9649", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983bf8d-ffad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685535417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535417, "uuid": "59bfebcc-7d56-4d0c-9966-24e6e78df041", "comment": "Malware payload (Quakbot)", "value": "2c55c2c1b7fbc68e11f48a6a13a34ec1", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535417, "uuid": "3a46356d-0c11-40eb-b31e-a62bc01ab2b9", "comment": "Malware payload (Quakbot)", "value": "6b157281cbb1af882dc0e88eb4832bb892e8c2e1678e0bcf30050d47f015f77f", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535417, "uuid": "fdb309ae-f49d-4a9a-a7a6-6e892be4c591", "comment": "Malware payload (Quakbot)", "value": "725de881de6a04ebbdc7422710daa343af3dfc66", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535417, "uuid": "67f7a7bb-8700-4af8-871d-bf9fd16bd917", "comment": "Malware payload (Quakbot)", "value": "ce0fd7c130eaff5731f1a58906403a994c244b4c4c01b94b712535a2f2dfd4a0a974d96f37a02f79288aab3fe22cb94d", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535417, "uuid": "ded28115-7bd1-4528-a4d4-43f605ad6395", "value": "T1B774A0A1394084B7F79F06328428D76B90FEA74027F981D71F7CDA5A2EA05C1ED315A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535417, "uuid": "5baa112a-8c38-445f-a039-4a4e75af8228", "value": "5f7981b73516d0a40ddc313c181df7bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535417, "uuid": "4b50541a-aa92-47df-bbde-abc85e911504", "value": "6144:ELh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zsjiBsTYrPlUEYD/QzkRWAFctOp6c:mInTDtXF15zsjiyZ/0tSkStJB/ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685535417, "uuid": "90e79bb6-cbc3-49d8-a398-e0993db453fb", "value": 366760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685535417, "uuid": "0bc58d09-f173-4195-9634-3d5e7ba55e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535417, "uuid": "3ca3d64e-113c-4971-921c-ecfa79e090c2", "value": "photographed.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfbe283-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522296, "uuid": "6c71d72d-e1e5-4ee9-b6ec-0f3da284f60b", "comment": "Malware payload (Gafgyt)", "value": "b886e1cca295b374dec8e670c76dd7e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522296, "uuid": "9563897e-0626-4376-8ca9-d27621ca0ed0", "comment": "Malware payload (Gafgyt)", "value": "6c0eca84295f6f020491ac46978633aa6388016fbc302774ececad2f0b34bce1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522296, "uuid": "4ebd2fdd-ac17-4201-9ae0-a2236b6d43c9", "comment": "Malware payload (Gafgyt)", "value": "24b43cd1478c330a68e8a4142cc16fad48e7f0e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522296, "uuid": "78bb26c3-0785-4db0-8fc8-f3ba5fc7921a", "comment": "Malware payload (Gafgyt)", "value": "1b370458aefe7cc02d6f0b9f07a6ecb5db29224ecce11d4a7369ff2070c1e9c6a785ab41b972521a8fd9de5fed0d60e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522296, "uuid": "9176e174-76fd-4adb-b8e1-03f48699f7e6", "value": "T1E7B31792F900DFF6F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522296, "uuid": "e7cfb0c1-432f-4b54-99c8-8d18ded50e1e", "value": "3072:mp+3MNBCpCTyRQpimmrytKus4OWlKhRm2pgYMx3IPtW:m+CTyRQuytDseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522296, "uuid": "5792b0b2-334a-43b4-a745-11196c74f7e4", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522296, "uuid": "a270af61-56fc-4bec-957d-966ca8b687c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522296, "uuid": "f6b2b51c-ea56-47b6-a26c-39178e3c9e3e", "value": "b886e1cca295b374dec8e670c76dd7e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e056a45-ff9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1685527828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527828, "uuid": "c5cbcbe7-eb72-4971-9f90-1e4a4fd6526f", "comment": "Malware payload (NanoCore)", "value": "8086b3bcc69ab5c969b67a4ba8104f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527828, "uuid": "0d536ba9-52f8-4821-84ae-7e9cd986f3c3", "comment": "Malware payload (NanoCore)", "value": "6c774ebc677180296f994563e208f0b0c09f7e7f25435999c6377668a91ba6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527828, "uuid": "a5ca4530-fd7a-4ee3-85e5-089b78f2d0ec", "comment": "Malware payload (NanoCore)", "value": "8aa75f5791db90006a7c5db8118ab6bcd695df2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685527828, "uuid": "7aca50e4-2cd3-4544-bd3c-71059cde389f", "comment": "Malware payload (NanoCore)", "value": "00723316f2d7a6718d2bbfe4cccdac561c6f085bbf2d2414ce5c8e0feb5ca07fa0ba6732885ee6211094c60ef3d8086f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527828, "uuid": "44cdb7ad-2673-4f6b-9152-3d27b4ea250d", "value": "T17F949B27B2BCC5E2F95C3CF9929443244AB0ACA28239E247D85FBDD0E9773A7D1055C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527828, "uuid": "961528e6-4a94-46f3-9180-fd54fba6b7d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527828, "uuid": "cf5246f0-65f4-49fe-b18e-056d14e8de72", "value": "6144:gKH1blm9ZuDIoOX520kV0aAAkTKpVatxtMV6ksT:RfmyDI55vPaAvrxtye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685527828, "uuid": "b7b37ed1-d857-4699-b11d-6f5cd7b2e206", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685527828, "uuid": "500e5521-8b1d-4fd7-8c8f-19cf27488baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685527828, "uuid": "95412dcb-5287-42c6-b79d-19d2bab4edce", "value": "BulkSMSData.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a76a0c2-ff96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685525728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525728, "uuid": "c8adad7b-5e18-4c6b-8a2e-ba40c393caea", "comment": "Malware payload (RecordBreaker)", "value": "a8c1f96c58503a9c766c7ed239263260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525728, "uuid": "d41ad9f1-8f82-4f13-b155-382d70bee5c2", "comment": "Malware payload (RecordBreaker)", "value": "6c8a2cea4dbf018262fc7ccf569de510c0a58612806a2be73a68d82f7b05d1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525728, "uuid": "ce5e7fc2-1546-429a-8ec6-f7f214f103f2", "comment": "Malware payload (RecordBreaker)", "value": "37069d83d46b51baceb396c1947891e3974e7594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525728, "uuid": "24f69781-5e9c-4ca4-8d90-fdf68fed0b2f", "comment": "Malware payload (RecordBreaker)", "value": "12c75f6dbc7a8338c1eeb3f9d9ef82dc4b09c34b3e9e902e8e559e43598abf82672b3824da61e13e8878d41045b46cbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525728, "uuid": "a472fdcc-0c24-47b3-afe6-01ffd220f0f8", "value": "T1EFF517C44990682DD0560267C7CFB6B6241AB0FE7BB5EB492F71E0C3D5E02A45BE2B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525728, "uuid": "818b452d-44f4-4e72-a03a-3f673b9e105c", "value": "ec65f5a4435b95682ab4aff841f3a72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525728, "uuid": "b5aaa47a-c780-4f7a-82d5-39b2ed573f43", "value": "49152:i+vDJjWt5tw0YCFs7JojDRmrlOt9lSyA8a0c1bEP0EDrmLKW2l6a77Z:i+vDJjWt5tRYTUe0fJKJbpKWi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685525728, "uuid": "98f31fb9-6bab-4421-a1e6-4270f5f29e2d", "value": 3557128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685525728, "uuid": "4b3eeb93-eb55-45f4-89df-eb5fd32e9957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525728, "uuid": "f8e6d587-d155-4d1a-b484-2fd1e5161596", "value": "a8c1f96c58503a9c766c7ed239263260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6968dc-fff3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685565490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685565490, "uuid": "c8f95a24-27a6-4a39-ae60-31cdb9f0e3bc", "comment": "Malware payload (RemcosRAT)", "value": "d1bfe5dced7785f6ed04ecea70874680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685565490, "uuid": "9504f6d9-08d4-403b-a770-89dcd006dcce", "comment": "Malware payload (RemcosRAT)", "value": "6e3cf5c7cccc4369fbed86c4de5bb59d7bb40c1ced10cab8b0bc733299d45ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685565490, "uuid": "0abdcc5b-7047-48c6-b2c6-964ead71681b", "comment": "Malware payload (RemcosRAT)", "value": "cbbbee660f7ea12a16a33a7668e8984661348fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685565490, "uuid": "cf79d3b7-a10a-4b47-bc53-5c44372477c2", "comment": "Malware payload (RemcosRAT)", "value": "d60367c59a7cd4b544a5e2f01bd1131ab5ac18bd9fdc12cd996323e1c3f83cb2971f679e7913c168d47992d7381bf7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685565490, "uuid": "5e233191-1892-486b-b272-a0747ad72dc9", "value": "T15B451256BF3F481EC2A62B79D132003487FBCA451117E30DBA8B157B9C0ABFD6C56662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685565490, "uuid": "5f3720b2-fea3-4dbc-bdf9-e8cf660dab6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685565490, "uuid": "cfd7f082-526f-46ad-a8f1-f0278ec97690", "value": "24576:n4Ver+iZgnLmcnsISMUgh8yBF6Wh7tOWcRZu+xr6DjOnaZayOjQdLLnz:Wa7MRh8yBF6SBtcHu+x2/ROk1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685565490, "uuid": "ed1e9840-8481-448c-9db8-8c8a5252fda5", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685565490, "uuid": "93a82655-2f10-47b1-a423-d8476a657d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685565490, "uuid": "4d0de2e3-9dc2-4348-a360-d806ad25c09d", "value": "Xerox scanner 3700013971 RFQ 2023_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178e76ce-ffa5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685532004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532004, "uuid": "8ad4b159-aa16-47e1-baa7-87b6dd25a9c4", "comment": "Malware payload (SnakeKeylogger)", "value": "c8b464bb63553f38026beb033afe58e9", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532004, "uuid": "6234f0fb-1575-4b6f-9a9a-bc169e11fcf6", "comment": "Malware payload (SnakeKeylogger)", "value": "6e6f28265a65efc29248f1bc10513f4c2320edba637d87f8341df71fa113dcd3", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532004, "uuid": "554c06d1-dd17-461d-81b6-51a95afe42a6", "comment": "Malware payload (SnakeKeylogger)", "value": "30ccc2ee2410802ad90275d13ddb4dc2cca11f45", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532004, "uuid": "800e149a-33c9-4d11-a452-064b45c7c7ae", "comment": "Malware payload (SnakeKeylogger)", "value": "5a0aa5f26b821d63919cb3af9b801870b831990b880996ec08f83bb13e787a085774e8bd084199b3b188d7c0f76684d7", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532004, "uuid": "ddc86bb7-08f6-4efa-abc1-d1df59c36d59", "value": "T1AC240202B2F02681EBFF2F75F9F6A12097B9BDD755B5D73C1A64900C5C44A4A2F22E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532004, "uuid": "c54b4697-4e76-4a2f-8fca-a1033d07dbd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532004, "uuid": "0ab9c241-1320-47b1-ac35-1c0e7c8215a7", "value": "6144:S6v1ebfDVAxV+szpZeVMebrmySqizl3D4hS:S6v12pAxV+sdY2efmnFlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685532004, "uuid": "f69790a0-ae10-4195-aef8-8534130cc32d", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685532004, "uuid": "f798e7cd-d97b-4c00-96b7-bd215b30d959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532004, "uuid": "972fd1ae-ee64-432e-99d8-31f6d007e146", "value": "06361699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb53337-ff62-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685503591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503591, "uuid": "b3f83e7b-febe-4ddf-bf8f-71b344062321", "comment": "Malware payload (AgentTesla)", "value": "3559be638fb00a48c2bdff70ec9166cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503591, "uuid": "aaffc938-6958-488b-9b17-39d38549795d", "comment": "Malware payload (AgentTesla)", "value": "6f75073132ca19d3880c0ac27a6d885d6f18f7c1b2650da13aeb84e5061acbb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503591, "uuid": "e9881b83-0f9e-4d31-ab32-e74dccc754fe", "comment": "Malware payload (AgentTesla)", "value": "25a2b1ad4808a015b79e99e3b2c6127883cfacde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503591, "uuid": "bfccadf9-4531-4ded-8e65-afacc9c73d9b", "comment": "Malware payload (AgentTesla)", "value": "f5f22e18dd35048b8d906a35122551aa6a9a98d461891c9c14e87322c0f5b51b185ad12e267fb6f555e821d21b5f21d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503591, "uuid": "e1c33654-cb7a-49a9-b0a8-c72ed79e29ab", "value": "T19FE41251EF7F1A07CAB6BEFE07744430A2FCC884546ED1AAFA5B1C1FD849A341D91262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503591, "uuid": "235c5f65-292c-4119-9ba5-aec5456b3936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503591, "uuid": "3e023bde-f189-47b9-93b0-6204d735c8ca", "value": "12288:LQAMTihh6xhZ6Orr5PlBnuazZROt3JUbpsCw58sV:fMUgh8yr5PLrRMU26s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685503591, "uuid": "54b8fcb9-55f1-4ef9-b883-0139db17a72f", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685503591, "uuid": "f4174574-2d8a-4863-a65b-9b1434bac9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503591, "uuid": "78eb4812-b141-4cf7-b21b-ce30ae3afa22", "value": "SecuriteInfo.com.Win32.PWSX-gen.4248.15440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca3833c-ff7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685514779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514779, "uuid": "9b297f37-a17d-4cf7-beb7-30b476a96fbb", "comment": "Malware payload (njrat)", "value": "bc548247396309826abd430f1d9c109a", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514779, "uuid": "ed0e91d9-a392-4d0b-a8ca-6a6eb4b04957", "comment": "Malware payload (njrat)", "value": "6fd73de1471bdbd28f8d23d97a6f6f30c9e4ec2ce1c753c43555bd4175576df0", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514779, "uuid": "7e3109ca-4b43-49d4-b30f-75637916a3d3", "comment": "Malware payload (njrat)", "value": "bee7a993e04140c4c1b91e6b7b6b54de385b27bc", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514779, "uuid": "b0230fe5-7045-489a-bb9c-da9f9ef4e82b", "comment": "Malware payload (njrat)", "value": "b989fcbc6cf9b0da62fb7dac48b75b99d9680f7896c674910c15b379d691172343726d4c0864dc7e67dd204c267f817a", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514779, "uuid": "a319306b-c74e-4b22-8008-542ecfca3cee", "value": "T14AF34B9A774A4B14E57C0C31D0EF5A3003F29A836A33E3893EC4669D9E522D75D4EBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514779, "uuid": "09300918-0f08-49ec-9266-45ad9d9a4171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514779, "uuid": "11d91d64-34f1-4bb3-90a6-827b1a091b2d", "value": "3072:Mi6S5/dqr1cPCU8zF6cBhBlnaAExMn9sODbrgNS6VtyTW:16M8zFP2xcsQbEVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685514779, "uuid": "d1522e12-6937-4327-bb53-0195a44961c5", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685514779, "uuid": "6c7f8f7c-af1d-45c2-a05c-2a2319bcdbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514779, "uuid": "2ef5d54a-8965-47be-82e0-3af485b16bc5", "value": "04149999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adc73c2-ff8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521675, "uuid": "5ab6ca5c-9e3d-4ba9-88f4-05f01a76230d", "comment": "Malware payload (GCleaner)", "value": "c624f3a0978da4f4f7dcdc9fc49c62bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521675, "uuid": "cf9683e7-00d0-45a9-a06c-f895e84c4d0a", "comment": "Malware payload (GCleaner)", "value": "708eabfad961139ab9f7fb423c1800a0a7cb3457af8998553aaf729c131d42c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521675, "uuid": "c0ebedda-403a-4154-ba32-289042592a1c", "comment": "Malware payload (GCleaner)", "value": "efb87a06efaa378c5bcd2d007bfe257ce99b62a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521675, "uuid": "14d364be-936e-4a15-88a4-4f1a4a6e4efb", "comment": "Malware payload (GCleaner)", "value": "71ddd05887f01a948cf35db0b1d33b8d8b61a1ab2b93f6fcb0a0f82a190180628d6b519416ef110ee0f1b00cd1071a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521675, "uuid": "eda3bfa6-b50a-4c03-a00f-63e3ffd34466", "value": "T19354CF1366E03C61EA7B5A318E3FD7A8266FF1514E24775A222B792F0D711F2C632352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521675, "uuid": "c8edda59-e877-44d0-8c24-31c02e5986d4", "value": "d4d619a3c5b6358079da73c25b60ff7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521675, "uuid": "f4fb40f5-97d4-4bc9-8a65-b7276163a57a", "value": "6144:w/KDqotj6SKEEQJDwPZ2EEj/pdKtMbG79wCeeBsG0a5:uEtjBwZ2EebVtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521675, "uuid": "d8144005-fbd0-435e-b73c-be0082e656da", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521675, "uuid": "48f7c91a-8956-421b-8ca2-1fd48b387da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521675, "uuid": "218f61b4-54a5-4c76-b754-6de5ec9a7be7", "value": "c624f3a0978da4f4f7dcdc9fc49c62bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6a166b-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1685511610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511610, "uuid": "125952dd-395a-4634-9879-25d11719ea07", "comment": "Malware payload (NanoCore)", "value": "e89323dd0063fb87b2115af014bbaf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511610, "uuid": "d92e63ed-b3d7-4195-a26f-dd0ecd76eba9", "comment": "Malware payload (NanoCore)", "value": "70d856cfc4e27c7ca18c939fd13fb989a308c64c0cd78d5d6f07759cc355c3db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511610, "uuid": "9c4be5a4-608a-48fe-9e28-81ba8372baa3", "comment": "Malware payload (NanoCore)", "value": "788e5fcae9e19827a9e2a3238cf17c50a737d948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511610, "uuid": "07484e34-b323-4b28-83ec-8b9a8dde3393", "comment": "Malware payload (NanoCore)", "value": "26d29f0147e5e97f3d4474cbdc9ec3ac5391820f17c02b0d6555a43cda9803d0f580295a0cf73b2231dae14c06fe1b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511610, "uuid": "38ede61e-52f1-4e21-86c4-b19a1cc2cb96", "value": "T11235F14463BB8F2BD47B57F24610623087FA6AA9347EE32A8ED261DF1575F404E01B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511610, "uuid": "0de8630a-f523-4fd2-b636-a221ba961280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511610, "uuid": "e9e51b45-334f-49ec-b6e7-ec39ac9d4cc1", "value": "24576:WkJLaVUH999a0EXC/swhOm5inc8NRLICAWVfjJGXQn+DxklRZ:BNBH9a0WImm5ic8TJlGAn+Fklb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511610, "uuid": "1d200271-3694-48f4-804d-325b63643837", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511610, "uuid": "a549daa8-2e72-4c30-ba5d-e5aec42508be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511610, "uuid": "886a0364-6929-42dc-976d-6ee654719203", "value": "e89323dd0063fb87b2115af014bbaf94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099e9c73-ffd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BitRAT)", "timestamp": 1685553026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685553026, "uuid": "487a51b9-1390-4836-82f6-6150637b8c2e", "comment": "Malware payload (BitRAT)", "value": "63e1c29b4c151caf92970fbaf8e0c2a7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685553026, "uuid": "bebb372a-a477-4bee-b013-f2f7d9b68810", "comment": "Malware payload (BitRAT)", "value": "719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685553026, "uuid": "dabdae0f-e2be-4fa7-a96e-2d45f2be6441", "comment": "Malware payload (BitRAT)", "value": "896386e7fd8d86ab3819598f4a549e61b919eee4", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685553026, "uuid": "56fd9e84-7e61-47f7-aa68-1cfef57d61c6", "comment": "Malware payload (BitRAT)", "value": "b41b5e3f99a71d8a7f4bf649a2be2799b5b7539eb6dea5212e3c15d2628d3e36796e46b2fe78d56dbc6f0f80448fb103", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685553026, "uuid": "359ceb55-0ca4-414a-824a-9efed6c66470", "value": "T104A5CF26B1A5F561D80641B05D22C5F93529FC3AA0326D07BAF17F8B94703C3ADB937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685553026, "uuid": "5720af90-0e9f-40ba-ac57-bacb6131c5c9", "value": "bb2690f72e68072712a6c527c992f5ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685553026, "uuid": "73b255c1-9e61-4023-9d6b-9fa4938eb52b", "value": "49152:GCO1NlTK6quyJYbwyi0UZTdA71QxlJOJ56eJwzG6hCF98v7:GJATVdA7WtOOeiv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685553026, "uuid": "f161d255-5134-4ac1-b191-08af99a66ad4", "value": 2183168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685553026, "uuid": "53ac65ad-c90a-4c52-b258-fbe92488c378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685553026, "uuid": "e90944b6-f4f1-4633-a9b2-00df9c2b128b", "value": "FAVOR DE RECTIFICAR.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012ed4cf-0009-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1685574916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685574916, "uuid": "c19934f2-d675-40f8-8039-8d59f809e8de", "comment": "Malware payload (Pony)", "value": "c1090629855ae54545498aaa7738e352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685574916, "uuid": "97b18e40-20d8-401c-8df0-4630a0ab20c3", "comment": "Malware payload (Pony)", "value": "71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685574916, "uuid": "c4af202c-863e-490b-bb8e-56b86a24ae6f", "comment": "Malware payload (Pony)", "value": "b768286921741aa0ce47c6485a922dc76f4d732f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685574916, "uuid": "ea0a0765-4d9c-4104-9e88-c5bfdcd4f6ca", "comment": "Malware payload (Pony)", "value": "7930084a9a971383cb24188f24d7898568dfc57faf01dc394dddd79242f71d6a8e56a54991784c757cb91de572b27dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685574916, "uuid": "168816b8-3122-4e04-9805-b2e86bfe44f0", "value": "T178E4DF963697AC09FCACBA310DA69560C860ED717864CDBA61B4FB3E59332049F3171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685574916, "uuid": "afc18e06-b240-4b24-aef8-a5265a0b92fd", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685574916, "uuid": "6bced8d8-cf17-4fac-b632-d6388060ebe3", "value": "12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHl:Url6kD68JmloO5TYI1lOq6sb8hTHAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685574916, "uuid": "0a052d9c-5068-4a90-a9a2-b9d5b296b7b4", "value": 719258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685574916, "uuid": "635f3875-6459-46d0-8a25-77d1218ed226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685574916, "uuid": "e8d46c8c-c36e-42b4-a686-1c4b834105dc", "value": "c1090629855ae54545498aaa7738e352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3edaeb-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685512764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512764, "uuid": "c5b4688b-719c-4f0d-8bb2-310bc3abe866", "comment": "Malware payload", "value": "4c1ff3cb56bcae906828c108c526750c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512764, "uuid": "fe7bde4f-801a-41b2-b5cb-12640343ec31", "comment": "Malware payload", "value": "721a227205747c992fd70f18c9afc4104eeffeb3267fe559ea27b1bd25b15c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512764, "uuid": "b3b8893e-c734-4d59-89e8-1f5c7fe1408f", "comment": "Malware payload", "value": "b5db12c9daecf7709b2255123dfd6a205fd43794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512764, "uuid": "ce19847d-4baa-4d94-b9ec-ef491f113778", "comment": "Malware payload", "value": "2bf31c8c5f258521137fcb91bd05370f6e36e19431b9d960236378a70eca698fd9fd408979387425ad1279df209370b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512764, "uuid": "593f125b-f9de-4526-a89b-e2b56abc8470", "value": "T1D0150201F6D684F2E6331936097ABB65A87E7D301E24CA1FE3887D6DCA35181A131F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512764, "uuid": "36311f74-1c2d-4b26-b5c1-8ed17bdf0fc1", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512764, "uuid": "d5953517-5f2d-43a1-b100-1745c953e0b3", "value": "12288:NcrNS33L10QdrXjpDnxSeEj7lEQ34SAEllZIyuj1uNwfewToVoLTVlBTUR8tPpX/:wNA3R5drXlDxSt7lEboZguNXVoL7BoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512764, "uuid": "ac216b1c-086b-4ad6-8401-cd57a4c6ecf8", "value": 940755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512764, "uuid": "15622e5c-f7fd-4544-ba97-ab039eb5c6b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512764, "uuid": "57488742-4c33-4536-a46c-659cb949f3d7", "value": "PAGO.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31d0373-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685513018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513018, "uuid": "985faa68-a320-4b02-8947-688fe358f5ba", "comment": "Malware payload (Formbook)", "value": "bf3daf6399200332162830f6e240eb81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513018, "uuid": "ad40d403-4269-45b5-86d1-cd8ce6849253", "comment": "Malware payload (Formbook)", "value": "72c2552dacff5e958ac6ba324ad741bd87449ef251b001b17d604112466809e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513018, "uuid": "4237c9c7-4602-48f7-8311-7e9aad200a06", "comment": "Malware payload (Formbook)", "value": "af275e1e21f9fa4bb55d380cec38ab69dedf9bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513018, "uuid": "4bbce671-5fff-4c6b-b0ea-1f66448c80b0", "comment": "Malware payload (Formbook)", "value": "fad66f51f90a437e40ce7883c2b3b25d30b27d391ddd5832322c2754934f0f06147a12133ee928db4cd77dd4b64b91e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513018, "uuid": "19f00159-6e7e-4373-9ee7-94e166954b1b", "value": "T14DF41205EBBF170BD5A67EBD07304071AAFCC985402AD5EFEA67986FCD1AA342CD0161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513018, "uuid": "ced02655-d886-4ac0-8c97-cd29e5075e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513018, "uuid": "10ea2d38-a7bd-426b-9a9e-151f2da31b70", "value": "12288:HHAMTihh6xhZ6Orat92oH5qcFc7k0gJ6Ff7E/KCPRtUexF8HObzoCThLiZb60n0z:AMUgh8yat0aoEcY0HFAHtUtpCAUv+ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513018, "uuid": "9e1f38a6-c322-49be-83fd-48d0f8d875b5", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513018, "uuid": "9e4d55d1-c946-4dea-9690-481b57611d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513018, "uuid": "a2b92c13-d3d0-420d-9546-9dd649af10dc", "value": "XZaJIn93XKEeTgV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc95a585-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533677, "uuid": "1400ded2-eff0-42a4-ac8b-e1ecd09543f1", "comment": "Malware payload (SnakeKeylogger)", "value": "4f2c6a52e85eed103eccb048c9bb33cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533677, "uuid": "6d763081-3141-4889-afc3-cdbd0ad67207", "comment": "Malware payload (SnakeKeylogger)", "value": "732354f17c07ca3b384ec5c2cdceed76395fbbdf3cd9e615d2383a444e35d695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533677, "uuid": "c448e2a5-a764-462c-a93b-28197faf482d", "comment": "Malware payload (SnakeKeylogger)", "value": "83a26cb54d7259506f68182951da8a4426cb1e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533677, "uuid": "c0bc6f66-cfcd-4314-b993-ebbb8c9e4f90", "comment": "Malware payload (SnakeKeylogger)", "value": "e970b540119686f144a8ddb50b8143f1a5c36162980aec18afeadfddc7747c766e2441b2f32a994400555da0edf25c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533677, "uuid": "eb9ebd29-1f1e-4d61-b023-b309a1bb8e40", "value": "T1AA24F142B3E02676DABF8EF6DBF71100C671E9DA5E3DDA7CD08090C99858B246A51F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533677, "uuid": "8feae0e9-f672-4718-9528-e14e6b80e4ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533677, "uuid": "ac940afa-f4cb-45a7-82a2-5924522b2e79", "value": "6144:W5hrsBs2tROJ8VUgol+Ow3iUUUsSdLTVy:W5hrs3tRjWFlSdsSLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533677, "uuid": "b09806aa-3d2e-48c8-8d6f-6f3c6d7fb073", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533677, "uuid": "ec29fde4-e079-4fa4-8cdf-3ea93c6160af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533677, "uuid": "dc9d58b1-4ce4-4481-abe1-427208dc3501", "value": "SGH09876678900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450abaa9-ff95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1685525209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525209, "uuid": "ee1e6177-e759-41df-9b40-53a984656d66", "comment": "Malware payload (GuLoader)", "value": "e57e1575e0737614cd18c1320b1b1183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525209, "uuid": "861c5b24-b236-4895-b10d-7739b671b6e6", "comment": "Malware payload (GuLoader)", "value": "733bf880b95b90976c6e7f066878d5450d4caa2014ef364056997cb6c49d87f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525209, "uuid": "26009745-799e-41f1-963c-dbd67909e27f", "comment": "Malware payload (GuLoader)", "value": "acc4bf41ba813bfaefed3c916d4e6a8554609a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525209, "uuid": "6243ec8f-6e35-4ed0-a528-4636ed5afcb3", "comment": "Malware payload (GuLoader)", "value": "db91daaa8e9087221bfe89682de66d5f19dc8e3f592fb7dcc7b70ce0998b8a21769d382a4e518afdb89d77d14939f89c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525209, "uuid": "f18a4406-5072-4fe5-a610-f662a0a16deb", "value": "T1EF64E04121A5BC53CC4D5DF2781BE5ED8D671EB00AAC963AEFD07A282B31F4FA706181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525209, "uuid": "8d9f1106-134a-4c2c-9d4b-064cbc0ccc2c", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525209, "uuid": "dd969bb0-7af8-4414-9d77-42fda10dc767", "value": "6144:eBerKbGa08c3c5ltQ0amlCszWBRJvh6GJxCwvzfYGlmUL:HaGatrvlaRJZ6mvzrmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685525209, "uuid": "68159c3f-f41d-4647-a7f4-3b4d63db448b", "value": 336296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685525209, "uuid": "b8830fa0-3fab-4ef8-8095-2eebca7297ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525209, "uuid": "0831bed2-0717-4b75-8923-7a5326153b4e", "value": "e57e1575e0737614cd18c1320b1b1183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efbf67a-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685533520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533520, "uuid": "f878b8fb-8d60-424a-b779-b854edc51774", "comment": "Malware payload (Loki)", "value": "51b45887de747bd8c4065fa476b0a607", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533520, "uuid": "e886596b-9e9c-4837-9d17-54e84fac678f", "comment": "Malware payload (Loki)", "value": "73fcece1a73ce4f819d9791ba05d30af3b246540c38da8b851bc4ec66b4dba3c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533520, "uuid": "f24f4f30-e905-49d4-979f-c87365eec889", "comment": "Malware payload (Loki)", "value": "b43bc0023fa6a9c7b9280d5307b15cd0c55041bd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533520, "uuid": "78d75bac-af70-4bc4-ab88-a77fa0521120", "comment": "Malware payload (Loki)", "value": "b3321f37b3a33c2a46c3bbabb603391e32a56130d9b1e805f795fd8fe0240e43557e643bb3e7beb520aa3f4eb99430fb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533520, "uuid": "8888a6ef-3e1c-4431-9cf1-8a380cee776a", "value": "T166650122E445EC3EEAC6CF349E836485861C7D57BE8E68862355772F7A331E2974320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533520, "uuid": "a1c527e2-d423-4aba-aa86-a1a898f70779", "value": "24576:pLKBIcRsDW/KKJ8cRsDW/KKQAnaWsyHBzebuhtBsRDc:pLKiPyCPyRsEzebkt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533520, "uuid": "30270175-25cb-45c3-9fda-492b89043470", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533520, "uuid": "74e5a860-3680-4ba3-a896-12c7ea82434d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533520, "uuid": "d7244cf9-4b3e-4f12-8c88-59d187dbc68a", "value": "PERFECT 214930.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c61e1a-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533979, "uuid": "155c2df1-4cff-4e18-979f-8f042b5fd77c", "comment": "Malware payload (Mirai)", "value": "b02897c14b793f2eba617fe117844cf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533979, "uuid": "ea9b0008-cb71-4a3d-8b7a-ff5416b610a1", "comment": "Malware payload (Mirai)", "value": "74a2be0718d7e0194f0587f5fc14b930f2355c8c242064706c6c32b37d6b7c47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533979, "uuid": "e0633f49-550e-41aa-bd51-08ad5d1f649f", "comment": "Malware payload (Mirai)", "value": "6495630c0a49751503f7a14ed811bcf033fc9b3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533979, "uuid": "6f65b06b-820f-47e8-9093-823d12435ea6", "comment": "Malware payload (Mirai)", "value": "2a48db86a760dff03079bf719b26dab0e86bd509b49f6e44d115c1654cf8326a370379d9c102e7141ec6a6817e5c234a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533979, "uuid": "96421ca5-be6f-464b-bd73-f9b3677a619d", "value": "T13C13E755B8819A3BC2E0237BB96E468D336067E8D2CF721BDD215B207A8651F0D37F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533979, "uuid": "bc6e6ec6-2435-4333-aa9a-fb46b5f49516", "value": "768:NgvFspbwLgK9SD5XfXSgnpoL3TZ0JV91pemOiuLDmfZUN9Dr9oeF/NxwW:NJb6gKS5PXSCaBU/emB0Dm6rpQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533979, "uuid": "1c166c5b-492b-48d7-bc13-af4004f82727", "value": 43868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533979, "uuid": "6ad62586-5299-497f-ad42-41c83f186600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533979, "uuid": "5745ca27-d53a-412b-982d-f71916b765e4", "value": "b02897c14b793f2eba617fe117844cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0dd9f5-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685498704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498704, "uuid": "6e8f744b-2c7b-4732-9848-e3f27bb63572", "comment": "Malware payload (RedLineStealer)", "value": "9300b7c620d67a91f9acbb4c6bb7b775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498704, "uuid": "3d5d30ff-620d-4980-af2e-1772e88de634", "comment": "Malware payload (RedLineStealer)", "value": "7548199d8c3b1c2c4a430337680c194805efb4932f5003bf1d9c836379cf7c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498704, "uuid": "c110fb88-93f4-4304-b57d-43e9032507e1", "comment": "Malware payload (RedLineStealer)", "value": "6841c976c891398d63c6155f713b027108b77fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498704, "uuid": "3ea2a3c5-49cc-4013-828b-ea3b5544b30e", "comment": "Malware payload (RedLineStealer)", "value": "ef6bb51c2becd3104092542e1af66a1f164dcd60617bd103c0c7bb36bc0ab4b71936c8fdde7920318fcab10c25d8aee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498704, "uuid": "06ac4f9c-e996-48af-82f3-3786a778b4c2", "value": "T168F41247D1E9D473E8A93B7068F707E30D7EBCA11C38865B2384A45A1CB29C4A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498704, "uuid": "21943c80-9d7a-45e8-a23d-47cc02bedc8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498704, "uuid": "af6f2f15-ab36-4aa8-ada8-c591f2bb3891", "value": "12288:rMrYy908oyXzFsK7dxmIVSggldzJk/lGrAq2+SCQlraCtHU1:rytl7TmMSnzC/MA6yah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498704, "uuid": "8465f74f-b3f5-40dd-b40d-98da462726f0", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498704, "uuid": "f38e4765-3a5c-4a33-8982-b08c8e54d647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498704, "uuid": "9c5eb286-0f00-49b2-9f7f-7d5d32dd4406", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f681f14d-ffae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1685536244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536244, "uuid": "34bcd295-160a-4e12-88b3-f69f8e0a2545", "comment": "Malware payload (NetSupport)", "value": "bc22a03482586db9212024d411eabd38", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536244, "uuid": "f863ba8c-a67e-4eee-afa4-d8598c7b1c7c", "comment": "Malware payload (NetSupport)", "value": "759e159da0592063bb0eb967dd45802caa0a1538867994868d5b883f099286a5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536244, "uuid": "c7f93316-e2b6-4843-aad7-b6f49c572d05", "comment": "Malware payload (NetSupport)", "value": "3ff35c3671ee1208fd32ff898b093fe5f23783ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536244, "uuid": "7f5a2f75-f615-453e-b6a8-04bcfaa7504a", "comment": "Malware payload (NetSupport)", "value": "121b9b5107b58c719bfa10b35f950ad0201f2e71614b46f797e5228685eef921f19349c487869c203050c3488e944c74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536244, "uuid": "66d1ee47-49d6-474d-9e72-77bde8458df3", "value": "T16253FEF98DE351A4691371EF536FE444A0A2041B0C49FE54785CEA10AFDC52CBA78AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536244, "uuid": "af9b7b9c-ef81-4b0e-bff0-dee7a14b5192", "value": "768:aV3C5ZVs0noboWvBgDs9FMBg7MU78OnmN8s2LaUB6k:Oy3Gx8WEs9R7MU7MN7ELv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685536244, "uuid": "27a8cf80-bbec-482b-84cf-b15f96c74e8d", "value": 61779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685536244, "uuid": "2087363a-c901-4da8-a8f8-b2f32527d803", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536244, "uuid": "5ed36824-1954-4b37-bf6d-b9f4072ff59a", "value": "scan129.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79cb41d-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685520247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520247, "uuid": "7120bcf7-00ae-4f14-a7d2-38e8c9389bb8", "comment": "Malware payload", "value": "729ee238b4bd1ffad1219a83afe7997d", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520247, "uuid": "8b94f84b-08ef-4c00-aa77-7d7f8044f469", "comment": "Malware payload", "value": "762d3a891ef749d969e512818971e193181f18fc4288d0a3b8c32b8f511f8577", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520247, "uuid": "0d77eebf-ceff-4516-87a6-85d06893885e", "comment": "Malware payload", "value": "62f3146c58f45bcff1ded669d93cd7e4340c3942", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520247, "uuid": "c62b02ee-e678-4c82-8fe8-008ba4fc4fd1", "comment": "Malware payload", "value": "c7c35a3a3e5a1ea48264cdd8ea97d21728290c5ed3f1b88f1b8ec0975843f7acd773188479bd6f005cfde8a06cbb0fe6", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520247, "uuid": "a32102ff-ff83-438d-9d53-31cf15f195e5", "value": "T1F352F71D6BE44334EABEAF365C72A24006B2BE04DD23EF6E09D6941D1C736548DE1F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520247, "uuid": "fc1ae271-a212-4a7f-ae7e-fded2dd186c3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520247, "uuid": "0752d529-bfce-4e95-baaa-dd5b78fbd6d8", "value": "192:pp3AJUFIWJm/sfCJBWEDKu8BZ5FGOsT1Vu4IW1CchI6gQHsNEuKkrdzL2v/HY:ppQFWA/5su8BMJVu3chtdsNQkrAnHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520247, "uuid": "bf3ed5ae-cb8c-4a3e-a85e-4b29c1ff5a6a", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520247, "uuid": "94fff464-964d-4f77-a927-6eab8138b4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520247, "uuid": "d85da8d0-6e3c-47cd-839a-ec846eaae8c9", "value": "1685520246532b9f05c4b4b777ad1e73c5104475c699e2430e982ea7eec42dcfc45771a30b505.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e1a24-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685519634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519634, "uuid": "7123bf68-e1db-4bce-85aa-3155f8b99410", "comment": "Malware payload (Stealc)", "value": "d7a9fc879fc9b5c6b5b189afb304dade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519634, "uuid": "f405bf79-a0bd-4344-8826-87839a71053e", "comment": "Malware payload (Stealc)", "value": "76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519634, "uuid": "316a4197-ecbf-423e-b5be-9fff3ca8dec9", "comment": "Malware payload (Stealc)", "value": "32221bd6511f38963b2ffab94f613be21398aa36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519634, "uuid": "6328ccaa-0d32-42e0-a999-6992f4b21ce3", "comment": "Malware payload (Stealc)", "value": "fa0788a9adf9236e0dd5d0ff6ecfce1962e3e93b54901719bc6069fa9b4995816bc9ff5bb1e9dec84b5ed74aa420198b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519634, "uuid": "af6c360c-386e-4845-8a82-34f677c169dd", "value": "T1A6449D1373E1A835E9670A719E2A82B8662FF8714F6567EB335C5A2F0D702E1C672305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519634, "uuid": "d750b27b-9109-4bf1-b535-e0b0c103126a", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519634, "uuid": "253f188f-30ed-4a0b-b9c3-dfdcf58af3cf", "value": "3072:A754m4GzHHV83FoePw7K7PkaTFWwbm0PVf3QrzdWX2Hr/OOy0WOW+PybI5j:u5P9zq3FhNFW+m0tEcm71/WR+I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519634, "uuid": "59618744-cbc6-4232-9b57-adb0a9220eb1", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519634, "uuid": "c5b77162-b50b-435e-8a75-62a6bf5e9410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519634, "uuid": "d475678d-32cf-4cbe-a710-09564b135860", "value": "d7a9fc879fc9b5c6b5b189afb304dade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c1fd32-ff97-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685526144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526144, "uuid": "d7f9bd8b-d7f1-4f53-8ef1-ff1d8d2d0a79", "comment": "Malware payload", "value": "764e1007523d9278f17307a86c0c4bd0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526144, "uuid": "93ed80fb-b36d-4f17-8905-8030c9e82d16", "comment": "Malware payload", "value": "76ef1c73f624e5bddfb13821c9808af9955dbffd2f5ce000e4ffeb4c72d6549f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526144, "uuid": "53fc480e-6d40-4631-a80e-f777581fce68", "comment": "Malware payload", "value": "a044718fff2cd3b8045fada9fdd2dd4c3e770b26", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526144, "uuid": "6f034325-0d6a-4fa2-b1d2-f28ba85d072a", "comment": "Malware payload", "value": "2098802c3460829b174ced7baba92ed2aa563d7d7b6b8bcc8d7d841d631971188f183dab5ce78d6e927421a35223ad9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526144, "uuid": "4e3e7b74-470f-4fb2-9600-52e797244408", "value": "T1F785227F32DE6417E1C5223103DA1B36D707E9FA329A17279B94676E8BA459CACC1033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526144, "uuid": "b6a47935-2747-4781-9edc-b7a092d02314", "value": "7478c874d7b2f9de14f3e84bb2758605", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526144, "uuid": "f56c2ba4-d1ae-446a-8bd7-0bd63ccc7af0", "value": "49152:o3f0Zhd9yD3zgfxvFNr3BcbdzcXrJStdwsJAC:oP0hCk9Nr3UzjiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685526144, "uuid": "14e5d9d7-7dd2-401d-81a5-6f4651f8ce73", "value": 1848832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685526144, "uuid": "d812da81-78f6-48f5-aa48-83f029f7f4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526144, "uuid": "dde4c7b2-7225-4224-b25d-99dd03f6bafa", "value": "IntPrt32.dll.ensilo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a01e59-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685519868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519868, "uuid": "ca2b4e53-77a9-4d81-8f5c-a0bdaabe4f4a", "comment": "Malware payload (AgentTesla)", "value": "465b1011b7c220d562ec8c0ee155e1a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519868, "uuid": "a3e6c227-13c5-498c-8986-e7b67d0d3cba", "comment": "Malware payload (AgentTesla)", "value": "77bfb64b680c8f44d0877bc689484abdf187b6634662b2eb4d4c9a39d2189c4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519868, "uuid": "cf56e04a-2c54-465f-880c-913e66857535", "comment": "Malware payload (AgentTesla)", "value": "bfe2297d14deb62defc34b90770ba99f5b0735bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519868, "uuid": "1d2e6a05-7d12-4df9-8fa5-e1efd44cf642", "comment": "Malware payload (AgentTesla)", "value": "d0f097caa4d2d1efcdbb05818ebbd44857be911f8c4ec7c4c2ec1eda54df5cdda0433b6307742bf846c61290cd7ad470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519868, "uuid": "15ddef29-dcca-4b4a-9e66-f2b934ed6141", "value": "T15F650122F895DC7EE699CB354E836485861DBC27BECE28472355731F3A325D2A74320E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519868, "uuid": "630e8789-b1d9-430d-8fcf-0d2cd5e210b5", "value": "24576:jLK9+PkdIDW+DC4PkdIDW+D4naWsySEG4mgwrQd:jLKEkdIlBkdIlisJEGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519868, "uuid": "d0ba7fda-44ba-4ba6-9e00-c3162b8db819", "value": 1497088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519868, "uuid": "08036372-9145-4eb6-a401-2363657f2dea", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519868, "uuid": "1ba7328f-7f95-4f89-bdf8-7b30bfe3db41", "value": "Perfect 214930.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0272a9d2-ffa5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Metasploit)", "timestamp": 1685531969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531969, "uuid": "fee51ab1-faff-430a-87d8-ce36e5f5cd48", "comment": "Malware payload (Metasploit)", "value": "c83781e961df941189eb2ca631e9f485", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531969, "uuid": "368cd03f-c9ac-4ed9-9f95-5193ea1d5a0d", "comment": "Malware payload (Metasploit)", "value": "785b5a5a7e290b1a00edf82a373b05dda47f252ec91ec64659b64eb98f9cba7a", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531969, "uuid": "92f3d4b0-1942-47ce-a4a8-7fc77381dbe4", "comment": "Malware payload (Metasploit)", "value": "b28949a572214b8b72ba1656cfed0557a551aafc", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531969, "uuid": "5e70e7c4-50ff-4eb6-9db1-d8171df1ceec", "comment": "Malware payload (Metasploit)", "value": "6ad7128862a851b22a7a1bfc81a2f4906707df3314230425ea2cb6b920053aa66e93073f70f2cc54b2f2d0e6d6ae40f5", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531969, "uuid": "1891a832-e561-47e8-b0aa-330a657be0d3", "value": "T1255165542BEBAA5445C30066BEA7E0CA1D2A1F7254D8AC00F1EDD5E1BF8B951C1B6394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531969, "uuid": "ad5d4e87-5109-48d5-9b74-0a3a2482f26e", "value": "48:XgGB2R6NDvO4dj7vMZ/+RpIIUbD3bDLELgDVL3x0lpmM0lpy2k0lt0lb:XgG44dvvOmRpFaALgDr0lpmM0lpU0ltu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531969, "uuid": "f0d091ca-ddc5-403d-bc79-1eee183239be", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531969, "uuid": "03706003-eb15-4555-9d1b-14b2f89d3820", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531969, "uuid": "9623dde1-91cd-4954-8579-973cd893ddf9", "value": "05019999.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bf5715-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685531926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531926, "uuid": "b8db6252-fd9e-4c1a-8950-4a38e6168218", "comment": "Malware payload (Quakbot)", "value": "5854ebd257262c4ae210aede88f068e1", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531926, "uuid": "fcc2f698-2af0-4ef7-aaf8-fcb4ac788e92", "comment": "Malware payload (Quakbot)", "value": "796097ee3f5ba067eea4c4620b8c64b6342300c7ea716bc99b112dbe940d9006", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531926, "uuid": "596eb9b8-f025-4aec-b3b2-3e8def9ba39c", "comment": "Malware payload (Quakbot)", "value": "9397864495da69627235ad0ca31adcdb503876c7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531926, "uuid": "090d6507-7ae7-4012-b58f-bd753877ccef", "comment": "Malware payload (Quakbot)", "value": "f756d70504e9bb8e75a940b671f6c7e717056bafea9d6d3c1ce761a81f899414174394a078f44569ca07c57428ca9ded", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531926, "uuid": "40c5a796-82dc-411e-9d71-0f64db9f054a", "value": "T11DA1E07B9F998A7ED269FE006086DC8FCAC9C175250FAD93F24B9150B8EE41C82735C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531926, "uuid": "1f72065a-b3c2-45dc-b342-9607fbbce038", "value": "96:P3alnOLPb6TlLMeGwlRn3QMCj+FwFTHlAMs:falnWb/P05QMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531926, "uuid": "ceb0acea-8705-48c0-af54-2121004e487a", "value": 5035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531926, "uuid": "d06386ed-52e7-40fe-af2a-133c00dba5e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531926, "uuid": "de9437fe-5c31-4ce1-9b20-f8e8878303ee", "value": "01957699.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13468cc-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521176, "uuid": "9c0b8c7e-94a2-410a-b473-6c7ac2333dd1", "comment": "Malware payload (Stealc)", "value": "f4ad5ffa0f38dd9a01da4790a5bb2f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521176, "uuid": "d38a5319-b8e5-4535-a7fd-840f04f8b597", "comment": "Malware payload (Stealc)", "value": "7b2acf4e50455c57cfd5ec624c1655e3ca4c5fc4fcafed3ff2ff2e4fd75a2894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521176, "uuid": "d481c27c-2beb-4021-a7ae-d8a2dfaa2959", "comment": "Malware payload (Stealc)", "value": "159d098c82a2308cfdf9a22259131f53f545f8d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521176, "uuid": "35f81ee8-abde-4974-a1c1-07a98c64a38d", "comment": "Malware payload (Stealc)", "value": "95e3674fe55f441cd0f5a6853b22ebf6ca8616a22bc42b311d61e188a562ec13a81c635349317c745daf2474641d6015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521176, "uuid": "c716ce11-bdf9-49f5-97f5-fc1b675eef85", "value": "T1D854F81382E37D44E927CB769E2ED6F8771EB6508E993769122AAB1F04B00B3D173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521176, "uuid": "028f1893-6553-4f0e-921b-456c972bb4b9", "value": "9514ea1f6b76796d84439e43008aa7f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521176, "uuid": "e3ee68ab-9aac-4554-baa9-b2c047e34911", "value": "3072:rX8lUoQLHhTizqlEc0UVDLqDFG6rC8A3MnxjVFcAtG5Jv1DATPGa5M6:b8lUoQlq6Ec0uqD9eEnPXoCGa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521176, "uuid": "7d18f61a-efd4-41f9-8544-365773a545a8", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521176, "uuid": "1ebe9656-76ee-43df-a264-d12837f6d71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521176, "uuid": "b2d79a24-147c-493d-b218-373fbea5b16b", "value": "f4ad5ffa0f38dd9a01da4790a5bb2f45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db59a69-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1685528122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528122, "uuid": "17b1fb94-555c-4fe3-a982-cd5b3d62cbed", "comment": "Malware payload (Pony)", "value": "aaecf776a6f8850da8a1b4d63bc15e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528122, "uuid": "4877f02c-4e50-4d3d-bd4b-97251988ba3f", "comment": "Malware payload (Pony)", "value": "7c4e0b95c73cc6c75ad1c74bc4bb7ea27444015c9934a000cf183eb5d4948a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528122, "uuid": "e3df1c15-fde8-4463-8f5d-7c809f20cd32", "comment": "Malware payload (Pony)", "value": "a17344b14cc9bf756d8b52666dfb665e19e8bb31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528122, "uuid": "8e4935fc-ea04-4360-8b4b-061100a1e8ea", "comment": "Malware payload (Pony)", "value": "1b416b4f4a4823830da7c1d91f920668c8e08e2caf5add2d8a341272d442aecc06f96a31087176bddb70bee232ac0d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528122, "uuid": "8f0c4c78-0598-498a-9118-c2c3b602ef80", "value": "T1EC459D12739F8260FE6EA1327E596301EE6ABC212520FC772EA41D7969231611F3C75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528122, "uuid": "40aee363-0948-4077-bfcb-656f9328db66", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528122, "uuid": "35c367dc-02b6-4dd3-8191-d5bbf04864c9", "value": "24576:iu6J33O0c+JY5UZ+XC0kGsoTGcjr1I1lOq6sb8hTH7NWYu:Eu0c++OCvkGsEGcjr1i6skHUYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528122, "uuid": "ceb74c0a-40fb-4219-9d7d-523142ed5e73", "value": 1186882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528122, "uuid": "991c6c47-a68e-4ec4-87af-060df3beb175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528122, "uuid": "33711a32-2f05-4f62-8fce-5b0888d3541b", "value": "aaecf776a6f8850da8a1b4d63bc15e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa34bd0-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685522507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522507, "uuid": "d52ca641-5e3f-4e85-8d49-9005de4f7c26", "comment": "Malware payload (Quakbot)", "value": "d0eb64ae32b9b76a4b14125fc22a6559", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522507, "uuid": "538ff499-3119-46e0-8d12-0e7f13d2285a", "comment": "Malware payload (Quakbot)", "value": "7c78ae9b90bfac4dae6449707fc59663df760d969c80a691d0dc0ff3c9e95b24", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522507, "uuid": "1186e784-76ec-4239-a313-bc3e6d5b2cc0", "comment": "Malware payload (Quakbot)", "value": "063816fc22a12504814b05de9fd071f706b5909c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522507, "uuid": "8ff034e5-c1e6-47e1-8e45-da77ffd5a823", "comment": "Malware payload (Quakbot)", "value": "1f563e505c01be9547dc6c8a0b0e0197936fa4bcaaf4c51c355951addf9a3e1d622ca6e7245669c3095bbf01d58c7ec3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522507, "uuid": "6989daae-2909-4457-a432-f6e5b2fe556c", "value": "T1FCA19EBB9F898D7ED268FA452086AC8FDAD5C534211FA993F71B509178EC41C82B35C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522507, "uuid": "aee0fb35-b1a7-43c4-808b-990e44aedef2", "value": "96:CaENtqGbDNTRfORxRr8VrrrUUrYXrJnTCvz66FwFHvMcUI:5ENtVb7ORxl8xH7Gd8EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522507, "uuid": "112a913e-6b19-423a-9336-e51cfbd47190", "value": 4842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522507, "uuid": "6a45f847-f699-474e-8085-d2e87721c984", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522507, "uuid": "4a266e5e-1d56-459a-9bd3-7952dc246d19", "value": "doc_C468_May_30.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de304027-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520312, "uuid": "b415c4e3-915b-49cb-b451-09f7e1fbb59e", "comment": "Malware payload (Loki)", "value": "717a054d7a7c2d0066e3888ea5863c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520312, "uuid": "dac76cdd-dbac-49a0-978c-0d9dcdee8773", "comment": "Malware payload (Loki)", "value": "7c7ceeedb2701b97482120051287570bb5d67749a285921664f3b17c926b687d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520312, "uuid": "62be1108-0edc-4959-8797-b16adf0798e0", "comment": "Malware payload (Loki)", "value": "a9dd53d5d14d610d278e106e08b6873793e0293c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520312, "uuid": "1cf80a42-0dc4-4369-bf7c-adf70ca400a2", "comment": "Malware payload (Loki)", "value": "dc1847171147985f91a4c118e4ae357db610f792728fcf74cfa9091c6058a68c1ace67b0210731b4c3420e70143e879b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520312, "uuid": "239f35da-85ae-431d-b361-cadce39f9ee2", "value": "T170448D1373D19831E96B0A719E2AC3F8662FF9718F556AEB336C5A2F09711E1C632305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520312, "uuid": "066920ef-bb8f-44ea-bce1-65dd76fa62d9", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520312, "uuid": "97ae4a4c-fe24-4282-bf0e-c73b3dd4d16b", "value": "6144:uUf9T+QJO3sIOTVGDci80Ug+mcAJ9QGh58X:uUVzJWsIGADr80UDLoQGh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520312, "uuid": "590b05ea-41c1-4a66-9db6-6eafb192d425", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520312, "uuid": "c1648652-e23a-4740-9852-07d0076a9fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520312, "uuid": "95547171-9d04-4e42-bfb2-536abd060ec8", "value": "717a054d7a7c2d0066e3888ea5863c03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645f8546-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519678, "uuid": "ec6c7e2c-0fdb-4ad4-a46e-c82f82014545", "comment": "Malware payload (SnakeKeylogger)", "value": "bc9848f310857b3e0cd21acbc150a8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519678, "uuid": "9dcb93ab-b9c2-4551-8d88-97820482b289", "comment": "Malware payload (SnakeKeylogger)", "value": "7e9d0558a3bf15fdb322f635cc2dc0932788c0b216bb1ff6ed80f01bb25f0f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519678, "uuid": "466b6e7b-5f08-467e-a219-4c6feffe16f2", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc3aac960e58a39b754596641c5b03d8969b75f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519678, "uuid": "6d2b1cef-2c6b-42b7-a2d7-897cce0d3d61", "comment": "Malware payload (SnakeKeylogger)", "value": "8060ebc2d10f3ba0a76afd55ff6db2e035f0a4b2f9a64678f524f03009531ad046c93c4802e80ead8180f5167b43442c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519678, "uuid": "b46a7a79-6a51-41bb-b7ae-208e6e8340f8", "value": "T10DF4F044B1BB0B1BD5BA97F1850062351BBE5A9DBCB6E71B4EC7F4C61925F060AC0B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519678, "uuid": "0733ae1c-6ab5-4ce0-9968-00d32692b945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519678, "uuid": "38911c0c-5ce2-49b5-a401-981646b7efc7", "value": "12288:+52B0xTGlxNqvNu2hZ+nUEsn9WJeYfUGlQhr69YhBRGhPpvssWCvPcVM7Eu0T/o:+5LaVUH999WJeYscQhOezeFzvk27Eu0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519678, "uuid": "2ba81b04-6718-4d57-9c0d-9359475baacb", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519678, "uuid": "653facea-0c2d-426f-bbcd-cc4c997db9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519678, "uuid": "c7f3c666-64d5-439c-aa54-581229b20329", "value": "Factura N\u00b0 097.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4008e1e2-ff92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685523912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523912, "uuid": "f6f4d032-1b75-475a-820c-d3920137a1fb", "comment": "Malware payload (Gozi)", "value": "19a3ab3d29d7d235461da9851545b0cd", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523912, "uuid": "61b4f76f-81e5-41bd-8b46-b46ed296c1ea", "comment": "Malware payload (Gozi)", "value": "7ebfb70265761fe5b1a695c919705b61344c9d41d2e13f698b4481e0209c4301", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523912, "uuid": "a504c56d-6dbd-4db0-9af5-2cae9b36b5c2", "comment": "Malware payload (Gozi)", "value": "563f0304dd85f0ca1643e13af665b0bc6a214b1e", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523912, "uuid": "1524fd74-f1cc-477a-b900-114c0315338c", "comment": "Malware payload (Gozi)", "value": "b04e4aca11d3e8e64600304316004d33794934d05d66c1d1b0cf921ca93c22ea4c6b46703768a23ed53e5c84aa30548d", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523912, "uuid": "663e31c6-b1a1-48c9-828b-ad65ebb2d822", "value": "T165F1AFFC49F3168D8BA29D79CC50C13249F5DCC96AAE92A307B9F6F6B0981B118541CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523912, "uuid": "20efc60e-af47-44bf-b63b-e6b9ca786e43", "value": "192:m0rADn7UxS3WjQMIbQbPy9WuOeEm07K5k0P1:9rA77B3fbQLjACqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685523912, "uuid": "44b508f9-7805-4ac4-a40e-ee66a7b3f3b6", "value": 7565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685523912, "uuid": "bfe65fb8-99d5-4777-9765-1bff658e4b39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523912, "uuid": "3523af94-f710-4e02-9f57-a81c9e8183b9", "value": "Fattura_31_05_23.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1554fa-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685520877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520877, "uuid": "63b18a9c-57c9-4cf6-96bb-eb3ed0d05ffa", "comment": "Malware payload (Fabookie)", "value": "9492bd67e22ab8850d4462cbb99363f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520877, "uuid": "042b9df7-aa82-4943-a317-a99c2b0f33c1", "comment": "Malware payload (Fabookie)", "value": "7ec3ff2f2299d18405471617dc0644a8d63492ba3186061d5081f503fc05d968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520877, "uuid": "2ac812e6-d489-4628-80b9-4afd97216736", "comment": "Malware payload (Fabookie)", "value": "7b8c8ad159a392ad73931208d82f489358007f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520877, "uuid": "ed00f586-6fc4-462d-b7c8-0670a43f9c3c", "comment": "Malware payload (Fabookie)", "value": "90405ae69ecfa6d5530d4cc176d2aac8874f008f390f74f719db1dd90a608a8dc358ca8ee452c51f33f73750759a5815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520877, "uuid": "9331dc2b-44d1-4100-b53b-1910e08a1f30", "value": "T14A258009BE5E8080CC1156388976D775B7627CA81F2D86EBF197BF2E6F325949C39203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520877, "uuid": "135fb8d8-b02a-4c9d-bc8a-c7298fdb24fb", "value": "5f05d39b59280bd80ba38f718e2a78b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520877, "uuid": "3c5dac04-4781-45c5-b556-f7be5ac52302", "value": "12288:xSJc93ljBhGbZmdWh6dSsR1xsBwIwGR/nh/XgCLYXKPXPiXuHNH/b6bH/zx/:xSuheh437IwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520877, "uuid": "fa6262ca-c844-4c77-933c-7da0b6b90d86", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520877, "uuid": "a2827a28-efda-4cd5-8692-9325d15bd3a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520877, "uuid": "ea568920-0020-4923-904b-392af0424570", "value": "9492bd67e22ab8850d4462cbb99363f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7117084-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Metasploit)", "timestamp": 1685531950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531950, "uuid": "85934a87-3584-41fa-8f79-7ca5099fd188", "comment": "Malware payload (Metasploit)", "value": "080691ca482dc2d6006857922b89bcb4", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531950, "uuid": "555a7224-f41c-4b28-b57b-4dda2b34f46c", "comment": "Malware payload (Metasploit)", "value": "7f5b0d5a1a15c2fd6534803134d1995958ad487fc718b5ef54314c3a8de1724d", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531950, "uuid": "0e51f610-cfb9-4237-a911-a18fd4a41871", "comment": "Malware payload (Metasploit)", "value": "1d75197e97547b561a655c9f459d7b5ee312acf7", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531950, "uuid": "743681e3-7b27-4a60-8c2f-1f8809944bed", "comment": "Malware payload (Metasploit)", "value": "f3838da15d3206085d9f7edea1aa5b24efc292c5a84008a0c905c7208ea2086fe3818ecb5b7261884b8b3770eb6d6678", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531950, "uuid": "4222f5d5-10f4-46e7-bf56-ced6674f0467", "value": "T1255164243BAB6A5506C30467BDB7D0CA29229F7254D8AC00F1ECE5E5BF8F550C13A358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531950, "uuid": "b3f6a4c4-1314-4c30-bc0d-736ccb759371", "value": "48:xgG72R9tOpqj7vMZ/+zWIsfdG3gowx+ELgDVu0l5qFGz0l5qs1F0l5EZ0l5V:xgUYvvOmiCb4bLgD40l4FGz0l4Q0lCZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531950, "uuid": "705e713b-cad0-4814-b45d-8df35826d0e9", "value": 2989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531950, "uuid": "50caaed1-499d-4e5a-b5d6-4d6b42278435", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531950, "uuid": "7e12056e-e141-4e0a-bfd1-0f5573bb914f", "value": "04491599.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30be6c4a-ff8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522598, "uuid": "b6aa825a-bdb2-4329-8686-cd2dd210df6d", "comment": "Malware payload (Gafgyt)", "value": "383ef23d88774ae52d73efb05885106e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522598, "uuid": "05834292-3279-4b17-9a3a-5c0c5504bcb8", "comment": "Malware payload (Gafgyt)", "value": "7fb815179dabfbd7c81a9c97fea5b8bc41c14e539868af2ba70e5b3e869d39a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522598, "uuid": "4c93e206-9960-4fe5-8d89-1118dddb5fd9", "comment": "Malware payload (Gafgyt)", "value": "046de21049d919d3895b800434c8e5cabbe0d163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522598, "uuid": "822f0113-226f-4f99-b056-fd590eaa349a", "comment": "Malware payload (Gafgyt)", "value": "412cfcf42325e75c59904182f2a7bb7c0d61ec8a9137b7c74af8cc6c2a14386de2dd63ab4f38c8e40a90a18e28331c6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522598, "uuid": "9b6d58e2-2e06-454f-900a-d449a598788c", "value": "T113B318436B1C0B83C49B99B02DA737F18769BE7112A351C9A90BFEC04773AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522598, "uuid": "5a815664-f646-4b73-9c8f-4122224a7347", "value": "3072:eDzhqL0vbKlnvZ0pqu9eTqsFh7tm2pgYMidIP1W:eDzhqL0vbKdvWpqyeFFdtm2pgYMidIPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522598, "uuid": "61cc1635-5517-4756-aac3-4bde1c9b11e0", "value": 113186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522598, "uuid": "cacf5cc6-3732-4ba2-beee-b9263af5a73e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522598, "uuid": "70241842-73c5-4dcf-9f53-be2339c461af", "value": "383ef23d88774ae52d73efb05885106e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a6f5a1-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685511620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511620, "uuid": "5bca3c71-1c75-42e3-9cef-b8f7022298d5", "comment": "Malware payload (Loki)", "value": "7788af5a8c3b75f2ed179ec0a4baa162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511620, "uuid": "fc75ec52-d7fc-4404-afa6-b57d7d89192b", "comment": "Malware payload (Loki)", "value": "80f4803c1ae286005a64ad790ae2d9f7e8294c6e436b7c686bd91257efbaa1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511620, "uuid": "0bf0f5fa-b6ab-4210-8885-8959ffd1da67", "comment": "Malware payload (Loki)", "value": "5ab2b06e5c32c58cb02ad5b5681900bdd5ecc604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511620, "uuid": "9cd9710c-dad4-411f-b8eb-c64f95f6cb64", "comment": "Malware payload (Loki)", "value": "e657545c705a137a12da14e01511c2a5b7aed19e0818023f9d043436190e166906a9b6d2aa826f93dc951dbe26022ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511620, "uuid": "e4d44227-f117-4a25-b0b7-721f40519f92", "value": "T1EB152C153A5F221EF18CA975BF5535AE22162F239212C03103F7F76E627DC7A1CA43A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511620, "uuid": "2835bcd3-1e5e-4065-92f1-7a400ef481ee", "value": "b24370f0178612108b2f925af7d8bf9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511620, "uuid": "80d43dfe-837b-4b7d-9513-30ce4f9c781c", "value": "12288:i6sBglkYEIEPeZCSwX8Qz7OraG4E7afdhYWlvU1lDY++RvRJx:i6s+i78CSwt7LGb4IlDYTvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511620, "uuid": "f2d7652d-76df-41d4-871c-e8038e67918e", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511620, "uuid": "45429d6f-ce50-41ed-bdbc-6cefe36829e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511620, "uuid": "811d09e1-8741-4c50-9397-55dd5af85e49", "value": "7788af5a8c3b75f2ed179ec0a4baa162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379b5c84-ffb6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685539360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539360, "uuid": "79c0787c-746f-4047-96eb-c0de0b31ba1b", "comment": "Malware payload (AgentTesla)", "value": "b9510752e8831b20ca546c9c9d5dc791", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539360, "uuid": "b0c9d882-1c5c-469b-b982-01bca4873ec5", "comment": "Malware payload (AgentTesla)", "value": "84b007fa05a8254769962daa7fffecfa810cf65414f5c31134ad6b4f6ed0d85c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539360, "uuid": "4cdd9516-8c05-4dd7-a0d6-a592e9e656ad", "comment": "Malware payload (AgentTesla)", "value": "304d3a13935f5478bcbb6b134b7cd76401413c66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539360, "uuid": "5feaba4f-ce56-471f-9602-d587614cbd5e", "comment": "Malware payload (AgentTesla)", "value": "846dd40d35efd8085c1134bf24fe2804985ad48449a6c368e1843a3beba0c5be4c3558cf963102508695a4c7ee382301", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539360, "uuid": "80c43ce6-080b-41cf-8867-7b86882ef77f", "value": "T110E41256DB7F1B0FD1A6BEBE5F300070A5FDCA84A43ED1AAD447182FC8589356CD2262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539360, "uuid": "4d6211dc-c6a5-45d6-ac26-a76dd748f5c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539360, "uuid": "b341fbbd-82c3-457c-b675-cecce8431ca9", "value": "12288:UpAMTihh6xhZ6OrAvkNVOaLVN0sIm+Ye4uO1uOVogZP7yhga+IgI:5MUgh8yAUL0sIm04J4OVnDyhl+Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685539360, "uuid": "838a9593-df39-4fbf-8894-953b479ecf85", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685539360, "uuid": "f1cc51dc-ca71-4b8a-bf0e-36cf02b1b6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539360, "uuid": "d8f9165d-dcca-400e-8572-5e4b922b0cff", "value": "Original Documents Shipmen_01165362534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169b0b70-ffb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685540593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540593, "uuid": "d743a37e-08d8-4e4d-a898-7bccc79035b4", "comment": "Malware payload (Formbook)", "value": "916748a9540dfacbdb87f433a7af36b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540593, "uuid": "26286fcd-5331-4d43-8080-e602b2b1a624", "comment": "Malware payload (Formbook)", "value": "84e9e8ea9fce3a8af80e7afea6944d411447346206679ab696aa302648f6db37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540593, "uuid": "4ca0af42-a392-43db-8ee3-3cc982bdd018", "comment": "Malware payload (Formbook)", "value": "907df73d909c4f8791612ebdb884ac25e3f46c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540593, "uuid": "d7e87ad6-15e3-4e45-a0be-210a2f8db604", "comment": "Malware payload (Formbook)", "value": "c245919615f78190a50ed03721ce094bdd0010ca88b947f839dedc94df0bf945f84717564ba1e77668451ea7cbafbf21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540593, "uuid": "82e42484-d24e-478f-ab1f-7217b866f6bd", "value": "T1E905F15475BF1F2BD1BB53F4850063345BBE6698B872E71A8EDBF4DA6061F050A80B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540593, "uuid": "980cdf0f-806a-4773-bf58-8f1bf028c5f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540593, "uuid": "d08966ea-4e52-4550-a746-0cb4ca15e41d", "value": "24576:aDLaVUH999cNZYd2cjiKt3xTvtv8AEvE1:cBH98ZdcWKt5vtUAEvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685540593, "uuid": "b875d2db-b40e-4278-97b3-bd5976047f1e", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685540593, "uuid": "940a500e-21de-416a-bc97-8ba52ae3cb9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540593, "uuid": "5905138a-90b6-4b7f-b432-e882e0c4603b", "value": "Senwa 090344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b7170e-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533669, "uuid": "cc76ad74-1e39-4ea2-9ade-0bf250f4b87d", "comment": "Malware payload (SnakeKeylogger)", "value": "a0240460a569a2e87f0231f83031c929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533669, "uuid": "c44b07b3-295d-4830-8fcf-12855dc46b9d", "comment": "Malware payload (SnakeKeylogger)", "value": "8615169ad317d762db6aac611781bbfa7f96e977e3fcf2e5385a952c8b3a3bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533669, "uuid": "354e62b3-627c-4d86-b81d-5c0925b68e89", "comment": "Malware payload (SnakeKeylogger)", "value": "27acaaf3529a328380b08678cff025b5285206a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533669, "uuid": "a03faf76-0dc4-47d3-8fd4-177317aa071f", "comment": "Malware payload (SnakeKeylogger)", "value": "3e1b13da78faa73698b6452d575e07ab5ceb9496a8bc0f8a3896fab739ced26b8eaced60a79f7cdcfb68b3472f9fdad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533669, "uuid": "93b2820c-a4f4-40e0-9e5a-67cfe741f132", "value": "T1E9E4E165DE9E2E3FC97869BDA131803183ECE112446FE7898E12587FC44DBB96F92053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533669, "uuid": "8bc4a341-abd4-4adc-b2dd-465f9f853f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533669, "uuid": "c7e1c607-763e-42b0-86a1-20aae3398d55", "value": "12288:zJ7AMTihh6xhZ6Orz1XBZ5ZjR1OqpZfSEAYnbV/8TP4PZujiGc4q:KMUgh8yJHHjR1LflnbVUEP0jiGc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533669, "uuid": "6ca919cd-8b3f-4f4e-b7d3-a72e13ea148a", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533669, "uuid": "4fb9d56f-05a0-481c-8f44-6cd940cfa44f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533669, "uuid": "173cc5c1-76e9-4969-9847-c396acfc136b", "value": "7655678987656sk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae37765d-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533975, "uuid": "905d666a-f756-4284-9335-62f8bb0fe986", "comment": "Malware payload (Mirai)", "value": "6daabc936401426e0d7149d4509ae0c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533975, "uuid": "5e0b4762-3500-4552-ac39-d57f3fc06eb5", "comment": "Malware payload (Mirai)", "value": "8632550d42536a0a0bdec5657c79887db75dcc8a1682815d9af0c47480b42d85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533975, "uuid": "4fa8b582-4ef4-4515-b8ee-66d552446cbd", "comment": "Malware payload (Mirai)", "value": "da416c4b11af9aa901d2f7d2ee34a9c135cf50db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533975, "uuid": "7c03dff5-5648-44b6-b6cf-f696177e9df7", "comment": "Malware payload (Mirai)", "value": "26cc138b4455908f0093fea0323f237727e97d5c4f74d1452656747c1fa855d72839e4c735250b3705bcf35622ec5326", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533975, "uuid": "f3cafc62-cb69-4ef2-b038-96bd33629e06", "value": "T1F6632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533975, "uuid": "e714434f-5696-421b-83c2-b687108469e7", "value": "1536:lGBVg7AOotXhGIAsQ/VJAcQhQm75YH/tattV:lSCz5LeQmVNDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533975, "uuid": "7e109eed-93c2-4f37-a249-c3a08e66b965", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533975, "uuid": "502d3b24-a32b-45d5-9ff4-27ff99a5260a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533975, "uuid": "be62e05f-0079-4a9f-be5f-5fe959376e02", "value": "6daabc936401426e0d7149d4509ae0c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4509c0a1-ff7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685514042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514042, "uuid": "2371a53a-8b9f-458d-a8bf-f9234721a806", "comment": "Malware payload", "value": "42033ab4bbaa96e3454ee64250bd7caf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514042, "uuid": "100c30b5-f4ec-43dc-a1d6-5bcded2e8e6a", "comment": "Malware payload", "value": "86782fad55ddd9a12122810d4776f9105e5dae0d94b3bc1cc56f9d75eb4a9b2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514042, "uuid": "4d1a58d0-e2f9-4641-a56b-df8d533e6619", "comment": "Malware payload", "value": "0a65e0194af1d8e445361092f18929e2810c7a79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514042, "uuid": "34b01448-5a11-4a91-b75c-a79e1a502472", "comment": "Malware payload", "value": "3d5c277bf690897d2f61c2198f2275fdd77e394d5a1fe964dbf2e065c4b1f97ebcdb04f29bb4c711912f29e146b51c1b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514042, "uuid": "36724da4-5292-4b92-ae36-7b56c259bc0c", "value": "T14D836C00B6D2C472D5BE19350838C7A15B3EB911DEE19D6B27961A7E5F306C1DE30E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514042, "uuid": "74af591d-44e0-409b-b3c2-10ada86528b4", "value": "b2825d6c30ae1813fe238592de49acca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514042, "uuid": "34307847-784d-429d-b7ca-3dd7d94c0fd2", "value": "1536:JewzVr7ZXF84In4FhhK4HBHyYWe8D5wSA5tnzsWY0cdbpWqyOGr:wwzVBV8Rn4FhpBHEw/6bpWEGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685514042, "uuid": "17c38f9c-a111-4afa-9281-aa1a463c180d", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685514042, "uuid": "160e8c8b-8b83-4e3d-ac4b-c1117abfd71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514042, "uuid": "51259bf4-e9e5-4075-9d92-050a7504ab83", "value": "tbwghfoiiu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6a0275-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533897, "uuid": "7c36e632-f5b7-4d9d-9ace-d04ae7050039", "comment": "Malware payload (Mirai)", "value": "304cc5cc76b903d00f562b44e8ea2146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533897, "uuid": "d1db6502-73a5-46e8-be34-5f90897723a4", "comment": "Malware payload (Mirai)", "value": "86b0e2880ae663937fbf5e0ced175c2a603ab75742c4bf09a88cf41571ff9452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533897, "uuid": "89b8ac4a-4577-4bd7-97cb-be041f995c51", "comment": "Malware payload (Mirai)", "value": "0217818ae380e7428edf85b70cb5795c58e87d4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533897, "uuid": "ea11e47f-4969-4872-b4e6-477d384b1c78", "comment": "Malware payload (Mirai)", "value": "f944b2800f8129348b0f1baa203be8e5a971cb81e583e683907e76322f1bc1cc6d8304ab2352047491a182c5d15a6eda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533897, "uuid": "a545a6ce-44b1-4814-9f43-9f3f81016fa7", "value": "T118332A31B5624923C4D2593A12E7063AF5F28A8E5CF8873B7DD10F58FFA4A442193EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533897, "uuid": "2c8dd5e2-2519-4fe6-a7a1-35c6100e8401", "value": "768:L8fRFyblPS015Q+bN2UUf6hAPZO+75ezmsnc1tsI4:gfRQblPS0155cVB75eets/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533897, "uuid": "f9b192bc-b0aa-41cf-9132-29ac4facf377", "value": 51528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533897, "uuid": "ccf430ff-f339-42e0-8781-bdefae21c824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533897, "uuid": "63df13f6-fe9b-4a6f-90b2-10065f93b1d6", "value": "304cc5cc76b903d00f562b44e8ea2146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bd7f55-ff74-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685511042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511042, "uuid": "cfeccbe4-5921-4f78-a26b-41bc143b1485", "comment": "Malware payload", "value": "15d6c18e34ad68f0907981c8850ba29f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511042, "uuid": "808e054a-9d41-4d27-a4fc-6517c83d2b46", "comment": "Malware payload", "value": "897b636eb7188114365d0570dc7091c32086b092f4bb08d04572952db09b22bb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511042, "uuid": "5183217e-ec31-4be4-ba3d-d7b31295d2d1", "comment": "Malware payload", "value": "6b2b5090925f5538b57b0be8471081576fe6fdc3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511042, "uuid": "bf181687-d032-41fd-95fa-7198c1a823ab", "comment": "Malware payload", "value": "8c0ff25edd2e1b9c1fc366e776880c68d5c312ec100fd9d78e6d5e9a6f06fbcae6400daa17eb2c1dd07be232dff3f446", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511042, "uuid": "4555e5eb-0394-4e6d-b3e4-27e932723209", "value": "T165B22A565B8C4C61E26AE87B434E900E49FCF63230C255C5BDADE2707B7D10E1B6B2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511042, "uuid": "6a4c7e23-1f97-4657-a6f9-9ac6ec517d1e", "value": "768:L0//SBi9zpeAZyLuicwtxZPBif2kTUtq5EtmO5+uWB2oz04vHw:w/SBi9zpeAWrhP+iqSYuET0Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511042, "uuid": "af8c84f6-46ea-4e9d-92a2-34df619f8558", "value": 25300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511042, "uuid": "9762ce11-fc54-4597-9e34-1aeec1bc6f3c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511042, "uuid": "5f4d0ba0-5698-49fa-89cc-cdbf07321437", "value": "15d6c18e34ad68f0907981c8850ba29f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ad2864-ffcb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685548352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548352, "uuid": "fb803f33-112f-43f3-8516-4a1314404c49", "comment": "Malware payload", "value": "e1bfeb584f8839e62c45fc88821c4c6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548352, "uuid": "91baf312-3ea5-49fd-8234-f48cf425ed61", "comment": "Malware payload", "value": "8a796af675f7b7028257dff1c97f1010198c5802ebcda08fabea53d754e30e2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548352, "uuid": "237ee40c-e629-4f4e-b0f7-c90c5da94218", "comment": "Malware payload", "value": "feadd95e0495db60ecd474554be889a693a11567", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548352, "uuid": "d951c4c0-0e9e-4245-9e0a-18596eb8be6d", "comment": "Malware payload", "value": "d314ca06ad1379ce0ec36328fe47e48a97a7b902215d898bfdd31180f2801591078aed5d286fbb3dfdfebc3705d7bbd2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548352, "uuid": "f52e4f09-242e-4b7d-bbf1-5f535bf3e8b9", "value": "T19285235FF3CB1394E1967A752BCA6532FB03C18A31AB5327A2B4129FCA744A47F014D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548352, "uuid": "d31283a1-3348-4db7-afc6-24723c67c8ac", "value": "7478c874d7b2f9de14f3e84bb2758605", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548352, "uuid": "c08a2b89-d7d9-47a0-b35b-e28a5298117c", "value": "49152:ZwukcQh3tM2NqDm1L0gguNh/tOqaO6Zvpi:iDdptM2+mN7hOqUZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685548352, "uuid": "224f9d3f-d5a4-41a0-ae01-e362d52517a4", "value": 1853952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685548352, "uuid": "99e5b4a4-ecd6-41c2-aaff-1acb96d8e298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548352, "uuid": "6c5f2099-3be9-4766-a37f-dba88c1e6fd2", "value": "IntPrt32.dll.ensilo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f791641b-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685521643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521643, "uuid": "ca2e68d8-777c-4529-a425-fa908d2a3759", "comment": "Malware payload (SnakeKeylogger)", "value": "9e70755fa332d8cf4fdaf16845d53af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521643, "uuid": "4bc2b990-7fee-4489-94b7-d9a9daf47ecb", "comment": "Malware payload (SnakeKeylogger)", "value": "8ab395051b25a0711bdf0041c343d9a3de2a32b542ff3ee9aa1162c0e14ed28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521643, "uuid": "7be69ec5-3865-4987-8047-24ac245f8f01", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac4d97546e0b65bd4a7155dd554209ba29e00ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521643, "uuid": "e4d93856-4d59-4923-b7ac-baa39d91f676", "comment": "Malware payload (SnakeKeylogger)", "value": "bcef56f6622092f20114746424089702d9a4bda3656ba94a55ab9ff6fcfd6653d059c9de199428867042d7c2467f5e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521643, "uuid": "8dbd2811-9182-4e05-b6cd-bf2d93c83f17", "value": "T1AC251202BAC188B2D0661D761B79A721797DB9201FB9CEDF9790096EDA324C0D7317A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521643, "uuid": "80ba5e32-c175-4e41-85f9-1bcddb3504a2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521643, "uuid": "4174f70d-0bc0-46b3-a76c-88bfb5ac11c8", "value": "24576:NTbBv5rUan7Oq9evjU7syeVKN/5ivrWvg:HBj7Oq9eIgy0KN/5ivrig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521643, "uuid": "f121b45f-c271-4ba4-a463-ebbb78f57ac0", "value": 1054895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521643, "uuid": "229ddacd-3855-4d46-aa42-d4cf5077dab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521643, "uuid": "2c6c6f28-54ed-41b5-847e-47bde0ebdcb1", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6278b5f8-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519675, "uuid": "95923f9b-ef21-4ef0-87fe-2925ace87342", "comment": "Malware payload (SnakeKeylogger)", "value": "fbb366614239f4b8797ecb45710a1ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519675, "uuid": "c4e8ac26-ffd4-4592-b12a-03d3f4ec5e1c", "comment": "Malware payload (SnakeKeylogger)", "value": "8b3a7d6b4cb16bcc532547df7d2940c353484cf475800be7947e66f970d1d8e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519675, "uuid": "2bf51c81-90d4-46ee-940c-bfe713dcb9cd", "comment": "Malware payload (SnakeKeylogger)", "value": "c51430c6ad74cc6fdba610f34b38285809544afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519675, "uuid": "b6071164-6860-4e45-b356-5e7451f1d208", "comment": "Malware payload (SnakeKeylogger)", "value": "33988e4d09e9ba7739ab2035bf7a72399b2fcae24af68b338f1f9d508170e8d314a79f5ad32e289a8e765d51b08e6527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519675, "uuid": "46dc14d0-b2c2-472f-a469-3815bc7fed4d", "value": "T1DF256ED1F160899AD86B07F1AD2A653015E77E9C64B4C10C5E9EBB9726B3302209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519675, "uuid": "9cfdb6f5-8ccd-415d-b52e-92f13532c448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519675, "uuid": "14623e34-a48e-4bdc-b60b-60de3fe9ac8a", "value": "12288:/c2B0xTGlxNqvNu2hZ+nUEsn9t9zDbotxkjHJilcWOVsKNJJAawAJ97N:/cLaVUH999t9zOxkTJiuFVs8JSawA97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519675, "uuid": "05420957-ac03-4a7c-8e34-f412582efe0b", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519675, "uuid": "bf731042-c9cc-4ba7-9c96-076f96172517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519675, "uuid": "5c69d34c-5e65-4a2e-a69a-787fbe7f7844", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e15f725-ff8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522593, "uuid": "eae0d062-7c5a-4d28-98e4-41e80eeb32b7", "comment": "Malware payload (Gafgyt)", "value": "1fe12e33cde61a11dd7945fc825da200", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522593, "uuid": "4480658b-c962-4d6b-b0bd-63b8fcd146f4", "comment": "Malware payload (Gafgyt)", "value": "8b9ab5656dd4f7a7b75c6e030ec6048c7f85a20c41272ab0ed630fdfa1d3c728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522593, "uuid": "b6a6548c-8672-4172-9e6c-ea614feba48d", "comment": "Malware payload (Gafgyt)", "value": "7f9b1702d228ff9600b5ec09cb1fd9697796ce64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522593, "uuid": "cf6f3b46-2e13-4037-b336-8bcb56a01fa4", "comment": "Malware payload (Gafgyt)", "value": "85b0a6d3bb840ff9c12bcb296929e01b89e9b7c077c09a530c1ce64f024387107a19caed28938adb5a47dbc0a9b753ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522593, "uuid": "5b5aa3c9-9ab4-4d94-9652-d734e75bd26e", "value": "T1A6E39366BB619EB7D80FCE7309AA4501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522593, "uuid": "8b2d9a4b-de31-455d-93bc-9b4cb386ab02", "value": "1536:LVeTVe4SsruJwYx0O9vPBysZgvsgxqAz/0ufMytVCpLfaMLAImlP+s4zWfOodW:LHYuJRBx+sK/PflgSImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522593, "uuid": "15925a4d-d2a3-4917-8c61-8d76b01e4573", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522593, "uuid": "ae1c89ac-09d1-4b86-8935-5941c2b607eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522593, "uuid": "3bb445b3-ed79-4d10-a7ff-3b927e895b6a", "value": "1fe12e33cde61a11dd7945fc825da200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd93f27-ffce-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685549972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549972, "uuid": "8de655a5-934e-4bb7-8386-37bdf50e7a1f", "comment": "Malware payload", "value": "d73eb6c6aa36e59dbff42880b608ce2d", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549972, "uuid": "091073ff-831a-4771-af90-e18b1acf7213", "comment": "Malware payload", "value": "8c2765a49347c4f7d2e03ff5a53465ba8405c803acf9ba46083ab3290757fc32", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549972, "uuid": "37a6f7b1-9065-4136-a1d2-7e95c6b0dd15", "comment": "Malware payload", "value": "d2b8be490bd8d2652318c16af0c412ad8af46ce4", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685549972, "uuid": "2a4e3715-6c90-4145-90e7-0b078f958e89", "comment": "Malware payload", "value": "e5f7ad9becacd197a8ef81dee9e0286a26518b522ade5bef4849c2f61cd7e49a90d56c4c009e57ac0267cb12191df32c", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549972, "uuid": "d52813ad-f80a-4e89-8f45-6a327cc04319", "value": "T1BA11DDF66B6E5012C9B1CB520D47925ECF6041A294C00B11B8FD0A70EE3A166A35EFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549972, "uuid": "8ba59404-f522-4152-931d-7e454b083097", "value": "24:KOVtyCiVv/YsFTxnswvpdPNuR71q2z8JAh/:KOVtyCiVvAsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685549972, "uuid": "85dd7fff-3c79-46bb-a5e1-4e8c38ea7325", "value": 1071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685549972, "uuid": "7fd82fdf-b47c-471f-a7a5-abbe904c044b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685549972, "uuid": "729d08d5-8928-4a45-a822-363670adeb48", "value": "cxJMmeat.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c767d37-ffb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685540683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540683, "uuid": "7c2e7cc3-bdda-487f-b907-7aa327c8168e", "comment": "Malware payload (AgentTesla)", "value": "cbeb30effc9cb0910930c82bfda6c703", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540683, "uuid": "a85be624-9978-4b55-9aac-281a4e3211cb", "comment": "Malware payload (AgentTesla)", "value": "8c539e1072fc6c04a615f7103cd36ca83c9d5963224a0dc55e900511de0438e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540683, "uuid": "1353d6c5-6a6f-4ec6-88dc-f499b825182d", "comment": "Malware payload (AgentTesla)", "value": "78f03c6f73f7d807b5906024ce9c1bb267fb9b61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685540683, "uuid": "082601a7-9e3c-442f-abbf-1c0e22877755", "comment": "Malware payload (AgentTesla)", "value": "9ece70935617b05bc1ec5eecbced136b7d9403f575f7270716e010d51a8672a0261da0388bbbedb17868a026806e2991", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540683, "uuid": "84fac44a-a0ad-4335-b75f-33e2ef8644aa", "value": "T129E41216EE7F5A0BC1A6BDFC1B308070EAEDD984842FD69FE956482FCC58A746CC1521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540683, "uuid": "62315deb-9c9f-4b21-90fa-f03878c485bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540683, "uuid": "d699b9b5-aee1-4d02-b067-6b39797111f8", "value": "12288:LAAMTihh6xhZ6OrRm1nISqJX++sOw+t24CICbSQQayugP9HHwqNTr:XMUgh8yRcISqlnVkbuugVQyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685540683, "uuid": "9d1d91af-3d06-4f9d-8333-d0b8e4a49f3d", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685540683, "uuid": "d1bea34d-df8f-46c4-b7f5-fafa677ebf54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685540683, "uuid": "870d8459-423c-4250-9d98-f485384e21c5", "value": "PAYMENT DATAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb09b7b5-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685533138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533138, "uuid": "4c578fa9-9bc5-4c1d-b92d-5d1f0cc759d8", "comment": "Malware payload (AgentTesla)", "value": "0aba28565d2837678e42bb32d33b2c73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533138, "uuid": "068c0569-336e-4323-9a17-ac966776edc1", "comment": "Malware payload (AgentTesla)", "value": "8c9234c1aa5f8a1bd6a17e41010db2da379729599935d315504ff1892f5bf643", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533138, "uuid": "7a218280-feaa-4c74-8dce-7105b68b3743", "comment": "Malware payload (AgentTesla)", "value": "20840c8382372d891bf6525c99f3303bfc48ff4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533138, "uuid": "cfd71dba-aa77-4323-9057-aa7f22867ca0", "comment": "Malware payload (AgentTesla)", "value": "d3b96c7a56ba733b754ec643963d314029aba063abc1910eec8654f47d981655e96a3b7a996342568b09be304b01c6ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533138, "uuid": "99f012a8-7e26-4d3a-872f-49e19c1f9891", "value": "T19355F1289BBE062DD97F7BBD6570503053FDD5015827C3ADAB0A38BECC2AF309A51166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533138, "uuid": "94f38e6f-bc56-4913-a643-a12b53231572", "value": "12288:WfXxAMTihh6xhZ6OrPyz+pBfC2c6lms555HS9vy9ApTV38EoGbk1dp3bx:dMUgh8yTzfhcykAsZ3Rzk1d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533138, "uuid": "aff96775-5c90-4363-a4f7-3115d947d648", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533138, "uuid": "0f3fc4e4-3569-4fb7-a7b8-3da41b8d8c11", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533138, "uuid": "c02025ac-6422-4fb4-a8bd-e3199f2937b7", "value": "RFQX60000178910.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d515e7b0-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685533611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533611, "uuid": "6c7a8cee-3eac-44aa-a416-6cc6d9431e7c", "comment": "Malware payload (GCleaner)", "value": "0c83a2426fabfcced5fb20e35eb18a3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533611, "uuid": "c1c58183-611e-4eb4-b7c7-8b2f99a65f3e", "comment": "Malware payload (GCleaner)", "value": "8e8020159506b5046d98e828d9a1a196d3c0874f34f75cf9e3f5992c7053bc3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533611, "uuid": "ed850d3f-2771-4dd4-b213-c71addcb786f", "comment": "Malware payload (GCleaner)", "value": "de9b81811f01ec15f28874a558e767d2cd805cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533611, "uuid": "35edf2ad-8785-4e2b-8262-5e888ea49e63", "comment": "Malware payload (GCleaner)", "value": "16175ca5e7768a4057b51ec0d964393af25c66e6467c4a79fea239f8a5c1f2f48307c538fb34b830e4dac3dff5d0fb15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533611, "uuid": "610dec56-0655-4a8c-803a-607a49d2b030", "value": "T1F874CF2373D16831EA261A715E2AC7B8662FF4704F656BDB639C5B2F0E711E2C632305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533611, "uuid": "6885f8d9-5737-4af9-83a6-ca04f4369256", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533611, "uuid": "b8e7ddbd-300a-48ba-a50c-705e16b92e66", "value": "6144:pBJ6K2eye0H4R0x9dXsCUX+bxbvFofMOyKmgWPCV5FO86:pZ2eye0Tx7Xs7ONKfMOy1k5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533611, "uuid": "49afc4ff-2e40-44bb-9f1d-22e3928cb7fc", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533611, "uuid": "6f15a4da-d41d-4473-8ffe-7263d4095f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533611, "uuid": "cf1481a9-1e13-49be-8fba-38afe4096202", "value": "0c83a2426fabfcced5fb20e35eb18a3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b03431c-ffb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685538855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538855, "uuid": "19438628-1db3-4cfa-98ce-b7839b9c4421", "comment": "Malware payload (AgentTesla)", "value": "78443c88f20906f05517923998a05d87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538855, "uuid": "7473a616-27d6-4a39-a0d0-995899ce4f95", "comment": "Malware payload (AgentTesla)", "value": "905491ddc53af3036d1c6a61dd010ab242b5ac40d093a77eb5c3b9f1be83333a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538855, "uuid": "369892ed-9391-4b7b-86dd-6bdbe9ed5bad", "comment": "Malware payload (AgentTesla)", "value": "dfa838506964fd8439e3a909f9aef4a48e1f85a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685538855, "uuid": "b5247634-2569-4ae1-a582-9363f8db92ab", "comment": "Malware payload (AgentTesla)", "value": "67df81c09777b215e576966a898ef759287ab98a2def3aec0f598360404aee43d97f35c02c28f601e6aef6f283e28bf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538855, "uuid": "fdc58935-9136-465d-89d9-d43a6b7eb96d", "value": "T1CFF401299BBE061EC9BB7B7DA574503053FCC5041823D75D5B4238BBEC2AF30AD621A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538855, "uuid": "05939f36-5d8d-407a-bef1-605abe51c88d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538855, "uuid": "d24dc852-39ef-40cf-a859-5fc09f8a5396", "value": "12288:6fopAMTihh6xhZ6OriJ3UvXhiL3HW+e4QOlpnR3vdqq5ahXP/wl11Tame7KfGj:jKMUgh8yiOv+BerOllBdqCuwl/+9K+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685538855, "uuid": "ed832b02-e621-44be-9cfb-dc13d185282e", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685538855, "uuid": "579bd85d-d0d9-45f3-a8f9-ee4e68e594fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685538855, "uuid": "116b9a21-4217-4d15-83c7-1b4a062a1c21", "value": "Packing List and BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac40c3c4-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1685511638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511638, "uuid": "c90c7636-1367-49ec-b502-d664ec126a9e", "comment": "Malware payload (NetSupport)", "value": "2c13cec20e08ff1564152af254da4cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511638, "uuid": "2972bbae-ba2b-411c-b585-df7ec1960a1f", "comment": "Malware payload (NetSupport)", "value": "918df3483605d66cdd9a1abf3df845cffc2ed38436bfbe4b7f9b9eb748e1b573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511638, "uuid": "dc48505e-1177-4421-8aac-fc525c595a9f", "comment": "Malware payload (NetSupport)", "value": "f05e11dcc62727cabc8948b1da73ab5d24efb1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511638, "uuid": "396b3673-e070-4a47-a0ed-418d4685f7b4", "comment": "Malware payload (NetSupport)", "value": "eaeb85b02bbc81d4d7c72f400cbe675e6e4067f84439ce2baf10083a916e18f2d1e0f990c594e5eb502df41116ac2ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511638, "uuid": "7042e2fc-7e9c-4055-9a70-2780036dd0d2", "value": "T13B07333FF1A8A53ED96A063205B38650997BBB2079168C0E47FC354DCF729701E3BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511638, "uuid": "b222f6ad-f121-4c67-9c20-7be4ef9f32ba", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511638, "uuid": "adba1d8d-420a-492e-b546-58abf2f84b01", "value": "196608:uY+ffboZh39AL4yV4Ksd1taqFOZvA87ZyAXX1v9bYMs9nVNNN7nYMvsrigt3p1kg:uoZrNo+1t7FQh7cAXXEV7RYqOgPHUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511638, "uuid": "2c3b9392-45e7-48f2-971b-61beb9a35c95", "value": 17418960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511638, "uuid": "aeda8a69-7996-4293-9aa4-2eeb5f02bccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511638, "uuid": "02a179d9-3151-4e1f-849d-fc0211a7bfed", "value": "2c13cec20e08ff1564152af254da4cee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e46d58-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685519873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519873, "uuid": "ba2b51f0-19eb-4042-9387-8de4e6e57ea3", "comment": "Malware payload (AgentTesla)", "value": "211e6002d69560d311f90715736f76d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519873, "uuid": "ea7cdb3f-81cc-4d18-a881-099bffb695a0", "comment": "Malware payload (AgentTesla)", "value": "91cf5e5060f254905b48d517addd966c3f43454de14c376e8cb3b45fbd3058c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519873, "uuid": "bf12fe87-05cf-4d59-adae-35f16a051a90", "comment": "Malware payload (AgentTesla)", "value": "98cb9639a3d5a0faee4ceaa4fe2cbdca8f8d31f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519873, "uuid": "9470726e-8fd2-4653-ad6f-6b6025bc20f7", "comment": "Malware payload (AgentTesla)", "value": "45dea198047b6f89a88675056b825853a78e94a7777cef25c8fbca13b2621716f7b1601d121b3026e767c2ad467db336", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519873, "uuid": "9bb1b5a4-d553-4721-abe5-798130b7f839", "value": "T1BE13D601B2CACA1BF22659324DD3C6D57738BD199E46D30B32847F2EBCB46708E26781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519873, "uuid": "8ae13e30-e2df-4af9-b932-70efb628e7da", "value": "384:TdrF3nfkolOCnC3p2MyM1Z5gB8iSwvxjk+tJm/Ortde1UV6Deop9myVG+50jigVn:hx3MoltC3d1Z54xw+tAz1UV6DPhL+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519873, "uuid": "e4421aa6-504f-4d90-9604-5ec49c4577fd", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519873, "uuid": "ab94b06c-104b-4b57-aca2-7493f877a785", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519873, "uuid": "ec044ef6-9092-4a69-867d-115a61dfaf6e", "value": "Telex_Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee0103f-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685519534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519534, "uuid": "46c415bf-cc2a-44e9-a19f-dbdade9f0a40", "comment": "Malware payload (Formbook)", "value": "f264efd6aa94d6eef7fb7c717124d1c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519534, "uuid": "d24dadb0-23d9-4efb-bdb8-57a2a991ba77", "comment": "Malware payload (Formbook)", "value": "92814573275c2578716e36854e2a8caca2be8e761b8dbecc3adb981d8ec656d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519534, "uuid": "879ae98d-4bd9-4b9f-b93e-4675e14c8451", "comment": "Malware payload (Formbook)", "value": "3125ac55e1979b14e1a9a24223fd231c802fe769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519534, "uuid": "15e7e41b-1cee-4863-a475-d21bc559b9f5", "comment": "Malware payload (Formbook)", "value": "245bb02f95b80ed9ffb055ce1eee0a94d57fb9112aadb0872bfafba65761be43fa2e4cfd72126f543d17a0cb7430bf62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519534, "uuid": "6a1e3f6e-5db2-452e-9c78-a28b6f9ffb17", "value": "T1FCF41296FF3F160BD466BDBD0A7040B0A6EDC681943EE5EFEA87482FCC096346C91521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519534, "uuid": "aab97025-4ec1-4ac3-b37e-4c6754eebf0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519534, "uuid": "e67cde73-ba23-4f36-925d-08e962690a12", "value": "12288:i6AMTihh6xhZ6Orxx3cJeoloTdbvZQlfSo2OxGLLQSvFV3+7lmDI:cMUgh8yxyJeoCJrZQlfSoaPHzRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519534, "uuid": "aab67e13-6a0a-4add-a87a-a3442a6747fe", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519534, "uuid": "64d91329-be78-40ad-a108-ce73dfc8e954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519534, "uuid": "333cc266-12cb-4368-8b20-b231d46b7d36", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2b87e0-ff80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685516387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685516387, "uuid": "3fe590e6-488c-4136-b15a-fba05732859b", "comment": "Malware payload (Fabookie)", "value": "014b9db957bdbafe8a48ec5cd4004f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685516387, "uuid": "ca635351-c7cd-4cbc-9cbd-508e323d61d3", "comment": "Malware payload (Fabookie)", "value": "92f4134cc013553a811aa371570d7e2e66a2537b4eac3dbdeaf0cb5f02e6ec56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685516387, "uuid": "bfbf5ef4-21b1-4d89-8c0a-bd9fc1d04fc0", "comment": "Malware payload (Fabookie)", "value": "44ba905cfb83b80bda92553e378eb4600acbea91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685516387, "uuid": "06f25814-2298-45a5-82bf-8b78047c3bfa", "comment": "Malware payload (Fabookie)", "value": "f8b2dcdfb9143bd18e9aa85031187cc48150cb9354318b7b51125987e757f0b1938ed6fbbb2c6a37dcd47fc2ea8eef8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685516387, "uuid": "69f07d2b-45cf-4c05-904f-0671c9475080", "value": "T109367DA95BAFE119F48BD1337F107FBE4183DDA8769D0224C080925C2B4BB497B959CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685516387, "uuid": "0c691f4e-0a43-4018-acc2-80057bda528e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685516387, "uuid": "09790d11-0769-407f-9d18-6a3f1bde5566", "value": "98304:MdBY9slh4DJF1QWHc5ymiJA7MNMrL3HW4PD25u:MdBYh+WaaSrLD78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685516387, "uuid": "7400c580-305a-4f65-8c14-1db4a77484a1", "value": 5128704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685516387, "uuid": "38c6fde7-77b1-40d0-b356-b7a42664a3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685516387, "uuid": "f8ce29b0-8291-4591-ab3f-c82598b6a5cf", "value": "014b9db957bdbafe8a48ec5cd4004f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad99d458-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685511640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511640, "uuid": "4402637b-58b1-480f-b9e3-542184c90ad5", "comment": "Malware payload (Loki)", "value": "5b93bedbd6f950ade1e8cd4bc0b35dfb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511640, "uuid": "ef4a8255-b57d-46d4-9287-0b4c61649cea", "comment": "Malware payload (Loki)", "value": "93bb44112e3ffe77fb9d89390095cbbc4b4697f0a83770d846bcfa1a7abb01ef", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511640, "uuid": "ef59e6d3-4c7d-4bfe-8de3-85d4259a1050", "comment": "Malware payload (Loki)", "value": "620cbfc1bc48fb434b91b3c463d82ba6ad61eff0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511640, "uuid": "318013d4-e391-4683-84f2-1bf05914b0a6", "comment": "Malware payload (Loki)", "value": "f5000fae2ce7b747a53900ba5e6a8ecaf54799eaf1302bff061a92b6fefbc43894f7082709e7416c2769fc7b3781d773", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511640, "uuid": "16b986d4-8145-4ad1-8141-03b1584eeb94", "value": "T11A451815BBCE1049F2F15F0206FD3099AFAF7692897D988D218C525B1BABF41ED11B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511640, "uuid": "9b0b1456-98be-48ad-a848-4dcf0f9f9d95", "value": "3072:8GRfGmwfkYFEhNe4VTdRnTT8w4TWatDZ4aFDfPPUj0Z2gVoqGdrQTGzpfsTRired://wfkYFfFZqXqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511640, "uuid": "18b90c07-bc3e-4785-8e35-fd5de26c9a57", "value": 1176410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511640, "uuid": "786e4922-e6d9-4723-bf03-1d5cec0a8850", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511640, "uuid": "d32f97f9-2242-47f3-860c-9512a9f9b567", "value": "docfacturas vencidas y datos bancarios.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5166cc-ff56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685498458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498458, "uuid": "ff856e67-055f-4c5a-8512-5bf8e940dff5", "comment": "Malware payload (Stop)", "value": "561bd76cefe9b3429eeaa2aec1bcc96f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498458, "uuid": "5848e2e4-02cd-41ee-8706-f6c1b5c85d86", "comment": "Malware payload (Stop)", "value": "959218473693d550912d906d2fc3d09f98c2a19dc7e5a09a09fb932c7fa25c3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498458, "uuid": "8e487047-d073-4497-b7de-e6c0ab212a93", "comment": "Malware payload (Stop)", "value": "a47fa3e39780b470c5687d9460214d0f1ec462a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498458, "uuid": "031f03e4-e7b5-4d8a-9e75-a2bd152e4d84", "comment": "Malware payload (Stop)", "value": "c3ee82ce26a9457e248dc96166b8c59fe5143ab6cdb850c0aa721d67e3010b0c8394c5f178e9bfedd9eb75a44ea1349b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498458, "uuid": "4fc6c75c-8ad7-47e6-af72-a2747fc14e2e", "value": "T1DBF412207AE0C0B1DABB56744C70DB24AF77F826AB354A5F3358165E1F71AE18A36313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498458, "uuid": "df8f8258-63ae-45a1-aaf4-e900691a5419", "value": "27113c217d53f26eb8f070c56bd3d296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498458, "uuid": "9d41b271-7f91-4fed-a1a8-c4db2aae9a87", "value": "12288:mcA1hzdBizfbSM6JF7ezvn37TSMKdw3cGVzpVEcBm9eA4Nw:nwizzSVw3PSMKG3H9VFBm9eA4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498458, "uuid": "53deabf7-1d10-44c2-b74e-7a7e22e55854", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498458, "uuid": "c4550c29-0508-4016-92c8-c92c8571a8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498458, "uuid": "d072c445-e712-40ba-bd97-3f1b7e232d88", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60af63d-ff6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685508272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508272, "uuid": "e07856b4-74e7-4235-aebe-e4bf06f28a54", "comment": "Malware payload (Loki)", "value": "506c7276a56ad45ffe3845e55849e013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508272, "uuid": "58c54601-3f4f-4359-b098-bf510de23fc9", "comment": "Malware payload (Loki)", "value": "95a8c444e633f4e71a0b5816fab61e05a3dd93ae3b27b98dfbde7ad3b8572f80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508272, "uuid": "e7b19daf-8406-4982-b83e-20cc48e66a8d", "comment": "Malware payload (Loki)", "value": "c65abb3367084598055c867526d436c95668cd9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508272, "uuid": "b9caade6-d181-47e8-8a3b-2c0ce4d049a5", "comment": "Malware payload (Loki)", "value": "d2c7ec9a804707518c077d47601599d4a73f9cba81c057e309fc1f2a292a04ce8375722c5eb25e850d05e9125cf995f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508272, "uuid": "a4d978b5-e406-465c-8fc1-3d3572aba153", "value": "T101D4125422B78B2BC57F5BFE60712DB403FAA78A7A01E7420DC370E95B5BB440E85947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508272, "uuid": "940d5c6d-92f9-47c8-8c54-11b1bb91ac71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508272, "uuid": "45e8e41a-e196-416e-8122-62381e767a80", "value": "12288:AHkmFx2iqNhujGjUTpPkwvSi5+h1llZWTWykBODYT5I5gGf7Vo:AEmFxUap85im1lXbG5Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685508272, "uuid": "305aba47-c65d-4591-98ac-4a07e7f1142e", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685508272, "uuid": "3cc2b0d8-5d27-420d-b5b3-e2428c674826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508272, "uuid": "4773d917-269f-475f-a4df-f31f22eda340", "value": "506c7276a56ad45ffe3845e55849e013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578e8c0b-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520945, "uuid": "8fcb567d-41b7-474d-a64a-9b717fd3f766", "comment": "Malware payload (Loki)", "value": "f1e5a2bbd370d257c561ba6696165e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520945, "uuid": "0044dd7d-f07f-4b97-8d08-fefa2e51d4e8", "comment": "Malware payload (Loki)", "value": "95b8e0bead7a576cc494ab4f34737a966d60abf551dae5e68c44a3be895c4913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520945, "uuid": "2aec7d8c-5325-4619-aa03-6280ae394b07", "comment": "Malware payload (Loki)", "value": "763ddd437f8753b1e36dd7a0f3f9eadafdbbe52f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520945, "uuid": "4e2a65dd-812a-444c-aa49-8915be4ba182", "comment": "Malware payload (Loki)", "value": "9a549bc8980abe681bdab698013fd9d1b3e78756d9bae0f4654aed17a576fa776232414379c6194b4ede729c91a27da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520945, "uuid": "1f9eed90-36c5-4d89-a899-bd0c3a9facd8", "value": "T1A925F00062BB8F6BD8BB5BF60251523087FA6AA9743AE3558FC361CF1175F400E16B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520945, "uuid": "cf558445-7d4e-4f1b-8d70-63dbcca90257", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520945, "uuid": "8a05c2a7-765a-4e68-9290-4a0ee54c0430", "value": "24576:1geLaVUH999kDSMppARIWh5ECJhEW5fht4Y86o:S4BH9IgZ5fJOWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520945, "uuid": "9c4ae391-fb00-49ff-b4a5-5b060129a36d", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520945, "uuid": "b0c264c9-9ff2-4643-95e9-dc766e7ad3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520945, "uuid": "d1eb49b2-28a5-4867-9001-617d2e564c45", "value": "f1e5a2bbd370d257c561ba6696165e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c887f-ffaf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685536508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536508, "uuid": "d26a4240-73b3-402e-9de7-b570fd47963f", "comment": "Malware payload (RedLineStealer)", "value": "0b07b38bb503bcea4383da9810b05a20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536508, "uuid": "4c65f00a-368c-4f8e-a866-9923ace5d876", "comment": "Malware payload (RedLineStealer)", "value": "95bcca42a36dba1496c90a8e70a2ce365ea6440ecc015c33c6101476b591392c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536508, "uuid": "f949bcd2-7a4c-40d4-b644-8a24e2fe6421", "comment": "Malware payload (RedLineStealer)", "value": "4c40fb4a9b77196d71dac264e09db7c8ea7c57f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536508, "uuid": "bc1b75e7-78cc-4a72-8abb-a54a683d78f7", "comment": "Malware payload (RedLineStealer)", "value": "a4de911e1ccd303046c8d90d513f2b97145f45d8604c8b2a6abf3ca6c160832ae75bda76bd9986e377c283bf8f3791ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536508, "uuid": "1539e554-919e-4503-aaec-5e543f9da9d2", "value": "T1FAF42213F3E88873E5B6637054FA03930B3ABC515CB5CB5B629589AA1873AC164B533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536508, "uuid": "434fce3b-628f-4f6d-ba65-9545b79cdcb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536508, "uuid": "90cc606f-2f85-4e80-a864-055c468dd070", "value": "12288:3MrEy90o+P3HiILygKaaENRp1Uf/SZ+n8LN4I/aHfhwWsskRO8gM7m4hgwi:Tyvo3/L1KORWaZ0e4I/a2Wxk4NolDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685536508, "uuid": "4c90b76b-1b8d-4e73-a5e8-800cee996823", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685536508, "uuid": "bc811e1a-951b-4731-a214-a8fb48dc090e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536508, "uuid": "8c0679b9-d6de-4275-ad06-ee68cf0f0c23", "value": "0b07b38bb503bcea4383da9810b05a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8444f5a-ffc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685547790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685547790, "uuid": "3be6a69c-e78c-45a3-9f34-7d7fd1535024", "comment": "Malware payload", "value": "e5c16e5fb03f43e3108aecd2b3854d40", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685547790, "uuid": "87d807b4-d0a4-4ff8-8bf3-8f6384e7cfe1", "comment": "Malware payload", "value": "970b33ef34cda002f3673f0aab7da9cac22bedba16ff5535d9a55259de6c8138", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685547790, "uuid": "3d3632f0-207a-47a7-ba9b-5285c91dba4b", "comment": "Malware payload", "value": "f11eff73473885f4a8bbf1746f1dcd1146394ae9", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685547790, "uuid": "24248be5-4a75-4d1b-bd95-74bd0b197e41", "comment": "Malware payload", "value": "1c35096a4edb20d7912e2c67324f8555c153ed242440f5e41c393f3bf504d8c661103ec6422069b7debefb67fc626094", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685547790, "uuid": "f9f71130-0852-4f04-bcd3-ce70885ac832", "value": "T10E11BBFA6F1E9012C9B1CB420D47965ECF6491A294C00704F4FD4E709E39123A34FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685547790, "uuid": "face1877-fc47-4784-9674-da7599cf7ef7", "value": "24:DOVtyCi0Zy3sFTxnswvpdPNuR71q2z8JAh/:DOVtyCir3sFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685547790, "uuid": "bd0b7506-f49e-4e53-9bdf-1d1bf89e0a77", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685547790, "uuid": "9c4bdbd0-3a74-4f3b-a2ac-a312b717d27e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685547790, "uuid": "363fea36-aed0-408b-8f72-6540c57d8ff4", "value": "asx5NXyu.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c42ed7b-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533918, "uuid": "eb95f41b-c2ff-4c66-8281-afe782876a60", "comment": "Malware payload (Mirai)", "value": "aef74fad539f7d150bc3b9f5f8efb84c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533918, "uuid": "6742c6ae-8e02-494c-98ba-11bfabfbf0d4", "comment": "Malware payload (Mirai)", "value": "979fcaae7b6491ff16915ae3a5b6eb06251ca8e867f00324f5a12628a7107f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533918, "uuid": "2bd40df2-25a6-4126-9038-5671a49a2a61", "comment": "Malware payload (Mirai)", "value": "b3c9d288fe7b6d97d86cc6e49239f8db33644683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533918, "uuid": "fbe4fbce-8230-45f6-b0a4-7a405f2caab8", "comment": "Malware payload (Mirai)", "value": "bf62a057eddc268b246020913f88a0e66e122f110b044886793e7c9a3e72cf760e27ad9f63ed4b87ddc338ff5ff0dbc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533918, "uuid": "24bf7245-850c-4e0e-b086-61c35ef17368", "value": "T173730856B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533918, "uuid": "ac808d4e-882b-4309-af27-bbb3a9b7823d", "value": "1536:2ln25xPBXk1wnnkL7+KEw073HdEya6t0bIeiNNfsvHTGcV5GYIW43:7xpXCMkMThza4NfsvHqcVER1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533918, "uuid": "4a13f964-71b8-4bba-b1b4-514468ba7b91", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533918, "uuid": "4eac7214-b4cd-4e1f-9807-b5846c5721c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533918, "uuid": "034a3bd8-0fd6-4d0f-b2dc-b7115c3054b3", "value": "aef74fad539f7d150bc3b9f5f8efb84c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db0e705-ff97-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1685526029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526029, "uuid": "73362bba-2cef-450c-8f73-6bd60d37fa8f", "comment": "Malware payload (RemoteManipulator)", "value": "a8fffe1256732a78425b3c4b81c00c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526029, "uuid": "80f6fbf5-43fb-4f9d-8717-15dc60231c18", "comment": "Malware payload (RemoteManipulator)", "value": "97ff84a22b9ae106c9c6d6893575360411773f084d600ae3ae21bec7b26a4c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526029, "uuid": "142edad2-cec0-454e-80a6-f41d7d5e1a7a", "comment": "Malware payload (RemoteManipulator)", "value": "d10eb0b29b6f0f0092cda88bb03ac91e42ecf25e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526029, "uuid": "9944c476-a5fe-4499-8029-1c4299ea2918", "comment": "Malware payload (RemoteManipulator)", "value": "aa2b50b7753a062e48085c4d4474e5d350f0c51d78832970a0253d266540c59fee0c21585131f932b6e980d029070519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526029, "uuid": "54c4c4d2-56a1-40fe-a36d-91ecd81533fe", "value": "T11F56124A73A4419DFFA7E1B7CA23C607D6B178460273961F06E49B762E33731662E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526029, "uuid": "78ac660f-6c0a-4deb-8830-ca4de0cb7198", "value": "fadc5a257419d2541a6b13dfb5e311e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526029, "uuid": "8daf6efe-1894-417d-85ba-aed6885af8af", "value": "196608:TIlF6JaxBEvXUJyXEJDNfZJoExr77dZWoNMUyr:EcYxBYXY+sJokFZWdUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685526029, "uuid": "603de91f-23bb-441f-8efb-69fc5a7468e7", "value": 6442496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685526029, "uuid": "c9f7ecbd-842c-4c81-a424-8c92d4e2b806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526029, "uuid": "c35ccdb3-7ecc-4adb-9c6d-c7ff9efe6681", "value": "a8fffe1256732a78425b3c4b81c00c78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cabd62-ff7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685514768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514768, "uuid": "305d2d24-9170-4382-99e6-8bf7ad49179b", "comment": "Malware payload (TeamBot)", "value": "30d1f0e11ed4d1bd2f11547c7dc44ab3", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514768, "uuid": "e5f098a5-07b4-4797-be56-80eb87105d9e", "comment": "Malware payload (TeamBot)", "value": "989e6a13fa14aa8bf6a4c683f09fd69e8b30fcee7a1454fd88a311bc4acd6137", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514768, "uuid": "eb8f090d-104d-49b0-9db4-dc058955ac8b", "comment": "Malware payload (TeamBot)", "value": "323559692d5c5245b6c6e6f9023c03150c43073a", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514768, "uuid": "9f86a377-d2fc-4fe1-841b-8af6a0ce089a", "comment": "Malware payload (TeamBot)", "value": "b8384f8de26c9fe953381c6eef64502387288b0f152159ce7c7d67825d549129b082d3ae78b4c70f5373ff84f934778e", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514768, "uuid": "fee718ac-1915-4ccd-95cd-04f53ce75f7f", "value": "T11E449D13B3D1A870E9674A358E2A82F8663FF8B14F5567EB235C5A2F0D711E1C632345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514768, "uuid": "1876bf94-5b74-49b2-b40d-cd9323bbcaf6", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514768, "uuid": "dba0b0e7-a5b6-44d4-a315-652c7a116586", "value": "6144:N0f9TcQjRgmUMJ1zVLzYSJU4Mc2Fc2yX:N0VljR3UMJlxzLJL2Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685514768, "uuid": "4f814de0-622b-40df-8a1a-dd64c1ce8b02", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685514768, "uuid": "555fb1ba-4d8f-4adf-8d40-e7954b090076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514768, "uuid": "3804a822-180d-4fb5-ad14-2bed844e8607", "value": "03548899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b08004d-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685520548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520548, "uuid": "23591d07-f2b2-4759-9c41-32493577845e", "comment": "Malware payload", "value": "e4c5b69a324c2b168fa852f5b304332d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520548, "uuid": "6766d5e3-8fa8-4e0a-a31a-485df808cbe5", "comment": "Malware payload", "value": "990f32ac5e94d0f0ff10f6cb925c89946916ee032d48a7e8b010f7552a6f8194", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520548, "uuid": "1fe78795-951e-4762-adc4-67a9414c7c86", "comment": "Malware payload", "value": "d075ee503743149e1c80d9a654c7f2bcfc536bd4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520548, "uuid": "843599ef-7481-4d3d-9e59-c710edd76f77", "comment": "Malware payload", "value": "2471052c3f1719e898b56331a72862f647cd76457c56454066203a465bfc567b2403be8c7a9fd55368b1cbb21bf12dc5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520548, "uuid": "2def92b2-35fb-43aa-9bee-fbc781dadc85", "value": "T17EA3F1AE605842ABC3C8F9B47B1C5C1FEA575BF676E01D02F91B16EC0022CB2AFD1455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520548, "uuid": "15456652-4dd5-4716-8426-c7a0cf481b7e", "value": "1536:8r6pdUZo0A3PuhZo0A3Pu4v8o2HIbD4TZV/yFaAzodrAZAkhZo0A3PuUZo0A3Pu1:66pO6o6Jd1E91yrKAZAw6l6ycNG66l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520548, "uuid": "3d21f18a-bb43-4ec5-99d3-5ccfa0d65d35", "value": 100133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520548, "uuid": "6acec3f8-7eec-4eab-93b0-cd0b5fac2fba", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520548, "uuid": "b4706351-a51c-44d6-84e5-74649631f35b", "value": "NEW ORDER.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faca11d3-ff7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685513917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513917, "uuid": "43d4b0f3-2fef-4b74-aa11-9450c9577c1e", "comment": "Malware payload (AgentTesla)", "value": "3bb96601470f69bd7c315ab08e5d4c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513917, "uuid": "03de3bbe-ab39-4c7d-a162-7fbf70c56d6a", "comment": "Malware payload (AgentTesla)", "value": "997bd2e38191c4def9366906e95ffbea6a793dc4806dcbf798157e51531cbf31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513917, "uuid": "a25a8b50-88e0-4626-bac6-b81e7fbb9ba4", "comment": "Malware payload (AgentTesla)", "value": "ed08f1e0b5db032a514cc57ecd0c57b5dd8a6fb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513917, "uuid": "91f73e2c-2311-402f-bc2b-030c3469efbe", "comment": "Malware payload (AgentTesla)", "value": "f1145e20e8e338e909e659b8d13568023df1373ca4236daffdb978362e71c6cc5e9211de3f9caa1792056509c46dfbea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513917, "uuid": "4c23a6ec-9f6f-4384-bc55-c3fb844fdc3c", "value": "T1EA259CEC351075DFCA57CD76C9982D70AA2064B7A30BE243A11719E89A0DADBDF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513917, "uuid": "9983d583-5420-4666-8b0b-c186ac912acc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513917, "uuid": "4ff78226-19f4-49dd-941c-8f57b9b297a7", "value": "24576:I5FLaVUH999IWxYJkkWM/0SRi7fTI6oQU:4JBH9IWxMfRin6QU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513917, "uuid": "4ebbb46e-ee3b-4c7a-b308-ea30b672a53c", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513917, "uuid": "1daf863a-b167-4e5a-a5a3-263ad83d7e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513917, "uuid": "5ea1b3f3-90e0-4622-b9d0-dab7f8023058", "value": "3bb96601470f69bd7c315ab08e5d4c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95083fa8-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533933, "uuid": "aec4c22e-0a4f-4b30-893c-9ab2facce9d2", "comment": "Malware payload (Mirai)", "value": "6346d5d43d218479a57d2fd2f32851e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533933, "uuid": "16480a74-8dae-4174-a128-202f866104f1", "comment": "Malware payload (Mirai)", "value": "99ac773e03cbd7cadc5064827d4f544111a8d8ba882bf68db0c455950abd07f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533933, "uuid": "174b5885-5011-4765-b2b4-adb2268e52ec", "comment": "Malware payload (Mirai)", "value": "7766951ddef8b6983d3557447ce2f93df0696433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533933, "uuid": "5d2112ac-a1fc-4852-ba38-83ec424ab70e", "comment": "Malware payload (Mirai)", "value": "1b461014a1f9f228b40368ad2bedbfa92bc6039bf484303486943e8c26ab260a1db86fad56dc0b7f68582db0f966b7ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533933, "uuid": "a3a2cb09-33fa-478e-81ad-0934b2598b8e", "value": "T14F731856B8814B22C5C512BAF92E118E332327FCE3DEB2129D116F247BC696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533933, "uuid": "75ed0a99-b5ed-44f9-b884-fbdd60e654be", "value": "1536:tKnn2WKd1+4Zjg9w1pmT7uEP3C43pcazh0PI9iZg3XvnTGPK5WYIWn:XWS1d2w1APykcaKg3XvnqPKERS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533933, "uuid": "9f3dd7e7-fd1e-4944-add4-7bf7ed1d1b88", "value": 80160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533933, "uuid": "0688022d-3380-4f8b-b1a5-093b1c5496a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533933, "uuid": "3981fb08-e7fc-4140-8c1a-cb10c1835d56", "value": "6346d5d43d218479a57d2fd2f32851e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff5ba43-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685522516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522516, "uuid": "257b8a56-28d5-45ba-b58a-149516a8ccde", "comment": "Malware payload (Quakbot)", "value": "eefcfaa58c267e78b8b006026db53fdb", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522516, "uuid": "3afea1bf-5614-4e5e-8413-3425dcf4b698", "comment": "Malware payload (Quakbot)", "value": "9c5dbac6625a15ae0a07b441c9fb83b1c828252b83ae62e61f9189eed3cdd2fd", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522516, "uuid": "8590a429-37c9-42e8-9e4d-720917bc9cc9", "comment": "Malware payload (Quakbot)", "value": "133890b001489989657e58cbbaeb440fc59f8dd7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522516, "uuid": "f7240179-c389-4b5b-b2a1-81296db758ad", "comment": "Malware payload (Quakbot)", "value": "ae80fa92507a6cfb0cc4f3d7dbd4fd48533d00db6244182a153116191ce00b0dac2e185cafa8db13b8fb6d9de8d98a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522516, "uuid": "8206c45d-1158-4050-8629-6e868258d861", "value": "T17D211B0177B16200C907A03D102142ABA5804909FD6FC6D23CCB11D2EBB9A2DC74038D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522516, "uuid": "1df951d7-11d8-4de1-be37-10aaea4dca2d", "value": "24:9hzzHJ2DN5IL+B1MWnR8A9ienVdT4DwHB05KrOvPVO5oV+se7T/H4tbHzzGRg/:9lHJ2R5ISBHR8/uVdTV05KruVY4+r/Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522516, "uuid": "f7320632-5133-445f-bedc-4ae066881437", "value": 1423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522516, "uuid": "2b4ba6a3-0fb3-40f5-af4c-900968df97ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522516, "uuid": "13c01f87-45e5-4070-898e-91ff89407d69", "value": "doc_C439_May_30.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc406983-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685498807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498807, "uuid": "75a4ae30-1cbb-4e86-9d53-c92ed81a97ac", "comment": "Malware payload", "value": "c027bbcb1ccdc36e4b742b8d445b73fa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498807, "uuid": "e8d82244-4186-456c-a374-37ef88a36e8a", "comment": "Malware payload", "value": "9d1582c69b56d7279f4962a9648524d9c57613b8fc2f7ad74fc2fd55f748e200", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498807, "uuid": "4123cf82-e00e-46b2-8b7e-ef04f85d2ac3", "comment": "Malware payload", "value": "c0b8449c705d2603a419f210ad3c7a2f98941b9b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498807, "uuid": "bb6de6b6-f850-4f9d-9d3a-c0e263ca2930", "comment": "Malware payload", "value": "05256908c0b462323121cdf9f3843031e6a232825c332ce9979d4cb69e781c70e6cf31cd8f26d8bb6cd72ad5826da979", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498807, "uuid": "badebc3b-e2a5-404c-af55-94a95961565f", "value": "T188115B1B8EA047C4042417E1482B75CD750F98CB9B6F428058ADB8EC3B07E73746BDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498807, "uuid": "612d6ad5-587d-4b21-b531-189cf0ad3c9e", "value": "24:HOtBO1QqP0IwSzOM5MXnfKO1xb4GcN/OYzO:HmBeJ04zZinfKM4/nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498807, "uuid": "1cc68ac3-0220-4629-b3e1-f5db9d0adca4", "value": 904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498807, "uuid": "70c1b5f3-9103-4ff5-a2f7-39b34a27e718", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498807, "uuid": "42c15c79-91eb-4350-96dd-ba223f90cb24", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b77d70-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519655, "uuid": "7357eace-a5cc-4ee8-82b3-250d4e2f3e4b", "comment": "Malware payload (SnakeKeylogger)", "value": "5fd5bdcab5d2ebf9c0c83c38613ed340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519655, "uuid": "b7607cca-b9f3-46c5-a998-98738bff0767", "comment": "Malware payload (SnakeKeylogger)", "value": "9da2be85343a64de6436061755bfdcb18bfdcfe2ad7c8f5fb80f1e4dd3099160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519655, "uuid": "04763238-7728-4b7f-93f8-6cf5e20dfb9f", "comment": "Malware payload (SnakeKeylogger)", "value": "ce01b7c3809af150a2de8a62744c825fa3a6ab13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519655, "uuid": "3a9aa4ce-7986-4054-b405-747eea34bb53", "comment": "Malware payload (SnakeKeylogger)", "value": "ba79836e12a17602338e19309f8f52af7fe5c96a8a645a48f3a7f82e16fca3ab9bc9ba96e8180326d5979cf9fd5d382b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519655, "uuid": "a81b73ca-61bc-4d0d-8d6d-7d17fff28225", "value": "T1AD240137B1F718DDECFEBE72D97749308A70E29316B2C65D968803542818B24EF52B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519655, "uuid": "bfa61d7f-2a54-486b-ad72-56356e084e93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519655, "uuid": "316ac7b5-e401-44aa-964d-e13a27203c7b", "value": "6144:09EfYQy0t+j7QwoGGoiisJv08pESnMKVy:09Ef35+j7QCSuPSMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519655, "uuid": "c2d98482-1648-4c0a-b861-0c990d279970", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519655, "uuid": "0f0ae6ed-7a18-40a7-8316-3eaef1087b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519655, "uuid": "2e801a24-5cda-434c-886b-5451b548355b", "value": "SD098765456789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a8e3f5-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685512640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512640, "uuid": "36d3dfce-8a00-4559-9d54-0ba535580ac3", "comment": "Malware payload (Formbook)", "value": "3c20f285efc6670dccaecd8283d86340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512640, "uuid": "34586fb5-0b67-4514-8a4d-a81e5f7a29c4", "comment": "Malware payload (Formbook)", "value": "9e392cb448daf1882dac5f6fbc0d736c76bed78befee2c8b513241b8ed6a95a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512640, "uuid": "8ef0059c-b7d7-426a-83ba-6e245ab95593", "comment": "Malware payload (Formbook)", "value": "75249424908a2a93d4983059e1510707dccb3fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512640, "uuid": "ea06e6fd-4ded-4eea-9370-7df65d870e66", "comment": "Malware payload (Formbook)", "value": "0fad8a19ac73eb039726c98963f8b579ed264663e3eae8ef94c279ab0a672b26b66d0bc3287fbd3f5e5f821a4bf54d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512640, "uuid": "d5760dae-422c-437f-b1d5-9015940dde5a", "value": "T10545D00863764797E03A2BF5C6296F3443701D7C34AAD7D4BED276DBA9A0F91082361B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512640, "uuid": "698fe27a-f658-4d1b-a755-dab75d7521bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512640, "uuid": "de49d840-6fa4-4de7-b132-3c9da390c163", "value": "24576:KozLaVUH999JI42gPVSkV/tGcudqpZ4dvNd20Pwwk5R+jMXrlwBd:BHBH9WNgPVSkFAdqpyRNdG5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512640, "uuid": "f70dcbc3-4136-44ed-9e49-a0db3609f198", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512640, "uuid": "e71395e1-3775-412e-b10b-3d41049f833e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512640, "uuid": "0efccf78-3368-4e8e-858a-e7121364b02c", "value": "Release Pending bookings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef30490-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521628, "uuid": "cb3fc08f-e323-4ce5-9e66-3a1a75981c3e", "comment": "Malware payload", "value": "90428255d17a33dd3f102730f572aae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521628, "uuid": "ea7dd53b-1c67-475a-8018-cd21de90b019", "comment": "Malware payload", "value": "9e5ad8a352f0ae5fb03d2078e890f5d2d33c8f845c11853daf49043eab3f451e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521628, "uuid": "3b7a9d58-f63e-4341-bb6b-968399d53c43", "comment": "Malware payload", "value": "8a1f5f999f58a3d84fa4ee1198a07103a6c7a983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521628, "uuid": "7b85712b-a07a-403d-a9ad-2339da7f0966", "comment": "Malware payload", "value": "c79eb4e8e7a9545c51c76f389f0ad8996d5b077231dd7cd491ddbd654db98b5e46deba2c391edb4a4e911277e78db451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521628, "uuid": "730a7099-9a77-41c3-930c-a7022037da0d", "value": "T1586612320532BDFE876C389494052B492CED5C235359DFACFA4414EF29A1738AA7F9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521628, "uuid": "7305654e-dce8-473e-95d4-3a82dc8f08b2", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Y75ka6N:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521628, "uuid": "8a7f1b88-1144-42f0-ac77-2e5f49d630be", "value": 6825975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521628, "uuid": "8f526d08-7702-43a6-8b38-5334ddd674af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521628, "uuid": "3aec4fb2-81e5-46f6-8db5-98e4cc77fa09", "value": "90428255d17a33dd3f102730f572aae9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9fabcf-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1685511612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511612, "uuid": "70e50572-0546-4184-a7d6-1bb5bc9c0b93", "comment": "Malware payload (N-W0rm)", "value": "b1955b33b43151e7b43c76197fb08368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511612, "uuid": "baa7b9d2-f0ac-4421-a7ef-a60ac6d6eba0", "comment": "Malware payload (N-W0rm)", "value": "9f7b454dc211409ff8955e5937bbc354d20d3efbf99d8baf6cd53357b78d998c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511612, "uuid": "81167d2d-11c6-4448-9dc2-fc306db5b7f7", "comment": "Malware payload (N-W0rm)", "value": "097c849b6391c1b2add98e6fd2779679c21a35b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511612, "uuid": "e4c4f3c0-0f53-4245-9eb9-7c7dd72bc55a", "comment": "Malware payload (N-W0rm)", "value": "81a973f5ebd5369613bcb173d5212f185cf71eec35de4d30a76179984d33ff6df5e0b85600a497b59ebbcc427dc68630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511612, "uuid": "6eaeb19c-7ca5-45b5-bedb-1d456fa97b45", "value": "T14FD33BD933886A9FDC6E897094740C6497F0A0576207E347BD87F4EB6A1DBC29F091E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511612, "uuid": "7c5efb17-d4c3-42ac-a38e-881a7d1d3424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511612, "uuid": "43505526-34b7-4e6b-b717-5b22a4ff0d11", "value": "3072:Sm6xdC1VRHiNRv0cAP1GGl4XDy0nsiq8YgafJl7:tUNdRzsiqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511612, "uuid": "43d19510-2600-4249-8d2d-d30c08acab4a", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511612, "uuid": "3c090561-ef4e-41e0-9f45-cff8327c906a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511612, "uuid": "b1c98e21-a030-4e2d-b46c-368b14a34f6a", "value": "b1955b33b43151e7b43c76197fb08368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75684968-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MiraiMiraiMirai)", "timestamp": 1685533880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533880, "uuid": "edd36629-4dc5-4956-aaa6-3d3fa43ddc38", "comment": "Malware payload (MiraiMiraiMirai)", "value": "5d6ed3a54a13afc13bf7dd0da1d3de28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "MiraiMiraiMirai", "colour": "#2E1D38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533880, "uuid": "3be71e0a-295c-4d90-9696-cc4164196bb9", "comment": "Malware payload (MiraiMiraiMirai)", "value": "a084bc3470677a9e9017b56be8a203e54ea326383e1a6462b48ac52f1c516891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "MiraiMiraiMirai", "colour": "#2E1D38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533880, "uuid": "271cdc5d-190c-4356-afef-641159399561", "comment": "Malware payload (MiraiMiraiMirai)", "value": "017e96f002bd225b4f9819143d99a17b7de5726e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "MiraiMiraiMirai", "colour": "#2E1D38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533880, "uuid": "d7a6ee94-6cc5-426f-9d01-58fac6c4681b", "comment": "Malware payload (MiraiMiraiMirai)", "value": "f2caac1bb2b1561a55f232003ee66f894f72a9a45feacd01b6894d5794720778c01f69fd29ea99282d5391872bfec75d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "MiraiMiraiMirai", "colour": "#2E1D38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533880, "uuid": "d5084747-8d7e-48fb-a527-01b6e7b1122b", "value": "T110231991BD80A662C5E415B7FA5F428D7B2613F8E1DA73139E159B303BDBC690EBB001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533880, "uuid": "8419fa65-a160-49ef-95f1-5802fd542acc", "value": "768:RfwDcWZX2CbGt28Mbg/9nGb1UOTYbzel0pbwzs+gbWdK+oBN0vvCqfpKups82M1R:dwJvGYng1s1l6zE8wYtWdrdvvHBRj1bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533880, "uuid": "e4e6a77b-2407-4d84-ac73-7fd94a73f33c", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533880, "uuid": "03678390-3db6-4a80-9f5f-e7170afe9bfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533880, "uuid": "0ed24992-a384-421b-9ce5-c81d0fe051c5", "value": "5d6ed3a54a13afc13bf7dd0da1d3de28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f2cf4b-ff4c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685493929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685493929, "uuid": "afec25c9-5fd5-468d-980a-f2bee0b40134", "comment": "Malware payload (GCleaner)", "value": "b134c7a2f5c2a50f2fceead9cc6d63e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685493929, "uuid": "26a9f693-42ea-4333-8036-f3e17380bbac", "comment": "Malware payload (GCleaner)", "value": "a18deeea319275d2d941fa683df3941af08dc6a3d440eace130bedd5676af90f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685493929, "uuid": "c136b3fb-7e91-43eb-9f31-aa46a89b85ec", "comment": "Malware payload (GCleaner)", "value": "12a9154a5fb2d35ac3a6bcfe890b243a8e629fe5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685493929, "uuid": "8fd0a4fe-7fcf-4a71-9252-8e3b8940ca30", "comment": "Malware payload (GCleaner)", "value": "a8dfb5510295927350b3451e7a36a4bd01cf0b563d32372336ccc3e153ca4aee92adb0644452403611804f2f6ff01da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685493929, "uuid": "524a51ad-f455-4e8a-8638-c64da1103ccc", "value": "T1C554E171B9E04831EABB65344C71DB581ABFB8322530C54B77B836BA6E317E14A35387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685493929, "uuid": "0b6fe242-64a4-4524-8f14-a6bb7dd9030b", "value": "27113c217d53f26eb8f070c56bd3d296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685493929, "uuid": "fa109dda-4bc7-4383-a900-bcf2dfcdb0dc", "value": "3072:Sqe+qbwDMdGiBkHfFFGV4krF9YtkfzfECkep0Bt1yNmnSwA890W92v5dM+l/TUjr:WbwiBOFoV4CFf7ENjvSFWwvHM+l97w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685493929, "uuid": "b6b24a08-abca-4fbe-bc33-6cd692bfa469", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685493929, "uuid": "832d19a3-1da9-40bb-b4e3-52c24e871c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685493929, "uuid": "ba18f425-9e22-4a64-a7a8-6a0d5d7ef54d", "value": "b134c7a2f5c2a50f2fceead9cc6d63e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75c6c3e-ffd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685550741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550741, "uuid": "a4b3f979-0928-43b7-aadb-fe88a06c3a51", "comment": "Malware payload (Quakbot)", "value": "3207579c779ad8830e49e3de23f576a0", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550741, "uuid": "37a0c7a5-b862-49c6-a890-93eff6e2d0a3", "comment": "Malware payload (Quakbot)", "value": "a1dd89ec488f16e541caf1aaf3f8d02e51080ba8694d48f5cb7d51adb4fd1800", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550741, "uuid": "bdb125c6-b3fe-4cf4-983f-57ada9d9d50a", "comment": "Malware payload (Quakbot)", "value": "7b36e469165782cac75d37e47be00062fb6145e0", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550741, "uuid": "632ed3a6-1a66-40fd-a495-62f8f8376734", "comment": "Malware payload (Quakbot)", "value": "83408f630e90b7a5022624e3b403ab576a13214a8715f4ca508e6e19236369c80ae163c85b5741148af92d477d444a92", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550741, "uuid": "516218dd-edfa-486d-8ba2-0df2484db06e", "value": "T18984A0A1394084FBF79F0631852CDA6AA0FEA74037F981D71F68DA5D2EA05C2ED31563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550741, "uuid": "e3195d79-01e5-41e1-ae0d-c526d43648ea", "value": "5f7981b73516d0a40ddc313c181df7bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550741, "uuid": "29d0ef60-be64-449c-aaa7-aa35b22710a7", "value": "6144:PLh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zs7iBsTYrPlUEYD/QzkRWAFctOp65:TInTDtXF15zs7iyZ/0tUS1CU3BJbwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685550741, "uuid": "42155ae0-1f7e-4d3c-8031-3be1e45336e7", "value": 404615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685550741, "uuid": "fb191329-deda-4b50-9764-63670a8fa130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550741, "uuid": "0fcd57e7-4066-4b6e-8c1c-516f1b002c94", "value": "oOo.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f94c78d-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685522274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522274, "uuid": "45a4365c-871c-4789-a03c-eccb451f353a", "comment": "Malware payload (Gafgyt)", "value": "1bc30257f42cdfa7ecabcb7473641154", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522274, "uuid": "fd61ef9d-4c95-47fa-be86-b6aa83f0cc42", "comment": "Malware payload (Gafgyt)", "value": "a254ff7dc2b35967aafd7a1bd407b5ac0cbe1f1363ef38890379ce0aa826e559", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522274, "uuid": "0470ef53-d857-4dc5-90ce-2dfc4c5c0904", "comment": "Malware payload (Gafgyt)", "value": "a263cff2dfe259858af7ebf992ed6e80b1574154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522274, "uuid": "9d3f114c-e220-4df1-8ebf-0fc5d59f7d92", "comment": "Malware payload (Gafgyt)", "value": "5ee3bb9d7806c5630fc9d80d0adbbf2e9ccf04479dae97cc9b81cb3f30b26dc71b111606e9e27264c55157f5c78cec54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522274, "uuid": "0659e6f8-4b5c-4e61-9980-18ca6cea8876", "value": "T170A35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C93125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522274, "uuid": "cf768cdd-9a7c-47f3-9f6b-b4bf14176bf9", "value": "3072:EWCjQrLpnr85EdT9Oa8vqbVr7p/CEgmqAgcVyZIcBI:Ef5EdTbpr7pWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522274, "uuid": "b9b70b56-b286-4978-a5f7-4230a2d385f4", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522274, "uuid": "56eb115e-d50c-4e07-96e7-b72c58314cb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522274, "uuid": "daa2fbc6-14c8-464b-91a5-cfedd3982548", "value": "1bc30257f42cdfa7ecabcb7473641154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826f2bb4-ff6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685508561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508561, "uuid": "093fe635-f027-40d4-b36c-872f73c9039e", "comment": "Malware payload", "value": "975ea012aff8d8dcc37638be840684e5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508561, "uuid": "e7c1919e-d0e3-401f-8b2b-f97fa57abbaf", "comment": "Malware payload", "value": "a2694a68b2edb61185dcbcafddf0889ad0d55150136d171674ce2e03a260c838", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508561, "uuid": "80c16071-b648-40e9-a122-add558da8ed5", "comment": "Malware payload", "value": "70b6fa43785aa7ef2ff4b28b0f03012cd5b9f06b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508561, "uuid": "6717695f-df3f-4fab-8fac-999e7f7b671b", "comment": "Malware payload", "value": "ced6f6be471bec4911765e63419c0f824f00317e6daaa1156231b6e31dd7b7c689bc7793320ff4fae960a4cd23fcaa3e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508561, "uuid": "3f3c5550-4661-4c3f-b5b7-adfa8056c63c", "value": "T1F9227DB6811F8D30E47B9F35F060FA55DCCC0846E2573965F015AAA3CDC36ECD266A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508561, "uuid": "81f5d935-2933-40d7-b514-0a7ae374c694", "value": "192:GEhM0o7Z/c+8poF1d3jvvtlsv9264wpKGhe/b8oCrGxjPCfZUUEc:GqlWcfa7pr1lY92hwsGA/bxCyxjPCfZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685508561, "uuid": "87ecefad-dbbe-48a3-8622-1fdfd3b1501a", "value": 10697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685508561, "uuid": "280640ed-f4ef-4765-8758-4d5ebee61b7d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508561, "uuid": "4517a8e0-e392-40bf-889f-3c95ef66e6e7", "value": "975ea012aff8d8dcc37638be840684e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31096f5d-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528182, "uuid": "daeba31e-1214-47ee-94f7-1daec812df70", "comment": "Malware payload (Gafgyt)", "value": "6da3501d9cd41a4bd7982bff486379f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528182, "uuid": "cfd7685b-a851-4fbb-a54d-4298d905b9f2", "comment": "Malware payload (Gafgyt)", "value": "a381f92ad710b53e82299dda0a86c59a277ca77a3a0ee6564b2f0cafccd78554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528182, "uuid": "a0527b5a-4109-4b41-833e-2deef965a96b", "comment": "Malware payload (Gafgyt)", "value": "2d706891ae5e65d1b101793108f554d2852c60c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528182, "uuid": "73bce893-f3d7-44fe-9daa-145be84647f6", "comment": "Malware payload (Gafgyt)", "value": "64f88b259f7ae52f983600afcfe7016b5e80d1724fde2b969047d91e5a4a4a2cb3372bf0738d3322065f5a4410f87769", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528182, "uuid": "b4655325-861c-46fc-aa05-a28e31975398", "value": "T1FCC3E9834A20DEB7C053AA7177765564B395BF690B1F06867E1EB6A00F3B4CEB41F620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528182, "uuid": "826adc30-6a4a-48f1-af11-4eb50f22743e", "value": "1536:UqAdl7hbawGMffKVy62JA5lWYPw7W/Cw3kVPZfwAK4FRRT0IAf1BgeJ8:dWOwtqVAA5lWm/xI84FLT0IA9BgeJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528182, "uuid": "12a61d6e-52d0-4f3e-abb3-8a8c03e1d650", "value": 125111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528182, "uuid": "51c6a1c6-edf9-42e4-8233-221994fd60a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528182, "uuid": "47905417-2699-4432-8f09-28605d36eca1", "value": "6da3501d9cd41a4bd7982bff486379f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7c2e1c-ffaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685534429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534429, "uuid": "31a74dd9-1fee-4f82-9dd8-5fc424445214", "comment": "Malware payload (Loki)", "value": "e0a9b1817281c6393781144157ea9708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534429, "uuid": "20232e87-3edb-4a10-a42e-0544d9a2fa71", "comment": "Malware payload (Loki)", "value": "a4b40080fe1ee2fa7a916be8d7738dab8f934f1d0367af6462fa1f0ddd1bab40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534429, "uuid": "2e45615a-d703-4f4e-bafb-97822a3c3423", "comment": "Malware payload (Loki)", "value": "44e7659f00987c79abbfa45e2c94461078cf357e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534429, "uuid": "19b6a43d-1c5b-4f1f-8b4c-bdcd3ab8563c", "comment": "Malware payload (Loki)", "value": "456d7c532d129bb60b4204ed88645e3cb3e5f19c2bd6b537336f0374bd7dace58a44ad974ce3bd546e444db831414965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534429, "uuid": "07533cab-62d8-4f5d-ab11-0eee36ea91a8", "value": "T108D41246EBBF160FD1AA7E7D4B704530AAFDC585502EC1EBE9970D2FCC58A346C91222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534429, "uuid": "3ce49a2f-5e3b-46c1-a089-f75a2f515482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534429, "uuid": "34321f87-1827-4180-9c41-562634e80b60", "value": "12288:a7AMTihh6xhZ6OrtUEjL7a+MDSUhRzhzBrR6wYyepK8fyCk:FMUgh8ytUE3+rDSg5LYy5Uy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685534429, "uuid": "e9b8681e-98ae-4670-8634-15df40aed87b", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685534429, "uuid": "defa6b98-9331-4430-a72f-6c6c62e0ad9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534429, "uuid": "0161ef76-fb29-4c9b-9207-746cf566600f", "value": "e0a9b1817281c6393781144157ea9708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f4ef52-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685521613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521613, "uuid": "bfa30c19-dda4-4150-99c9-fa0aea1e22b3", "comment": "Malware payload (Rhadamanthys)", "value": "c2efc3276a3f8d3963e26602a2218d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521613, "uuid": "aa918be0-cba9-4f60-b185-9ff669de7ed5", "comment": "Malware payload (Rhadamanthys)", "value": "a5fbff72a3aa6120ee4b47120171d9886f0428e36359efcc2b257308a2c78d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521613, "uuid": "4c2be183-9783-4669-af21-26cccedd6c5b", "comment": "Malware payload (Rhadamanthys)", "value": "a9a312008b2d662800cf7582e0e9d7887d11071c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521613, "uuid": "5512e6c9-8fe5-4195-9fcd-98e5460c3a9e", "comment": "Malware payload (Rhadamanthys)", "value": "660912517d6510ebc878d2bed38d7012bfe2dfcfc31a3321797ea51504d9763727376274916ee4f9197e135a2f33b094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521613, "uuid": "662a3f06-5e80-4d86-89a4-fa35c671d27b", "value": "T1E4940221BAE2C035D4FB85709835EB946E7B79636976858B336027FE6E303D18736306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521613, "uuid": "de55982c-8fc2-4bc5-be49-19891d0dcd5e", "value": "39951adf16315ed2342de9402f2891d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521613, "uuid": "c072df76-f7d5-49b7-92ea-9d12be5959c5", "value": "12288:ps1LmabvQXBNEG+xT9vZ0anesDwjr1kZXW43i4/q:ps1yab2BeyIzDwjX4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521613, "uuid": "fd84d703-969b-4c07-a3f5-fce39a64e841", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521613, "uuid": "6610b893-4eaa-45f0-be3d-8f952dc781c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521613, "uuid": "0cec214d-8976-47e3-ba00-808a50a3f7eb", "value": "c2efc3276a3f8d3963e26602a2218d19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece11c33-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685519907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519907, "uuid": "79e46cb3-e185-444a-a616-11e6e0269ed2", "comment": "Malware payload", "value": "23cfb8a26a00b24b44825084b2309655", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519907, "uuid": "b1e81f97-7019-4ec6-a9fc-937012da02ea", "comment": "Malware payload", "value": "a78f957f97c635c0c4913f101e3960058696804d6d2856d70259e36cbbd10b07", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519907, "uuid": "193ff6fe-7625-4a0e-9016-95c920611052", "comment": "Malware payload", "value": "9cfa9008ef852961b8ab986f424f1bf043b152c2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519907, "uuid": "95db4d38-9224-4edf-bf23-ac7ac943f062", "comment": "Malware payload", "value": "0c9dc4367b3ca20b98372c8def768363878b68830d16698b27d82f291d800e427c7ee9020e612aad00a7607aae1f3855", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519907, "uuid": "15c4b55a-31de-4fc0-851b-b53411706072", "value": "T1C6E13BAA578D0D93C556D2F4F1EA7D670BE3F50981D72358B305EAB11A062016958C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519907, "uuid": "bd12c0f0-5c49-4691-b7b7-04fc22c86eac", "value": "96:ClUQKr4IyQRlnbrMmimYUQl+JiyDgqaOfvmGicg1fIzlsm1/QyGrmevk4zw:CKQKZvnbg46+D04vB3vlsmZzQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519907, "uuid": "15ca9f89-3d17-46e8-8cef-6cdf71199bb6", "value": 6860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519907, "uuid": "81c02c82-ef83-411c-a210-b185bfe58f64", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519907, "uuid": "0f76a900-9973-4e26-b545-452581264020", "value": "CS30-POL - Traffic Signs chemical products BOQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88218116-ffbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685543360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543360, "uuid": "c4912f2e-c79a-4052-99e3-df72a2c0c29f", "comment": "Malware payload (Mirai)", "value": "7a9087623c239af857f69cf79fe8b3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543360, "uuid": "dcd51aa0-d3db-491d-91bb-b77a8f911e0b", "comment": "Malware payload (Mirai)", "value": "a84de46a574ff256be2b974a1243536c34d183198973a89ae9faa6a7fb0de768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543360, "uuid": "f88ae3c7-59a4-441f-9af1-95d65fc9dd5f", "comment": "Malware payload (Mirai)", "value": "72a74212fb7697bf350ee8923a7dfcab467e7dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543360, "uuid": "b901dab2-9d53-4fda-9b10-e55af5138f6d", "comment": "Malware payload (Mirai)", "value": "08c0ea1fd711b860b3ebac56ae24575ffb61336e1bce1c7c711b3c910f267f35dd6ef9e91e4e0a501c61cb675b0a6063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543360, "uuid": "be1f0319-b89d-40bd-8ffc-fab5c952f889", "value": "T1D8F2E10D47DE7FA9D2FC8D3CA42E1F352881F586704E9E8D96884884FA75A07BA6D4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543360, "uuid": "d4a53626-56ff-4269-bd8c-0eb3910d1252", "value": "768:mE1T2TphOV0R3IE/XZ3nfjysjkry2/rjJ1xmXWMW:mMn097B3fF2TjJ1xm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685543360, "uuid": "76e36004-358f-456c-ae59-2bdebec1c0b9", "value": 36304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685543360, "uuid": "9bc1f8ec-97fe-49f7-b673-7e5b3ca112bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543360, "uuid": "d70c0d8b-a755-42f6-8dfa-d53805a92266", "value": "SecuriteInfo.com.Heur.20230531133228987075586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75682bd8-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685520565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520565, "uuid": "53e2e450-8c84-47f1-a481-ebb72ae7030f", "comment": "Malware payload (AgentTesla)", "value": "f098ba8230b7d964077c014f9fb33e53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520565, "uuid": "cccd8a7a-053d-48e3-b854-c6211ebdfb4a", "comment": "Malware payload (AgentTesla)", "value": "a8e0587c11c94b01dbfa35ab575d6ff9987aea21eeec5e1136445cbd4bf50c99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520565, "uuid": "9fb607a8-b0f2-42e0-a86c-a5c7d5693740", "comment": "Malware payload (AgentTesla)", "value": "249b16f1a9a1011c05601efea9493facea2333c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520565, "uuid": "0ed44850-0a1c-4c60-a247-c58e8597c003", "comment": "Malware payload (AgentTesla)", "value": "86dd02f8ac779430ddd0c1e077d9827495b3b28905a4743d832254e3ad63979f5e83162f9c5fbe27e0e9a75069743c29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520565, "uuid": "393e8173-1ba6-4964-8d58-16f9433e0f81", "value": "T1B205F140B5BB4F2BC5BA53F58604B2345BBD699CB872E30B8EC7B5D69551F020AC0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520565, "uuid": "c7508a9d-77ac-4ea0-82b9-2806102f44f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520565, "uuid": "91152c3c-bf4d-4296-9ac7-e52e66a3070f", "value": "12288:on2B0xTGlxNqvNu2hZ+nUEsn9BD2C3SL2hok8PP07bogXIlcJAm/CHfVASniew2v:onLaVUH999BdCqbXmAV6Hf22ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520565, "uuid": "1c3a2a92-a03f-45a8-ad01-bd60e5788f6c", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520565, "uuid": "9f321929-82b1-4a1d-91b8-2acc1104573f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520565, "uuid": "de276aa7-8285-4ac9-8e34-5da939bcf198", "value": "Turkiye Is Bankasi e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42593334-ff56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685498146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498146, "uuid": "888b43d0-772d-40bd-94d5-a96a69b76da7", "comment": "Malware payload (CoinMiner)", "value": "01ec31a1ad9fed1136bd9e7f3c164ffc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498146, "uuid": "518d552b-3309-430e-a4a6-16f208f39b38", "comment": "Malware payload (CoinMiner)", "value": "a95e8541f0e2e8ac15d15b079ac0ac9826c52f8ed61e2c8a3c0ca72908230296", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498146, "uuid": "e1416c0f-6d03-4be9-ad58-21b693100fa9", "comment": "Malware payload (CoinMiner)", "value": "9f01f27246dda3590a59f15e868a452f7b5dbc90", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498146, "uuid": "097fb907-4e1f-4229-9d87-6b921f51c60d", "comment": "Malware payload (CoinMiner)", "value": "b5b6b577013d1303788536c57eab489e117b13e6cf7921c0f2f41b0e97854887a7354c773526ca460513e03c673cfddf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498146, "uuid": "26d172d6-cad7-4ab5-8c98-37d86094bba9", "value": "T122C52A0AB5560CE1CD4580F3C1D36B39DB60B80A0F1095FB2AD787EA6BEF2CA597D254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498146, "uuid": "727465e2-3154-4587-99f4-c2a21d73cb0e", "value": "49152:mdMk1uixB1C4Z7QLRVAmJhxB8LRX/y4kQlr6:9kUixBMA7FmJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498146, "uuid": "ed81d078-9528-4b21-b40f-94ab720f1154", "value": 2643312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498146, "uuid": "087b2445-4bbe-4f6b-850e-f3f96454fad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498146, "uuid": "2c08d739-ea4b-4de3-9624-d7821ce4d24f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc3e811-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685531803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531803, "uuid": "36ff423b-5228-4b37-a799-095e7f0eb6ab", "comment": "Malware payload (Mirai)", "value": "6ef13be0b984af235e52bcaa6119f41d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531803, "uuid": "5de6f590-cb82-4afa-9b97-8cb29d657db7", "comment": "Malware payload (Mirai)", "value": "aac4ae67e3461fc3078fca075540218da106751ace593f6803b759896aed7fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531803, "uuid": "7325ada2-87bb-47b4-975f-59768685f557", "comment": "Malware payload (Mirai)", "value": "f7ec41e9b2084cac9e8fa20abe2225ff88fc0e7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531803, "uuid": "4adbf566-9d41-42eb-8735-35241fd27a2e", "comment": "Malware payload (Mirai)", "value": "324cc37f6d5bd7ba48f6ab5da606ac65d56b83366d5e8895703cdbe4af7a6d531a312fadd0f11a2c040b8ba32ff98250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531803, "uuid": "795b0f35-3872-4d95-9406-8185f0c4e9ee", "value": "T154434BC4F647E8F5DC5706741136EB778B32F5FA2218D743D3A99A32AC92601E613A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531803, "uuid": "e6265e11-f519-44cf-81da-0090c1376395", "value": "1536:ka4CVvtTO8yJT/0fSGUzU+vwWxn6V/Ps06r6MF:d4CxtTO8yd/0KGUw+vvx69k0Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531803, "uuid": "301ef7f5-a29a-4c16-874a-5ca44368d34c", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531803, "uuid": "acf8dcb5-2bf9-4ada-bd8f-772c2aaaf01a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531803, "uuid": "ff4304f9-4c4a-4121-9fee-f76ddea9a1d4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e12e17-ff77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685512570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512570, "uuid": "50616edc-123c-48bc-b8d7-13973e2b1ca3", "comment": "Malware payload (AgentTesla)", "value": "e6394d71525a3d1285f0ba6cfed896d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512570, "uuid": "18e3318c-8922-4fc1-b9f0-5a51684bdfff", "comment": "Malware payload (AgentTesla)", "value": "aaddffb20e26092a85aa566936443dd5ca8e70a8f1e5456355d81882dbc7b856", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512570, "uuid": "36621fc7-1e49-41a0-88b9-53637ff9c216", "comment": "Malware payload (AgentTesla)", "value": "e0c4404c2507cf058a2b675a4a8799a68c8f9abd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512570, "uuid": "ee017857-1c1a-4ca7-9b87-0e1a6995f19d", "comment": "Malware payload (AgentTesla)", "value": "d2371f8d02dd0393941786f5b158ff9b027bf30830447cc2ed8fe2dd65b5fc72822b5ac13ca24c8ba15219bdf334f26d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512570, "uuid": "cfc850b7-9fe7-4404-b66f-21a7b0378fe4", "value": "T159F41215EBBF1A17C0627D7D5A70517856FCC940902FE2AFE98B28BFC804A75ACE3161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512570, "uuid": "5f84d2b8-cf49-4259-95cd-2fbc3a1475bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512570, "uuid": "d9a2202f-74d2-4826-8371-90587f949a99", "value": "12288:wIAMTihh6xhZ6OrpcRucr7X/tmj2x9Jw0pDaOdaDGkRXeZcRXb15qgM:sMUgh8y+pr7Xlmj2dJB7YxfL15ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512570, "uuid": "cc0a0ba1-90e4-49f1-95c3-205d79d0a094", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512570, "uuid": "a6e72eb6-0683-4220-8099-9ff248a62eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512570, "uuid": "a0bc7757-c07a-423d-a51f-6afac225a729", "value": "PRE-ALERT SKLZ2112352 SHANGHAI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca02a86b-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685522425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522425, "uuid": "9f7f6b82-c0bd-4b1e-81f8-c0f338c85b7d", "comment": "Malware payload (STRRAT)", "value": "4481fc350f86230dff7064a3d0ffc1bb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522425, "uuid": "35e14200-805b-4189-9de5-99cf6f4d3d66", "comment": "Malware payload (STRRAT)", "value": "ad2be93a1f1aad3389640d2eb5a32137711cd9fb5b9fbc59b804e19231d46d61", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522425, "uuid": "b254125a-b80f-4bf2-b109-f2700b7fed6f", "comment": "Malware payload (STRRAT)", "value": "140fb15288336bcbe64cc430f218f050763ae49d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522425, "uuid": "570e20e9-a0f0-4c66-bb18-7ca6ca5aed95", "comment": "Malware payload (STRRAT)", "value": "9f7c7560a1d7e5c08a5ec9f80445efb85efd926b0f48dd741374c57de58bd96072bfeae901f02a447e53d3e10c3cc2b9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522425, "uuid": "1192cc96-ce32-4d4b-95a3-4eb55a9ffb66", "value": "T14463121476C88D6CCF0B88BD3525F4AA3C26E6FD949CCC6376E09706497E08367CB16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522425, "uuid": "922b33ce-9e9a-4acb-81fa-c9e9363759d6", "value": "1536:fZVlyAv/DUBTdJq67LBwkVUsrhUXUcE9JDc0OMSoMBCuVGMrpBBr:R/lX45dcfkCeHcE9xZOMcBHrprr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522425, "uuid": "f9c9dc56-0fd8-41d4-b49d-66bc4ee43e97", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522425, "uuid": "779bfe31-51b1-407a-ac5f-c93c9a7e660b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522425, "uuid": "f6b0d593-b823-4f06-aaf8-4e9d523e1b1f", "value": "050031.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa551c-ff96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685525646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525646, "uuid": "6058ba21-e19f-4dc6-953a-36158ca5b905", "comment": "Malware payload (Mirai)", "value": "61f55cf67c82b9d3fe28b747f327f22a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525646, "uuid": "159a01f5-1143-4335-a827-df4f54b1a2f2", "comment": "Malware payload (Mirai)", "value": "ad3be43a4feb37bf709b20aad0d2ee4df99f273e5f6086383be9fe0d5e7028b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525646, "uuid": "bc4499e4-a5db-4464-b151-868b19337a04", "comment": "Malware payload (Mirai)", "value": "677d68175090638c32075b5d2776c7db493d4816", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525646, "uuid": "3164d386-3df6-4b36-8fbf-081b4d882431", "comment": "Malware payload (Mirai)", "value": "5abfc727bfccea48e0ebca10e78412b53e50f58da1b16bdbdfc7530813bd05165a5a4cab0f36cfd2ddef353ad636f70d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525646, "uuid": "e2c452ce-29a8-45c1-a8f1-0ce78fe7f41f", "value": "T184E2F0C7436AE7A0C07900732CCEA50F5E11D31B51042AF96F94A9ADCFB5FAC7E06921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525646, "uuid": "9cd5f0d9-2050-4218-8cb9-6183a97a844c", "value": "768:7Plc0REzRgcK+UqwoyspZy7TyNBYkXM2qbp5U5fnbcuyD7UiyqV:CdRgci8yiNz6g5fnouy8ZqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685525646, "uuid": "e1cd7026-72d5-4cf2-bb31-f80dac4007e3", "value": 33024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685525646, "uuid": "cfab72bb-b9fe-4abf-96e8-544d254cc40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525646, "uuid": "03a78718-32bc-4228-aadc-a97c9e354834", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd77796c-ffaf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685536685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536685, "uuid": "cfd93b30-cf8f-4c98-8fcc-9aceff903ecc", "comment": "Malware payload (Formbook)", "value": "6afa6592e709e8a3bd291d579ee140b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536685, "uuid": "417dc81e-0f33-48ce-9c25-d33b94f69d86", "comment": "Malware payload (Formbook)", "value": "ad5131dfaba269367d500cd343ccc1956434b4cb21c2fcd163545c433deded66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536685, "uuid": "0320b852-788a-4774-bfd0-d7f4d39a5add", "comment": "Malware payload (Formbook)", "value": "c45d7695612191c4630825759d1ee90efeb5f63c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536685, "uuid": "9426882d-12a3-4292-86d0-8a7bcf5b818c", "comment": "Malware payload (Formbook)", "value": "bcc57e6b3ab3a7b408b102aaae236916555dcc25a531281fa109bb4602948bdbb00d01feb11d79fe95e4c70d9237e635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536685, "uuid": "c866bc96-bad7-49f6-ae7a-8529dcefd378", "value": "T193159E3271B3A87AE9135638DC16B774A4387F123A27ED09BAE8BC1C4F37196251D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536685, "uuid": "07294362-36c3-4859-9f33-cc84f0b50459", "value": "faffee6ddb737e162a2459239510b1e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536685, "uuid": "5d9bbd27-bd7a-4ce7-a250-2c4907d2c959", "value": "12288:H7uk7C8LDMu42r0Dyo6Te5rf1C7nh5YaGNr23ax56pw1MJf:HC52r0WorR4Dw23i+w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685536685, "uuid": "0ca314bd-fe49-49dd-81cb-3a0343bd5223", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685536685, "uuid": "aeae2b7f-891b-4dfa-badd-dd6f3c0d6424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536685, "uuid": "26ea713e-7cdb-4d1d-b6f9-25ee25c478c5", "value": "Nbvkrvfanxfmla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bef1ac-ffcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685550142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550142, "uuid": "86c56f8a-382d-4bca-a35c-ef396c018373", "comment": "Malware payload", "value": "3661cbaa14b2974e5f1c228da71b3375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550142, "uuid": "b8e32fb9-e500-4184-8569-0f44781b0f06", "comment": "Malware payload", "value": "ada19cb4ac105d3455eb0c2f84fcc2d9cf4350e78e149a62304c90f978e72b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550142, "uuid": "82ef03ca-849f-42f9-b6ee-7ac7a98d000e", "comment": "Malware payload", "value": "2802749a624d8b66786988805aafabdc8b3c741e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550142, "uuid": "8e5d2e60-b088-4003-892e-cb769181dd8f", "comment": "Malware payload", "value": "fe4deb18d2b8c7d098ed4ac7af2582a9c414571fd59a6fded9f852942b297a0ac2d6f0b0a6e6ecc3479bbe455a14d367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550142, "uuid": "924ef8ab-4340-4d91-9485-2292e65246c2", "value": "T15144D500B5D68532D5620C368CF67B5CA738A6110F274BEB738825799E243CCF6F99A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550142, "uuid": "40d60442-aa8c-42ad-aad9-3d56cf990ea8", "value": "8ad88ac708ddb8f8b13f36cf34d63196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550142, "uuid": "e2ef4d46-f670-47ce-b370-688e6c96e36d", "value": "3072:/jw74LtbRIpVtSxq3hJSaj0CqWuvSNImaZhljVLl7r8qi41j2m2FtHJjgBvFGhC4:M6hJVL5nt2FvUJFGhCWUyAOkgqk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685550142, "uuid": "af157a63-8120-4611-9c7b-7a2e1a26fd27", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685550142, "uuid": "7b6e341d-0e77-4e91-9769-ae6470ad2494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550142, "uuid": "46ddf012-ee7b-4e61-971f-dbeba97c94c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd60d439-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685522511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522511, "uuid": "d650d3a3-d89d-4d73-90e1-e2c4878f20e9", "comment": "Malware payload (Quakbot)", "value": "afe4c0bae4f8c0836b797cdc7bd3752d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522511, "uuid": "56354dea-82b9-49e7-9aa8-a920e9ff9447", "comment": "Malware payload (Quakbot)", "value": "ae2673d1dfbf45197a4539925fe025c7f040bd3276360f9d543482958b441ce1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522511, "uuid": "1d3caf3b-1497-4352-b64e-0e27688ed31a", "comment": "Malware payload (Quakbot)", "value": "d6aabb76f82880eb1976a63e1221232a94631abc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522511, "uuid": "e64ffac4-7a7e-44e0-8d2d-ab3234ff6eb5", "comment": "Malware payload (Quakbot)", "value": "e562c8698cb9086d212d1106d6e95aeb644f545f1baac63956e70df947e573f44d301804703a17b6cf30edeb04fdce27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522511, "uuid": "d67ec6f7-47d3-49bc-8118-88e559b21119", "value": "T173A10477AF198D6ED265FA402082EC8FCAC5C639211FED93F38B659178ED41D92B21C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522511, "uuid": "89a3ebca-99af-4049-a7e8-24c287a7fd34", "value": "96:ENaF6PIEKMbZ3IT6gtu1f773grwnfCkBCFwKxRHGEO7:Eb9bY+hcXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522511, "uuid": "18c5f59a-629d-4e7c-9924-d383aa7c21ec", "value": 4765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522511, "uuid": "6e6aef94-3743-4b89-ba40-92e113543427", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522511, "uuid": "493f8acd-a895-4e49-b0a2-f5e23493e1c4", "value": "doc_C469_May_30.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e55b26d-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528204, "uuid": "ae434452-7c0e-4936-bfdb-c56f285a5c27", "comment": "Malware payload (Gafgyt)", "value": "3797251cf4d387cd7cb7a348f1cf97cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528204, "uuid": "9fc7a943-956e-4e64-8627-08cb9283dc6e", "comment": "Malware payload (Gafgyt)", "value": "ae592a2ee511d43b37b63e6f1f6d9caff3e5a79b57881b28f2b163636fce1810", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528204, "uuid": "974675e1-216e-4f45-8f45-1daca61ffe90", "comment": "Malware payload (Gafgyt)", "value": "9ed6bd2c80955d6f0ad33769b3f3a2f2259cb838", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528204, "uuid": "06648a10-ba09-4d69-b278-a9404b31f850", "comment": "Malware payload (Gafgyt)", "value": "03868ae5cea874f2cc28c75f4b285761e56b02825a455291bbedbb7103d14b1cf5674f6aaa1f07c4a1d2744ac032dd4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528204, "uuid": "94f574d0-0fa3-4fe7-81a3-6709614991de", "value": "T13C142A05D6408B57C6D367BEF74662CA33729F987F97330AC2187AB037D13A99E26205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528204, "uuid": "0e1bd89b-6f7d-42e5-9ff8-68d7917e3caa", "value": "6144:XEBboLikKa1wYuChjHZtlfQxP8CM/9JpuGrmDaTmD5r:wcmDa1wYu6j5vI+L/LpVrmDaTmD5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528204, "uuid": "fe5c3c8d-87ea-43c8-995a-6e8328846ccf", "value": 201626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528204, "uuid": "c1284246-06df-432b-83f9-da13a23f1c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528204, "uuid": "171fb496-0af4-49b5-8b1b-c74e9b2fb9b5", "value": "3797251cf4d387cd7cb7a348f1cf97cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a58f457-ff79-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685513111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513111, "uuid": "c6453a93-31b0-4e33-ae9c-2f385a989892", "comment": "Malware payload (Loki)", "value": "4b8a3b2a71abc48567cae11690618959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513111, "uuid": "8cf6bc44-b0d6-45ac-ab95-a46a7395dd0f", "comment": "Malware payload (Loki)", "value": "af5b4f4418963dbfc195c5f03976e3b6659fc34e31a9737410e73ae6da78fe2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513111, "uuid": "f4701e4c-d657-4528-95ab-c8ea1eeff09d", "comment": "Malware payload (Loki)", "value": "0bdbc765e48024cd33cf6b86cb9edae1c375cbff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685513111, "uuid": "87fd28d5-e746-486f-bcd7-62fe7383e4de", "comment": "Malware payload (Loki)", "value": "31719eda515d88f5dd4676ab23cd8cf445b45c726461ec90bc2b36491c962952b9c61f2e6a5ced443ea69cd1caac2100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513111, "uuid": "1d34440b-dca5-4094-8124-e4a779cbff0d", "value": "T18D24BE2D79F1C072E6BB46358570F7A47A3BB8326B74858F336426AE1E307D14A65323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513111, "uuid": "d3ae32f9-50ba-4032-adf0-11da1ea958f4", "value": "39951adf16315ed2342de9402f2891d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513111, "uuid": "99d0aa7c-2a94-42de-9f6d-1b9149786ad7", "value": "3072:4qfld8p1wHJ7iJcJOJVTm51fI1RQqGQvrduTOm3k5fs:/flmpvJ46VC+o3eduTOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685513111, "uuid": "1fabfb94-76bf-4d5f-a9bc-2b0c4212dc5d", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685513111, "uuid": "195b6c12-fdc1-4dc6-bf5a-450d8bc11964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685513111, "uuid": "0321345b-2baf-4d1f-857b-287c2be01619", "value": "4b8a3b2a71abc48567cae11690618959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de985cd-ff99-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685526915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526915, "uuid": "e3ccdb46-1a55-4a82-b20a-f96979e7c1ac", "comment": "Malware payload (Formbook)", "value": "31f682d265bb2bf6845a98e383d23ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526915, "uuid": "84eed2bb-7d4c-4cdb-a56d-500ed1a4adc0", "comment": "Malware payload (Formbook)", "value": "b1dac250b790090d75044bf149fb5e5372fed13d4c44999e4653a159d96c63b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526915, "uuid": "7d074b4b-c3d7-48e0-9d9d-6a49a464fe6b", "comment": "Malware payload (Formbook)", "value": "5978686177e06c001204be8aef86ccc28fd92db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526915, "uuid": "550a8eb8-f4cb-4b08-a894-46eccf2d3ea6", "comment": "Malware payload (Formbook)", "value": "c2be95851f481cc6ba69f33304eca7e9fe2e783d87f45905e04d5224f2f8edc6316d82834eb12fa32fc7905fa1775b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526915, "uuid": "c3f15ece-0989-49da-842b-f5370bf38f5c", "value": "T11635F11023BF8F5BC57F67F20611577097FA6AA9743EE3198ED261CB15A2F400A02B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526915, "uuid": "d0036a75-e535-4aaf-9c7e-57b2dcc76e74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526915, "uuid": "5cdb1c98-5e69-45d4-88fb-3a4e479d0d7c", "value": "24576:lX/LaVUH999yvrVq6UDWlR83Kt3Ffqcbo/DHXWRV89LJ+hD1P8:xTBH9yvrJmWlQK9FfvU7XIV89Lu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685526915, "uuid": "c7467a11-cc49-4a95-937f-1087afea1d17", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685526915, "uuid": "7109d6dd-bb86-4adf-87e5-2cab9636f3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526915, "uuid": "7b175cf8-58f1-423d-a47a-3d722d177fe1", "value": "0630OTT231156917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6787d2-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Metasploit)", "timestamp": 1685531937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531937, "uuid": "2dbe8dca-1c2b-4cf9-b62a-b6088f41179d", "comment": "Malware payload (Metasploit)", "value": "5af8f3a1200402ef7ce6649c71b94993", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531937, "uuid": "d63833d7-d79f-48b8-9015-a315419c1a23", "comment": "Malware payload (Metasploit)", "value": "b1f32e797d0ff51fd926834b89167ba45c3ca8a75f2cfe8cda7dbb1c9fdc6775", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531937, "uuid": "1b1ab9de-9031-40f7-9c7e-43569460bbf1", "comment": "Malware payload (Metasploit)", "value": "48d44229a349cd3fe5c3e84b3ea07058f2df7c48", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531937, "uuid": "28203d5e-803f-42cf-99ec-8a2dadad1c64", "comment": "Malware payload (Metasploit)", "value": "8b21f5bbd9c985de10bbcfc611429d2bb262be0533460fc0eac204092ebc0ff3eacda403acb3f064b577cc61b3fe397c", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531937, "uuid": "6da3bd35-5f35-497c-89b1-b9f8adfd6108", "value": "T18D5197143BEBAE2945C30067BDBBD08629161B7510D96C00F5ECD5A1BF4F9A5C037350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531937, "uuid": "4543465f-8ed4-4176-ba03-6082a4d46a11", "value": "48:rWgGI+2RjKVOWj7vMZ/+YIUvnVh3633wFELgDVL60ls40lsYRm0lr0lE:KgdWvvOmYlVhS39LgDI0ls40lsv0lr0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531937, "uuid": "9d1149ed-2d95-4dab-b483-63f521af0c33", "value": 2949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531937, "uuid": "6107bf43-3ef7-4304-851e-da525cefd391", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531937, "uuid": "6b32675b-bcaa-48cc-b921-c04177766735", "value": "03683699.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21264ed7-ffa5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685532020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532020, "uuid": "aff134ee-3a54-4200-8b29-11a731b01220", "comment": "Malware payload", "value": "ffa2e6f6a7a8001f56c352df43af3fe5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532020, "uuid": "72d0df82-73ae-4e79-8a55-2d812f0af98e", "comment": "Malware payload", "value": "b277a824b2671f40298ce03586a2ccc0fca2a081a66230c57a3060c2028f13ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532020, "uuid": "7d77966d-921a-45be-831d-0311848a04ec", "comment": "Malware payload", "value": "78a14c070f2efa0a22e08fd74b7947c2d8354641", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685532020, "uuid": "12ecd922-fddb-4c2a-a87c-c652d02452e2", "comment": "Malware payload", "value": "af5e5174397bc3b11210311055d469149055c77257b28a44c33d7817db87f2d46794e8686e3bf6925843b3df58ad732c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532020, "uuid": "92e05c03-c8ee-408b-9d3f-d0848af9186f", "value": "T1129301B8427E58E3C18A5DB9549107B1A5DD148943C4369F3FA3F2A8A6F07DE13CB217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532020, "uuid": "071ff783-9c52-4050-9437-da4b4e361e52", "value": "1536:vgisx3MFz0FKl1xkwhyqkNtxt0YZzFDrzivRF5GA5kacGQN5+LYo:6ct0Yiwh3kvxfFD+5GfaOD+so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685532020, "uuid": "20a1c73d-e4c7-4315-a522-f892d77f692f", "value": 91296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685532020, "uuid": "ff488b62-3a26-4d10-986d-a67df83d27e9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685532020, "uuid": "29b870a1-2435-47aa-8bcb-b96a3342b399", "value": "07439399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0289819d-ff8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685522520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522520, "uuid": "7f413b41-c48d-4cde-992c-69f7c1b55fa4", "comment": "Malware payload (Quakbot)", "value": "ee3bfd2df66a6e79086a3a281b88f566", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522520, "uuid": "8fcebd2f-489e-4a16-a6a0-62611c827e62", "comment": "Malware payload (Quakbot)", "value": "b29ce45faa874ca2ea0086265d533025b64555bec9883b0035c3d8f4bed1ffea", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522520, "uuid": "1091c2a2-49e3-42d0-a7d1-fd98cf7cdf0c", "comment": "Malware payload (Quakbot)", "value": "d8bf9aa4b3c50762fbaa2821b200fef1613beab1", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522520, "uuid": "25f69643-5c5c-404c-ad01-c9cf7c1b5d08", "comment": "Malware payload (Quakbot)", "value": "725961070009cd18de4b44323f230d8b4468d867113c2dc7ba3ff8ad3c05c83c3da968aef5b5aed1fdfaff2d57831a82", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522520, "uuid": "bcb166fd-d00a-4a3a-8d38-bc972a125cb8", "value": "T1C02108A3DB50A20CC6240DBBD1EB57268697D24CC4423942E068A9DC3E1EC2D4EF11A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522520, "uuid": "246a6605-0acc-4d39-aed4-426b0e05feec", "value": "24:9XfFnVZhwuWyU75dEuZn1heiI/FcsaZrc9oCEGEU7dHK0wb21n:9vFnV4uWH7Yg1YDjaZAxENGHK0wS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522520, "uuid": "f5e9a2cc-83b7-41ac-a9e7-3c15ba12cb85", "value": 1419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522520, "uuid": "dfe37b6f-6054-4306-ab9f-d1d8792efb19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522520, "uuid": "f3c79a21-f2fc-4a21-8881-5902e6df1158", "value": "doc_C430_May_30.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808db413-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685520155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520155, "uuid": "4acf562a-22e1-4078-9a29-6c072040f3e3", "comment": "Malware payload (RemcosRAT)", "value": "2e188db658ebc70144969efb50d393c9", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520155, "uuid": "018e008c-012b-4abc-825e-226aef8df275", "comment": "Malware payload (RemcosRAT)", "value": "b2a00a736c7f3cc7212c99c445c222c589c08fdffbb0085d0688a857b081eec1", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520155, "uuid": "962c2378-355a-4536-b6c9-1be120d64014", "comment": "Malware payload (RemcosRAT)", "value": "1ad0c15103ae290e3abda82ef43192f4d1468a22", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520155, "uuid": "75534b53-6bb6-43cc-89e4-261e5537ec9e", "comment": "Malware payload (RemcosRAT)", "value": "d0f4881c0256da2ecd63e42b74e56f8d9549c35f6e42047424c8d8140c0ec176adedeb68c99348885160bb8b11513f8b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520155, "uuid": "4c3ae10f-d432-4c02-84d1-d5800ae78721", "value": "T131F4EC51D6DB20C8F7722D00F7BF91A86B1BB5D98839E94D4488892E37EF502CB91772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520155, "uuid": "37f9ed08-3e23-4d57-9805-9b10f23d1560", "value": "3072:MGKGXwfkYFEhNe4VTdRnTT8w4TWx5f1gCpDf2CG9NBZqs6AOg4cpz+og0S7wQzSM:PrwfkYFe9YZq5Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520155, "uuid": "70f0cef9-b577-439f-a70e-c91a30a1d073", "value": 764916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520155, "uuid": "abd7a454-0798-4326-8a6f-9d4c1edd056e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520155, "uuid": "4d37f1d5-863c-44bc-b323-774a17d73b09", "value": "Invoice and Shipping Documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9987244f-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685511607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511607, "uuid": "2fa48ea3-8b1e-4992-a925-adaf5afb9237", "comment": "Malware payload (STRRAT)", "value": "f0d417436648dc1cc37aec62aaabb4b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511607, "uuid": "640812fd-e783-4701-84d0-457838204781", "comment": "Malware payload (STRRAT)", "value": "b42cb298c087c4172a614444dd6562f3f1a277fa1e66ef8f72331f008e35e73d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511607, "uuid": "bd3468cc-ede2-450c-8ed5-a04ae6d57e27", "comment": "Malware payload (STRRAT)", "value": "a2c10fbde66ce86ffb8ff75c42838cf05c3b9cdb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511607, "uuid": "80b75982-6f2b-4892-9d21-23a93edb9361", "comment": "Malware payload (STRRAT)", "value": "c5b3cde8c4f0fdd01343be6e741196a7b7f832f970d6c0d06dd8f5e4c380513b558b7a5d87b91dedcfc7bb794def97ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511607, "uuid": "24b5a14c-ffb2-419b-be4b-65c1a30ba4de", "value": "T13B746B4E58C61F2F96EC392883F902358DA6AF44401990A6ED337BED5F1A45C22763FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511607, "uuid": "23b43dd1-13dc-45bd-b7d8-bdfadad21b4c", "value": "6144:QQKlOIKjy8sf6vEeh83+S7fB+/iKk7Lt9XpklC3lgZZ9RK4E686:TeEJs/9h7fs/1kF9XpFWKiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511607, "uuid": "64b30713-b5f2-411b-9ada-9c7062a1a1fa", "value": 352179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511607, "uuid": "c1d2b0a7-bb78-4ccc-8537-c2ee84874a26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511607, "uuid": "ac3d5aec-f7a6-4c1d-8027-f4b5cc81c3c4", "value": "Proof Of Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaed055-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521648, "uuid": "b7ef486a-1166-482b-aebc-8a67ce9b3d10", "comment": "Malware payload (GCleaner)", "value": "9a9fb4d288c680fe1b42eb6739e90e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521648, "uuid": "9ee01c45-c7f5-459b-b4c7-023e02c971b9", "comment": "Malware payload (GCleaner)", "value": "b45f06674745e4120595dc1ad0300c64c3c00256c88bb1c0c5d7ae606872b62f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521648, "uuid": "2b086997-54c6-43be-b15d-b74f93061d6a", "comment": "Malware payload (GCleaner)", "value": "2744777bf310fb53a26d90225c5e36f8891849f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521648, "uuid": "8ed4db60-4a82-481b-a80a-9a1272c0d79e", "comment": "Malware payload (GCleaner)", "value": "66c2f812a52f8ea6486ffb1ceb0d0b516d3ddc574f4f8663c07858aad71822a0bd35bcce7f07be5e3faed1d28101b330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521648, "uuid": "a9430d17-912a-4447-a06e-5372d9194b54", "value": "T15754BF5361E03C70E9775B728E3BD6A8366FF6514E25774A222B7A6F09701F2C272342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521648, "uuid": "67fd0410-33bb-4bdc-a414-fa4b3f9468ba", "value": "b16c3db38ebd1039deaa7b416b1dd4fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521648, "uuid": "5d956f76-6c4d-4f2e-aa73-8d7d8cac041f", "value": "6144:QceT2Dh25HqHNn1z9S+WSjEHI+ejwI2W65:c2DhCKtn1BSwIHFgHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521648, "uuid": "2c7091ac-2840-4b6b-967d-4230ba381c35", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521648, "uuid": "e5c4511c-475f-4c23-ae1a-dc8e219e661b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521648, "uuid": "44ea54f8-7e47-4ffb-bf90-3a149fefd92e", "value": "9a9fb4d288c680fe1b42eb6739e90e05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aa0b8c-ff76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685511915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511915, "uuid": "0c230ad3-f3df-451f-9fba-7a49f1f1811f", "comment": "Malware payload (STRRAT)", "value": "4e105498422dc4730f1b2b7511055a8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511915, "uuid": "b08802b7-9a97-41ea-b9e9-f31512d4938a", "comment": "Malware payload (STRRAT)", "value": "b478720822b30c55218ea31f592b22f0042bc00f900e8991f7879c6fca79d3dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511915, "uuid": "b23231b4-3db1-4ed3-a488-54794c3d887a", "comment": "Malware payload (STRRAT)", "value": "cbd3449600220b0fb3ee34f6d2d3b968e89e92d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511915, "uuid": "b6c108a5-9637-48e2-ab49-5ef842551884", "comment": "Malware payload (STRRAT)", "value": "52f06315882df8eb6058c943f46083466bf94f68a256812ef90e5020379268c2b2b32d211e000e1258a481bda732ef12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511915, "uuid": "b09dbb79-ac16-4efe-aff0-a52e982ba48f", "value": "T1B2746C09C07606D6BE70D0248A9E3F9BB397F98D3EE0944B01B5FFAE561B6C4855F908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511915, "uuid": "23c33d24-9377-4b1c-8e65-8658e5de7fee", "value": "6144:eNMXPBQOJOAj+zKHOFio0Kezk3AAf3+RH7wBx9ICcJWa8GUsxVhg:1PBvXjSiPi3AAve7whxa8Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511915, "uuid": "bbe530bc-74fc-4bf3-986b-276f2f6aee10", "value": 366869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511915, "uuid": "eb5ffd04-0aac-4598-a7df-66c8cf9fe894", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511915, "uuid": "205e379c-9d23-423d-ac4c-3e3c9a5591ed", "value": "new purchase order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f377c7-ff98-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685526735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526735, "uuid": "0aea1e0a-7c79-49b1-9351-5155250181c8", "comment": "Malware payload (Gozi)", "value": "7b12bd965a8d0a8feb4975d1de432349", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526735, "uuid": "bb9e9299-0d2b-4ab7-b46b-e2892d6c96ac", "comment": "Malware payload (Gozi)", "value": "b4a6e624afd7b5e6013011c380ccceafb15993090dde5f773f79dc8ff9783575", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526735, "uuid": "7ee8d6c5-0f78-483d-b83f-671146c71095", "comment": "Malware payload (Gozi)", "value": "d293cc5069f6530b1ddc836eada238c84d0c4d8d", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685526735, "uuid": "edce9cd5-2fc6-4c6b-aac4-3ebd36456505", "comment": "Malware payload (Gozi)", "value": "cb90d897f4822ae2794677359ccaafe4abe9fd9a2e941d6afc4f0839fb59975a19c2c1132431fef9bdf5159013be1247", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526735, "uuid": "80584496-cd66-466e-8e44-1925257c80b9", "value": "T16282081145DB1FB41D03E2362EAB07F1EEC2A0595996009D7BACFDA4D72C9BC2279B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526735, "uuid": "ffcb81d2-5652-4db7-a1bd-c6c7129f164f", "value": "384:adJfglkrq5i55kSTEZNxuElQwkSI5FUlV14dUNqoAE0gxWEzOAar:a4CxaaEZNxuaQOSo4dUNq9E0gxW0ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685526735, "uuid": "025d4e09-6909-4ee7-a04c-cf890f09b4c2", "value": 18765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685526735, "uuid": "26c83923-30ef-43ce-ad36-f9229d7f3cf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685526735, "uuid": "e2c6b697-2ced-40b8-a9c4-9948b0a8f70b", "value": "Fattura_31_05_23.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929d3df1-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685533929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533929, "uuid": "417ae386-65e2-4cec-9218-d97c4f13df00", "comment": "Malware payload (RedLineStealer)", "value": "4513016ed9b9a7e7fef4b364cb372dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533929, "uuid": "cad5337d-53e8-41ca-b250-a0ce953caf6d", "comment": "Malware payload (RedLineStealer)", "value": "b5eca4cbd012265d341116ee6de9ca4d1a951a55e3d31145b0d0d887497619f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533929, "uuid": "dc5aa960-f0a9-49e9-a485-d8af534ed50b", "comment": "Malware payload (RedLineStealer)", "value": "0a855045deb6ae4cf287c1a06fd7a38f36001107", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533929, "uuid": "578edeb8-bac1-4640-b662-36c7940dfbe8", "comment": "Malware payload (RedLineStealer)", "value": "f6cf710de7971152ea331556fe891f2b134fc732c4f3d10c28755e67e56aa2c58a690583e5843393849fe50cd9b908e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533929, "uuid": "abf6a270-f79d-4965-b66d-dcd1f5c71619", "value": "T1F8F42303AAD99033E9B9677054F316831F75BC221D79437E2746CA2E8DB3688E871367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533929, "uuid": "46816833-dafc-458c-b192-5bdef468ce6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533929, "uuid": "0c62e551-3793-4bc1-ac06-2b367eb9854e", "value": "12288:sMrtTy90Ex8pJyI0fQnzXRt1KL4xnzkYWN7SwKw7H7Zu8OEstR:pyXxYyI0fQnzrPxzQnKsHtuBLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533929, "uuid": "08739eb7-a30f-49ce-97b1-c4c53115c2f3", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533929, "uuid": "f369a3bd-7d69-415a-89a1-21158ffd45e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533929, "uuid": "e7e49b85-19d8-4142-b5ec-562bdbb1fef8", "value": "4513016ed9b9a7e7fef4b364cb372dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308599ec-ff90-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685523027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523027, "uuid": "02b37055-1584-4b1f-b924-2a9f25a03507", "comment": "Malware payload (Loki)", "value": "fa2f3757fc80781a717cebf54ed81962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523027, "uuid": "8a918ebf-72d6-4844-8e1c-e1a8d80995ff", "comment": "Malware payload (Loki)", "value": "b744bae65129d2d9980029a4d55b4552c79a28a5afa89b48e0a383b96078231a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523027, "uuid": "9ec356a7-e1ee-4fb2-9713-c0d19960d9ad", "comment": "Malware payload (Loki)", "value": "c5bf1799bb004d8dade0f29fb7ee4bf75836bb9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523027, "uuid": "c4cf58ea-585d-46ab-9ee3-91fa6e25fc5a", "comment": "Malware payload (Loki)", "value": "c7449fd1f0b342cf78ae411ffc70e1dc33b1bff212947b8f6a73815cf41562e2a82e731228afca33c0322b61271b77d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523027, "uuid": "22dec872-41fa-43a5-bdde-dfc0743e6aad", "value": "T1FCA31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523027, "uuid": "70f06beb-acfe-4d15-83ef-1df7b753f324", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523027, "uuid": "cba9e720-fc1b-4783-8a45-27fa289d7259", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685523027, "uuid": "5f6b7651-95cd-4541-bd3a-38fccfe59d57", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685523027, "uuid": "e765ba4f-0a82-43e5-a3b6-34180a09dffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523027, "uuid": "d30c75a2-033d-430d-a0fe-6fb68e1931ef", "value": "fa2f3757fc80781a717cebf54ed81962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42234340-ff95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685525204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525204, "uuid": "8d7274dc-ae96-4363-9304-6a41e55041cb", "comment": "Malware payload (Loki)", "value": "ab63cd70848e6c0cc499abcb927735e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525204, "uuid": "a225f417-4f6c-4777-8efe-a053291a23ee", "comment": "Malware payload (Loki)", "value": "b84fb2b35829e25b9f3e5fb31e2cd3359009f1d04e719653eaa8c1437e3625f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525204, "uuid": "4fa4d9b8-da95-41dd-b64a-f3e45d71e610", "comment": "Malware payload (Loki)", "value": "499c19a09cd1e1bf79477c1d47b5b233a21600db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525204, "uuid": "680b906b-820f-43e1-91d5-dfbd27d0c634", "comment": "Malware payload (Loki)", "value": "0c11758212f433f13f609c945c2de9046f14919274c9a975ceeee4f48e3adebff48355151e7e02ac76afd41be7f1cd26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525204, "uuid": "391ff974-ad35-41c0-bfff-68cf7c5f1abf", "value": "T1CAD41256DB7F5B0BC5B77DBD1A304030BAECD545A42EC1ABEA97081FCC09E349D92262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525204, "uuid": "88bc40c0-1a6b-4375-9362-105e361f9dc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525204, "uuid": "2b657b37-2457-4024-b096-adceaa414987", "value": "12288:85AMTihh6xhZ6Ore5QQDepRMAo2XNEPbX7PiD0nIlioSNjS:BMUgh8ye5SpRVPXNEPHPi4cioS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685525204, "uuid": "944eae22-3bdc-40c8-9510-6494fe3e7b14", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685525204, "uuid": "4e2266d7-c1dd-4f35-adcd-019a7ae5bd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525204, "uuid": "10ed935f-88a7-456c-a8c0-fcec15966222", "value": "ab63cd70848e6c0cc499abcb927735e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf02b2f-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685528146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528146, "uuid": "bf43daed-b3f9-45f1-a7e8-4a2c9b9a269f", "comment": "Malware payload", "value": "cd807a009f8be90bb3adcb6be273d49b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528146, "uuid": "a9a8dedc-af06-4c1f-913a-3bfc4be02f56", "comment": "Malware payload", "value": "b9689d9c53f3ae93ad44819bc9565c90ba04086a75376d268498cac29fab3cb5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528146, "uuid": "59d322f1-3aa2-48db-a40c-e99d3e01a854", "comment": "Malware payload", "value": "46b475419cb823b90ef37b7110bd811acadc21c5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528146, "uuid": "8c852878-7009-49f0-8651-7d16f813de42", "comment": "Malware payload", "value": "50f932b3289af797f847f596015fbec60d1bdc23b13fed62ed8a1874e4107a87bed9db588ddc76efa439c6643ee167d7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528146, "uuid": "b584a1b5-9ea9-46bd-aaae-5e62ac3ed67c", "value": "T19DA57C11BAC28022D16E0636E5ADFE691938BFF20B3084DF67B43D5E3E744C1A675B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528146, "uuid": "a2f86001-b759-4221-94a9-95b40861d0ed", "value": "24576:VNlx5NLMg1O+HmV5B1F8oN5072aCVx8072aCVx8072aCVx8072aCVx:VNLjHmV5B1amKD6pD6pD6pD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528146, "uuid": "6dbfd2c8-68f6-40cf-b1b9-f9bd35b62a4f", "value": 2267232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528146, "uuid": "1269dbc8-669f-491d-aa2c-1daf5762d92b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528146, "uuid": "39238da7-07b6-475d-8b53-54396a8ea2e9", "value": "FACT64771.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1119018-ffda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685555133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685555133, "uuid": "63b2b065-d187-49ae-9fbf-00536b97d9c8", "comment": "Malware payload (njrat)", "value": "b72f3fc55ae3de481cad90bba27dcb15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685555133, "uuid": "2d180b86-83a0-478f-abdf-2f8d01b5cfd7", "comment": "Malware payload (njrat)", "value": "ba93ee7bb38e10c6b38fb3c37798ad618e20b4f3d5125bd8d5de77f23afc3dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685555133, "uuid": "d960e61f-a905-4008-8fc1-fdc816a825a7", "comment": "Malware payload (njrat)", "value": "7d0207d40747fff10f6e233e35bbefa9207f044d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685555133, "uuid": "54bfbc27-9b9d-4354-82d7-fcce71008880", "comment": "Malware payload (njrat)", "value": "3f19cbd9ba82da3112f32a32736f0dc867a13a7200b45937c902cbe1000a243739f5f78e2eab6daf0c96deffc15c5778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685555133, "uuid": "35846e87-c9fe-4235-a2c3-5950d15c07fa", "value": "T16254B36A9B72E48AE1D536FE6BE3E21050289FFAD4029909C4B0F1207FB7A53DD5444F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685555133, "uuid": "7b004665-0b54-43f5-87d9-a5e8b65a4711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685555133, "uuid": "8f7e7535-0e83-4997-9e6e-a5d2ac54f1f3", "value": "3072:VsSeAmR5SqlxXOu5pMo3Pvn8faDZXNOBdy6u4zWvoh+KOu57Xh7cT+sJTk:VsSeAmOqlxD5p2qLcgC3h+Fu5DWi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685555133, "uuid": "27cd9a46-d255-4ee1-8b46-ea7d0faaff2b", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685555133, "uuid": "138164a1-f02c-4430-8e83-a63d6cd59bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685555133, "uuid": "4c333378-5292-40b1-9c0d-48577947dc35", "value": "b72f3fc55ae3de481cad90bba27dcb15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cbabc6-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533964, "uuid": "ecbe0925-b45a-4e14-93ff-62496938a7af", "comment": "Malware payload (Mirai)", "value": "4e5690a208c4b9ad678f4659d61c0ea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533964, "uuid": "faad5526-b12d-4064-adc7-d2f19b24ae05", "comment": "Malware payload (Mirai)", "value": "bab9e859e177c625464f6419c3f7d1a438add2b6a29f1625766f7a9eca80566c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533964, "uuid": "cfa4a14a-005c-4005-a19b-35b29fc3bfb2", "comment": "Malware payload (Mirai)", "value": "ec105a0cf99c2129bcdf2b898386c9a3d46ddb1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533964, "uuid": "b1241684-4c95-427e-8c4f-65af513bc934", "comment": "Malware payload (Mirai)", "value": "1c43e7e29d3582d7afecb86ef1533b9bda6b47956c3b896180be5a513ad00c967821de2a3d13cb1ab8c08c686f911295", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533964, "uuid": "17f031cd-a521-436a-842f-f64275e9c741", "value": "T1E1534B02B71C0E13D4A35D70253F57D197BBAAD022F4F684252E8BAA8A75E375182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533964, "uuid": "565f59b6-769c-4d65-b2e4-9349319c9b07", "value": "768:JwZN6sxR+wVRpiRNhxYR7FYG6hpCk3Ne2tEM58/U93ycztvm3SaNBIOFV+tDq3wZ:CZdaBAYY2ewdn3yye3SaNe6+RqgWel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533964, "uuid": "48d97730-5a35-4835-bdc9-23f3c01d21db", "value": 65212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533964, "uuid": "d3a3c05f-791a-43b4-b309-42b4aa1d6bf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533964, "uuid": "0c8b6a08-b3fb-4cb4-8a20-e13760f4fa70", "value": "4e5690a208c4b9ad678f4659d61c0ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821e82f9-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533901, "uuid": "21f7de70-f62b-444e-b5d7-27ece5647de5", "comment": "Malware payload (Mirai)", "value": "68ca4bc62ffbae8effb1419ed7b35836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533901, "uuid": "7d55f5ee-b06e-4c8d-8671-7a0ffbb1eaca", "comment": "Malware payload (Mirai)", "value": "bb2b41c7a331d4f3dcf88bf70bd5be9a754fc7e930071ef32a0bd356d9ce34b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533901, "uuid": "630bb403-194e-4980-8f3c-e89ea5b22027", "comment": "Malware payload (Mirai)", "value": "08e31febdbcdf9262fac61f87bd5d1bbf80ef288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533901, "uuid": "2b26512d-9bdc-4259-b870-3201da2df535", "comment": "Malware payload (Mirai)", "value": "521a1945cad4db7c4c27212df03fcdb2ff8b280b8970924c4ceb55e561178565198bb5c444d77958005af828cd23c7d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533901, "uuid": "6b7d8ea3-ce17-4564-bb34-a0b844e9cc80", "value": "T1C583A71E7E228FBDF759863047B79E21A75833C627E1D645E16CD6002EA034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533901, "uuid": "ecfce135-0947-440f-9eb0-f33f8ed1f7bd", "value": "1536:DIYkXCnKDwaABXUPWzIjUHbLdeMmB2Wub:DIFXCnKDwaABKW8jUHbLk27b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533901, "uuid": "4337144f-cdd5-48b6-8118-070d7877db77", "value": 85760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533901, "uuid": "1a3d4eb4-2287-4372-8cc5-61ce7db73121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533901, "uuid": "16261612-3ef5-49c4-8c3a-dcc3be44c802", "value": "68ca4bc62ffbae8effb1419ed7b35836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c00591-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685521539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521539, "uuid": "b8f0956c-7ccb-4793-9b47-dcb3a3dfb54c", "comment": "Malware payload (GCleaner)", "value": "d521b13437cb4b492dd4e4634d693af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521539, "uuid": "852bc151-636a-48b5-942d-a40858e9ce4d", "comment": "Malware payload (GCleaner)", "value": "bb58187a9f2ae598a7a611c5be6b4ee42f256cef1f548d3baf2da5ba4c51b71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521539, "uuid": "45b6bade-5462-4eeb-bd53-62c541f3c5cd", "comment": "Malware payload (GCleaner)", "value": "882c7de835e3ba59bf251c504f132f06c4ea89de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521539, "uuid": "c9cd5e13-31ad-4b7d-9681-730825a5ec2b", "comment": "Malware payload (GCleaner)", "value": "de434814ada6d31c6c183f3ab267223ba8dde115ad7a802eb5875ddc15610b1f7bdb2217fb08b919e1c7cffe7f6a831f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521539, "uuid": "6a3d5119-f15d-4397-84e5-a2fdcfa6294d", "value": "T1D274CF1272D1A870E95656718E7AC6B8672FF5314F152AEB336C5B3F0E311E1DA32342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521539, "uuid": "9e52f36c-516d-4b02-835a-06b177b82e31", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521539, "uuid": "53449293-d851-42e0-83fb-449311ac6e15", "value": "6144:Bcf9T0+j8keEjfJSXoUSknk9V/B7WDip9ohW97ccYahiEt1X:BcVbj8keYoX1nk9VpKLhM7piEt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521539, "uuid": "21a9db5d-2642-4e49-82dd-e03f0c064189", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521539, "uuid": "a2028b82-95d2-40db-93d7-4a4e0fbf0ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521539, "uuid": "72b55117-8261-4c16-863f-4b85a7d384fa", "value": "d521b13437cb4b492dd4e4634d693af4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4223d8-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533673, "uuid": "d08e7034-c422-4a1a-980f-d435e607f6fd", "comment": "Malware payload (SnakeKeylogger)", "value": "495d8af23d282c25c53ac94805eedab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533673, "uuid": "c5460cfb-6b6b-4593-af21-2ff6aeb8351c", "comment": "Malware payload (SnakeKeylogger)", "value": "bb8e3470cf05d4aa4e74551b11a39436681db63206d7c1bee0ddb4bdfe99dec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533673, "uuid": "e82b9633-0de7-4583-99a9-8dee297ff8c3", "comment": "Malware payload (SnakeKeylogger)", "value": "1a377ec0bcbe1a1ddcdffd7ede7079f38eb3e44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533673, "uuid": "7ccfc4de-83ec-4e15-8277-f5f3dd4c8ee8", "comment": "Malware payload (SnakeKeylogger)", "value": "b796a2e67fe0ece46f4da99179423b17a780fe3dcd66f2df38076e1f1056bbd24f40adf83122aa0e59dc8a099e94b96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533673, "uuid": "ce309a5d-d3d8-4377-8777-ea463523818e", "value": "T1FBF4F164DABE951EC8EB767CA570103052FDC508281BD3AC5A423C7FD83AF70AA53267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533673, "uuid": "364a9c74-f2ee-4f4a-88ae-913b99e75af3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533673, "uuid": "1ea041b2-e769-47b8-a7c1-20a665b648d4", "value": "12288:pfjU22n22f223229AMTihh6xhZ6Ory76iaCfBs6EqbyGkvSgoKHeWeBU2kJMMMDg:ZU22n22f223222MUgh8ywguy8sHWQMM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533673, "uuid": "72f41840-0b8b-4947-b8d1-d90d2265b695", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533673, "uuid": "6238107b-50c0-4675-bff0-b38801e4ffa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533673, "uuid": "72a2e14c-82e8-495e-b04b-3d40c45d0abc", "value": "LSl71RSdKGfhuNG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4475c1b6-ffd3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685551837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551837, "uuid": "e1941796-59c6-4ba6-82d7-391c8da9f08b", "comment": "Malware payload (AgentTesla)", "value": "8a1e832674033cb7fdd73a8cf55971fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551837, "uuid": "62410fcb-1380-47a4-bb4f-c78597131808", "comment": "Malware payload (AgentTesla)", "value": "bb992023216a9723d9157cacbe3f2dec846902eacce0122734d6111c85ee6309", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551837, "uuid": "8a36d023-6123-458f-9d57-56fe3c3904ca", "comment": "Malware payload (AgentTesla)", "value": "0923b3c19a178a797e7dcf784c9060338d0dedef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685551837, "uuid": "8adf08d7-2393-49d9-a0b4-f77b15f63319", "comment": "Malware payload (AgentTesla)", "value": "6977281e80adc1b833d4c9b192abdd02d578e3dec16b785906932d1531a8809d4ff56bff9d3fb1b41547d83ad9c6c26c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551837, "uuid": "c04c7dd1-d592-448b-a651-7ca82dd10e07", "value": "T15064124435C8C417C9265731ADB9DAFAAFE89D02D8A58F4B17E06F2B7971386C90E313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551837, "uuid": "8ed4458e-56d7-472e-868d-03461b1e0fc6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551837, "uuid": "fc9abf9c-e339-4a4e-a5ad-ddf941e39421", "value": "6144:aYa6rlD/7B6uUhmwYAzSE2lBPp5zp6HB+NO1cTUX9VAMh1+Lxwr:aY1Rt6uUmxTlp5zpogqhMx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685551837, "uuid": "3d0ea67d-426f-456d-8ac8-3636d0bbb557", "value": 328888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685551837, "uuid": "80928410-fb4c-447d-b071-f428b6cdd5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685551837, "uuid": "7c2d9ab0-349a-4af4-867f-af440c1d2ed8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd779a7d-ffac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685535397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535397, "uuid": "6aabb5de-d9a3-4336-a3ba-1e152df490b4", "comment": "Malware payload (Quakbot)", "value": "e54e010b3202522a918e2ad6ad95f893", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535397, "uuid": "840d90d7-3f3c-4e63-92f3-dff18235cadf", "comment": "Malware payload (Quakbot)", "value": "bb9cdcd1154fe8a544917b27eb35afd379fe0ea10235307663bef706160f9fb7", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535397, "uuid": "07261cfc-b7d9-43b5-bedf-7889042334bb", "comment": "Malware payload (Quakbot)", "value": "602670887fdd70eabce1053252cdf18790efdaad", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535397, "uuid": "cfac2725-a0aa-4107-8c40-f95c60f16c4d", "comment": "Malware payload (Quakbot)", "value": "0fbc58048e2dc80f03cbbc9acad3fcf5c6ac3351c30933f724aedc0d0d1fde5a54c72b44f55d67cec773c2ff37a56480", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535397, "uuid": "aad80738-cb04-4b10-bb22-429a227c7cbc", "value": "T1D131C619DE27052CCEB44134D0F40A88B6812E8C60CF5306B99B26DE8C12382864FE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535397, "uuid": "917e8dc5-1c80-4367-8024-8a5d5f9430ba", "value": "24:9+AhKKH0G+UOLG/SdmcoXP6Jj/7pMpLd+D8+2RfNRMpF/UWYslLDczAsog:9/mGx/SdmcoXPA92dAx6fNapOWAUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685535397, "uuid": "ddbf236e-26e4-42eb-a209-b6e612c18627", "value": 1455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685535397, "uuid": "e17e785b-08c6-4787-a5e2-36b47484fb1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535397, "uuid": "80c65065-403c-475e-ab70-a682afb90dd2", "value": "doc_D704_May_31.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc429a94-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1685521597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521597, "uuid": "66d00a8c-fd41-4b54-8821-1c1dcd9ac20b", "comment": "Malware payload (LgoogLoader)", "value": "fcc58d9d4d7d202bdba84e0cb7cdf4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521597, "uuid": "211d8f3d-f5c0-41af-9e45-b8e6523870bd", "comment": "Malware payload (LgoogLoader)", "value": "bd3bb713b9523d155c0b81d5ab2e3aa02bf5afa641a168c5582735e6d1b3d710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521597, "uuid": "53537a99-b934-4ee0-8089-114323a0a51b", "comment": "Malware payload (LgoogLoader)", "value": "8e7bac43983c6cbe15f26dcb94ab5c205fd04e03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521597, "uuid": "3738d5f3-0cdb-4d66-9c88-3985ea729ead", "comment": "Malware payload (LgoogLoader)", "value": "2e60cc430e32b9d2228e556df2b7e2e0560c23a3accc91a1b75a13b1e7d818c911873f8d5458a6ce9601b77578415cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521597, "uuid": "d0b77309-54e8-4089-846f-77aeb1c198c9", "value": "T1F8A5129473A1C063E74C82358A66C1B0A3BABEB9E516D25739CC7F5F37B43821532297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521597, "uuid": "4bd10545-14fc-4cf0-9737-bc769abbf814", "value": "49152:NnoyoWrAnzcL+gh12wNQ57HcbHzr3G6mm:Nnoquzc8wNQx4Hv3sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521597, "uuid": "3b6bf8ba-15e4-4991-bf08-d50a5c0eeff5", "value": 2089840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521597, "uuid": "aea90e49-9e4d-412e-bb3f-ba68bb4f91dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521597, "uuid": "e3e88128-8920-478f-83fe-45ec7748493b", "value": "fcc58d9d4d7d202bdba84e0cb7cdf4b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc51b862-ff6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685508256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508256, "uuid": "07ffc865-8b88-40f3-bd5b-8de5927e953a", "comment": "Malware payload (Formbook)", "value": "6e201981b59dbed41004e8a0787ab06e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508256, "uuid": "4cbec001-485a-4c31-a8fe-cdcf6c5bc407", "comment": "Malware payload (Formbook)", "value": "bf6b4761b00e6361cd51396ef2ea47edf870755fd4341becee627c39ea2fb315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508256, "uuid": "3e2a96ed-b5d3-40b2-be6d-9927e6a12a9b", "comment": "Malware payload (Formbook)", "value": "1f3ad860838da18311e09c3ab42ec1c0508e8050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685508256, "uuid": "1326c4d3-1164-408d-a7fc-6dda5b7b20b3", "comment": "Malware payload (Formbook)", "value": "6fe33559c7a8a0639a54fa7e9b7729ad80c919b1e606382aaad70c6dfdd39cb3ada5d2d3bafc890da9912ef66136700e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508256, "uuid": "7b23a473-d82a-41d5-9bf9-84a8a4a5fb63", "value": "T134650232464FBEFFFBE90D64D88B15880CC86AAB521C50A4BD8845DF32B5A54ED5EC70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508256, "uuid": "471a5c15-1f95-4340-ab42-eeffc6274426", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508256, "uuid": "86da7174-a507-4861-a16f-84af31a3d15a", "value": "24576:pLvIBEPzAZIUk/EC5hQk4cUN/fn39s9zcCImSKh+KtjqX:pPz6MEBgUN3p9GJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685508256, "uuid": "fa04586e-34bd-4706-b6a3-f9f9dd03a047", "value": 1439232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685508256, "uuid": "df3db671-82a2-4c10-b422-421dc06b4804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685508256, "uuid": "53b0d73a-24df-4b67-bf88-5fc2ee93c07f", "value": "6e201981b59dbed41004e8a0787ab06e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb50558-ff67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685505468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505468, "uuid": "31d727ad-d9cd-4adb-8ff3-8eef403b9722", "comment": "Malware payload (Loki)", "value": "d9eca8a9237d39e32b892cacd27ac633", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505468, "uuid": "aaf612ca-04f0-4bd3-9be2-485a4da1bfdd", "comment": "Malware payload (Loki)", "value": "bff33f3b468dfa85eb29f6d1335ceb67c54c5630dbc21d1261978f27cab57f45", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505468, "uuid": "10aaa53d-e387-4c8b-9866-63174f7a41b4", "comment": "Malware payload (Loki)", "value": "da6ba5172d51e213579d437cabdf5e05c6a085a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685505468, "uuid": "1a780f72-92bd-40ef-b9f0-c64a33005470", "comment": "Malware payload (Loki)", "value": "baac78216c9dd18671f6aadc03221c180333ec86269cb4edfd63f39be5227848122617f20e84e4c68e49959c2da2987f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505468, "uuid": "63295240-9351-4a14-859b-3773031aff70", "value": "T182D228565B8C4C61E269E8BB874DA00E19BCF23634C205C5BD9DE2753B7D14E0B6B2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505468, "uuid": "a576a61f-8aa6-415c-ae10-389341c639f5", "value": "768:KSPrE+H1B2F8YNEy6CldGpSeNRBcIewu+pPfiUXdMeRU3sll4+y:KyrZYNEyrYSeNYItiUqeRjll0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685505468, "uuid": "57c054c0-e5dd-4a03-98c7-4e8be3dbc3f1", "value": 28341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685505468, "uuid": "5ffc55a3-cd73-47a8-b876-b6c2d3b377a0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685505468, "uuid": "edc43142-8c5c-4e0d-accb-5d4d2fbc1709", "value": "d9eca8a9237d39e32b892cacd27ac633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a63d79c-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685522292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522292, "uuid": "2d50c391-e5c5-4671-8a52-f77180b0bcfa", "comment": "Malware payload (Loki)", "value": "a75b82ea2020ba61e2679c2f09d589cc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522292, "uuid": "77c56399-53d6-4b1d-82ae-36af33be75cf", "comment": "Malware payload (Loki)", "value": "c13a2c140be5190da2ef623ed656ae55540ec61a7fbcf9f59ae4da3e0f7001a1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522292, "uuid": "e6644035-2b38-44ca-8ca0-d8c2bb54b646", "comment": "Malware payload (Loki)", "value": "b6bf123711ef4204675bf63ddd5e65ac8399eaa1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522292, "uuid": "1334d618-ffa2-4e52-b16a-d0a4abc9b4c1", "comment": "Malware payload (Loki)", "value": "1902fec5462d867028f2531b1a4c5fd9b48fa282cf13d4e0101cafcb4f7d2ef6f0257d5d2ac9a65903144bf9b8ecb296", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522292, "uuid": "f5210aee-cfa4-4f3a-b148-e515e3a4ad01", "value": "T140C2EF565B8C4C62E269F87B865EE10E48FCF23630C255C5BD9DE2743B7D10E0B6A1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522292, "uuid": "6f995dff-40f7-4d9c-a848-0bee46a98cfd", "value": "768:ZN5evRhW8z2x7pXnOBwGWGwiIr3xfQIPphFZe3z7KiSJk3lSDw02dt:3QJhN2x7pywGWGt+xPPrKy7Gf0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522292, "uuid": "af33be6b-8c48-419c-abad-d9c716c4d0bf", "value": 27473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522292, "uuid": "99f5ae25-ad22-4bcc-94b3-37a978774739", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522292, "uuid": "c33e9b83-3db0-4ea0-ba63-a323d1c04da7", "value": "a75b82ea2020ba61e2679c2f09d589cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de8db3d-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533867, "uuid": "b8a1b0a3-186b-498f-83c7-fc8d6321b62d", "comment": "Malware payload (Mirai)", "value": "1fbe82e4d22a3a5db279d49263955546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533867, "uuid": "42ecf63e-f91c-4b82-b34f-b35fa571dc42", "comment": "Malware payload (Mirai)", "value": "c1f8bbd695b824fec3abf19debbce89fae45bd58e445954f859ca9dcfdb6c355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533867, "uuid": "5c6ca8de-36fe-404c-ae9f-4daac0efe2d3", "comment": "Malware payload (Mirai)", "value": "7637f18cd5a39c2956692d69c694667a192304b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533867, "uuid": "ee1841d0-5490-4a87-9dca-5c0e96d80fac", "comment": "Malware payload (Mirai)", "value": "7548df7b8a6cb9e55492140e3bb7b9eccc2cd29f389466e298b443632188b1317bdd7142ea7995e9c3250be21f65e6cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533867, "uuid": "ab041d23-c15c-4100-addd-6a7155afe526", "value": "T16A83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533867, "uuid": "14a1bd20-037d-4d40-b305-aefb51df391c", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gT67ZDYovZ73x/nL8y8QE:Rakdn2Eo3eQaV6T6RYo99Be037WlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533867, "uuid": "7bcf2e3c-6e16-449b-a117-211dc0828f45", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533867, "uuid": "ad6fd1ce-5991-4a25-a954-76cbef361681", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533867, "uuid": "af7b4b4f-8571-45a4-955d-490e938766fd", "value": "1fbe82e4d22a3a5db279d49263955546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bc24d3-ffb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685539241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539241, "uuid": "d62cd8e8-a8d6-4c13-9387-796b446aff6b", "comment": "Malware payload (AgentTesla)", "value": "4be7638fdc46975eeaac9bb5f3939e66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539241, "uuid": "e25440b9-bfba-4af1-8223-37e31f0e9e5c", "comment": "Malware payload (AgentTesla)", "value": "c261674efa44bd9deebcf6b478ffc330fc97f73b8ca586cc8c79ff6de693bd1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539241, "uuid": "253acbdb-e9c2-4f66-b339-85d6d317a66d", "comment": "Malware payload (AgentTesla)", "value": "8190e22f27de4012331b2644c836fd310d34bd30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685539241, "uuid": "ad6c3041-5e73-4bec-99a5-2dad88bac182", "comment": "Malware payload (AgentTesla)", "value": "d3d1949da2c2a7a41f513b48077c75f4eef6fb3eb1511e9ec573e644aad87b9491d1c66db6d01e2f015efc9f754798a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539241, "uuid": "64f1c78f-db0c-4133-b5d9-d9a3799c8bd4", "value": "T12755F27257C2FFF977A60D64DC8A25400C912BFB97985064F9C839AFE2B5530E985CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539241, "uuid": "217a5614-f176-4dc2-97e3-56cf8d39f53a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539241, "uuid": "d81cc3bc-a87e-4540-b723-dd13472150df", "value": "24576:OmyuHw1Lnk+fL6dmliF98uiPCjKfTohyD0mSqn16lqZDmLEi9:O1uQ1zDOASObPCy4Rq160", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685539241, "uuid": "0f56f314-2b27-424a-b60d-4e2d169f513d", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685539241, "uuid": "a98e4bd8-eeec-41ad-b1f2-3f127ec7a5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685539241, "uuid": "1054f35d-0284-4162-aa22-0588f6549151", "value": "OUR RFQ#20230911-3.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad865f6-ffcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685548894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548894, "uuid": "1ccbe09b-9659-4fd8-808d-bcd2d313eb4d", "comment": "Malware payload (Quakbot)", "value": "69bb6dccea92cd67d4d00ede99cbe684", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548894, "uuid": "abc88186-9c75-4c1d-bc39-0ddcc5d52556", "comment": "Malware payload (Quakbot)", "value": "c32a4139aa0371e89f88db1a78e7ba8c4c32428bd8f228bf02fb55b61e13f601", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548894, "uuid": "a95cc667-7bb0-450e-8326-e03846b13f17", "comment": "Malware payload (Quakbot)", "value": "3e6c99720de035fb52b889b6942386fecf3d2627", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685548894, "uuid": "7d5932e1-78a0-48e0-93b8-638134df8b5f", "comment": "Malware payload (Quakbot)", "value": "e1748bbf2350d31ce99c6fb98e9d335cf0ca81e5127377e08ec9b24b15d54ff9fba30e8312267975b2011739611260a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548894, "uuid": "b84c6521-61e4-4623-ab23-b299484b76af", "value": "T17AA1C5769F4989BDD199FD081094ED0FCAC5C536211F6D93FB0B48A578ED81883BB9C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548894, "uuid": "76d14f84-5b76-4983-a3d1-4fd10895ea2f", "value": "48:s5H94NqzqFFNo2UkkVwRb46mfZmfnmf79Rkc3iKdHeSxFKV34ZjAifofof67KLmO:K4NqzqFFNx9bFMBlFmUAAVSFSsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685548894, "uuid": "8893394b-0c35-47cc-ac2e-1a5c8d485f91", "value": 4954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685548894, "uuid": "46df6899-5d67-47ed-a9ac-4ab594040bb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685548894, "uuid": "d4e8d425-708f-4d56-bb20-4b9d377c2ff1", "value": "doc_C604_May_31.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8796d659-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685520596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520596, "uuid": "b75a5003-1d6a-462c-9bc6-bdc1484644fd", "comment": "Malware payload (AgentTesla)", "value": "ce362b6095b1104c8e5bc8a1016be25f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520596, "uuid": "be1d59f2-3447-49d4-944e-5ef309815601", "comment": "Malware payload (AgentTesla)", "value": "c48351300bbb0c3615e445d9bef22ae9aa728f7975f62ab49d3a47bfaacd8eaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520596, "uuid": "99b5df82-f22e-42df-8e33-f420d3880c8c", "comment": "Malware payload (AgentTesla)", "value": "f5af55f5aeeb24186fab69d3ca73ebddd31dd1ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520596, "uuid": "0319ec82-c607-4681-aa57-1ebaaf469535", "comment": "Malware payload (AgentTesla)", "value": "24325cf3d12dc087168f694128d9ea4d88758c503043a65b878cbf8ae45c3de9470fe5e4738409be5fe013aca7bf8164", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520596, "uuid": "8ce7ccae-05b9-4a81-98a7-2b3377e935af", "value": "T192E41256EFBF1F1FD5777EBD5A304070A6FCCA41442ED2AAEA97182FC819A349C90121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520596, "uuid": "8a7f7f3b-ab8d-4ea0-b6ee-d07e2e4af691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520596, "uuid": "59dd219e-c19c-48e4-a5e3-5835aac05ddd", "value": "12288:WdAMTihh6xhZ6OrEm0zGg+dH8pHAKTqHeJaWneb6LGjTYJKE7Vky2:DMUgh8yEmvg+dH8pg5HeJaAebmGjTYcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520596, "uuid": "5986b995-f36f-439f-bf6d-bfa47f7b36d1", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520596, "uuid": "891c1217-feae-4187-9950-2370d1659383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520596, "uuid": "d1b88467-408b-4eec-910f-3bee3857796e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31b7e70-ff75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685511623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511623, "uuid": "3fcf8b1f-f558-4a27-a36c-20cf67db6555", "comment": "Malware payload (DCRat)", "value": "6f6a61090a9add724eebbec1c558826b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511623, "uuid": "7188f73c-74f0-4da6-908e-e53b7beba17c", "comment": "Malware payload (DCRat)", "value": "c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511623, "uuid": "00b360e4-1b69-4001-86c3-204f7e314da2", "comment": "Malware payload (DCRat)", "value": "566ea8db4bcea2d078fb71be08bc8e7003e36119", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685511623, "uuid": "e6f132f5-b52a-4580-84e2-d0b8d4682bf8", "comment": "Malware payload (DCRat)", "value": "26983ce9abd3e7cfb8b45201c4d207d729fa6358dbad895d93c45a766ef187a02fa5f40c25cf34d4ed2842f4ce77ead8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511623, "uuid": "f75a3333-28fa-49ec-a9e1-955777a8619e", "value": "T130556A017E44CE11F0092233C2EF454887F4A85167A6E72B7DBA377E59123A73D8D9EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511623, "uuid": "950f7946-c87e-45a6-b8d6-f434ec784f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511623, "uuid": "1c9ce2ea-e9f4-4216-a2a2-f6dbb2818ff2", "value": "24576:4LS70OsASkYS827M+8NFNzmJd+eVjW2LGLrk2WKiT:gS70OfRhxW1c2vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685511623, "uuid": "160db347-69b2-42bc-811c-b25f04db21e5", "value": 1351168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685511623, "uuid": "7f40fd85-5ae7-449f-8bd7-6d14f5316d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685511623, "uuid": "eb1d51e2-8796-4034-90d2-1023c35d9b5f", "value": "C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933c62b0-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685512884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512884, "uuid": "71fdc43c-22af-43b4-8dc3-4e235afff279", "comment": "Malware payload (Formbook)", "value": "9e87d445570c67c4e324e3d600f9d466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512884, "uuid": "61ac5209-b7b6-4f61-b8b7-df318f27d604", "comment": "Malware payload (Formbook)", "value": "c6a8a26cba06649f599b82e98ff2af4e2b9a034f52f8c1c1a9efdbba9becee12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512884, "uuid": "c0cadf1c-4014-42ea-8358-834faf198fe9", "comment": "Malware payload (Formbook)", "value": "518ab3f9d699d1cb2542815a5d7a6952694efd73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512884, "uuid": "7611a4ea-d069-4de1-b9f0-98c8bb5f1be4", "comment": "Malware payload (Formbook)", "value": "997cfd91cde1cbe244967d7131c6190450c6f672236d5347c9bf5e8317023f19fd9cd33c393cdf77ddf1b17e9bb4bc38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512884, "uuid": "0c4d6e44-6396-4a3e-b204-c00fdf2c8cee", "value": "T19154120866D6E463E9B001712CB98713AED67D2918F5930FB364261FBA33796C90F735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512884, "uuid": "cce62a77-43f4-4406-8d4b-688a462491bc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512884, "uuid": "fd69cc09-67ca-454a-a2dd-897d68455dbd", "value": "6144:JYa6eSavKVmaw16Um4WKOrDE8l4X7bppsIk1BPpIx++OyLfpR+T5z:JYIS1umNKO/XGX3ppsTBRIh7pR2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512884, "uuid": "19a47da2-3c55-4cb5-b357-ed3403c28149", "value": 295240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512884, "uuid": "e2700b56-ef52-4590-bdfd-e7981377fdea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512884, "uuid": "b28f2097-2442-4751-b947-f8bae495a954", "value": "INQUIRY NO. 217166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1320b6-ff7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1685514721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514721, "uuid": "995b7a8c-96a2-4f90-ba97-b4d05dbfdc2e", "comment": "Malware payload (NanoCore)", "value": "b2662708454ec2456f52db8b237c6c33", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514721, "uuid": "0c90db48-7acd-40f8-b8ed-257f52d7892a", "comment": "Malware payload (NanoCore)", "value": "c9c5e89d6da5c9da9cc6244be14270a8730604bbd55c78d005fd24d6c9714299", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514721, "uuid": "896efef0-57a7-4a93-9d68-18266effadec", "comment": "Malware payload (NanoCore)", "value": "f1b651b571cd6a7ca9a2939df25b5ecca440c065", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514721, "uuid": "f1cf1620-f113-4d2d-9f3e-636a6af4dcbe", "comment": "Malware payload (NanoCore)", "value": "13404107f62c0cc32d2d1dc3218f2b2b281978c2843bb073a9ac9e23b43f6151d59fa77bbed101438e2e4789d4658393", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514721, "uuid": "962664ff-a30e-49cb-b591-2eb78b8afcd7", "value": "T121649D0522B1891EE28E85FB60D1410247B9C9DA9ADFF3DE78B079B65B732D211473E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514721, "uuid": "0193b414-f6f0-4231-be84-ae9366c7d666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514721, "uuid": "21ca323e-ca01-40b6-aece-40513dd07c1e", "value": "6144:2LV6Bta6dtJmakIM50Qm2bTnvHbLOupQe4li2+m:2LV6BtpmkzizzLVpEs2+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685514721, "uuid": "102680c3-1fdf-43e4-9a68-571309bc3cb4", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685514721, "uuid": "2d68af09-123f-4ca2-a6bb-b403f625a094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514721, "uuid": "f9fef0ce-e666-45f0-8736-281b2bc140f6", "value": "02399999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b2cbd2-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533884, "uuid": "1e282bec-6e7b-428f-9126-b3ad38372ea7", "comment": "Malware payload (Mirai)", "value": "baac95ccd1e491bd681e13c235e493c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533884, "uuid": "5bcd28f2-aaa2-42ac-a81e-7dafa012a98e", "comment": "Malware payload (Mirai)", "value": "ca9b99d8ece1c61b1bab23516c58ec8211f704f06cca1109a250854a65bdc10e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533884, "uuid": "8ef64bd5-0fd6-4d1b-959e-01f382d1e8ec", "comment": "Malware payload (Mirai)", "value": "355b7f2dfa22a052dd2596b3e68bca3226cee95d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533884, "uuid": "3a547d0f-2f06-4ef0-8732-7728c56d7506", "comment": "Malware payload (Mirai)", "value": "769d775c231415ef4f912bd39a1fcd2e2175da723114bf2171a58001b8fdfd77daeec1efdaab942cab087f7c637f0b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533884, "uuid": "e0f28f87-3492-4c3b-bef5-c497cb719138", "value": "T1C0732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533884, "uuid": "8dcb4e3e-33f6-4635-9439-bf110dd11828", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftcEnA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFO6A5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533884, "uuid": "fc3bd3a6-9722-4f83-acc5-74d514699d63", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533884, "uuid": "e1fef67b-1fa2-4ec1-b159-e09421804dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533884, "uuid": "7f35f9e3-56a0-4d2a-a257-53cd0f0368d7", "value": "baac95ccd1e491bd681e13c235e493c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bf64d8-ff95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Zyklon)", "timestamp": 1685525217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525217, "uuid": "e910b7d9-db8b-462f-99e8-50e00854eeb3", "comment": "Malware payload (Zyklon)", "value": "7e63345c6e790bd58818a298eba69ae2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525217, "uuid": "9ee49d86-e084-4efd-91cf-6b145ecabc35", "comment": "Malware payload (Zyklon)", "value": "cb74248d3d1b1c17a1585e9c4467b03cea1a2cb3d58136a5316baa10fa619ff1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525217, "uuid": "58e723c7-e30b-4c44-80b4-1722f1bd107c", "comment": "Malware payload (Zyklon)", "value": "9107d99816fb5889805bf50c86a2e4c3760dbd83", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685525217, "uuid": "ad05971d-835d-4441-a23a-a17f1da93ce9", "comment": "Malware payload (Zyklon)", "value": "0dcf8158b0495912c9872d0481af5e7a5e9d1fba142f107d45e7dbb274ebb389c0367588e8f4087869889e651ad22c75", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525217, "uuid": "bbd98d5c-1ffb-4936-8830-9a0ab6a20e1e", "value": "T10AC52A0AB5560CE1CD4580F3C1D36B39DB60B80A0F1095FB2AD787EA6BEF2CA597D254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525217, "uuid": "3ebdd178-8d2d-468b-b3ee-3c656fdb6ad5", "value": "49152:7dMk1uixB1C4Z7QLRVAmJhxB8LRX/y4kQlr6Q:OkUixBMA7FmJyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685525217, "uuid": "96050d5c-f5cd-458d-983e-57ea7cca018c", "value": 2640040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685525217, "uuid": "a74c266f-0423-4d9d-b9d9-4dea1b461863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685525217, "uuid": "1757a243-ead9-41a5-9db9-f91af125fabb", "value": "7e63345c6e790bd58818a298eba69ae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aec3293-ff92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685523850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523850, "uuid": "d454bb6c-0893-40fc-9c3e-ffac3e4e6d64", "comment": "Malware payload (Rhadamanthys)", "value": "b4cbe89d7566e05654b18f3954b8c759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523850, "uuid": "9e7b306d-181c-4a4c-bf4d-c75892bf7d8f", "comment": "Malware payload (Rhadamanthys)", "value": "cb9dd1c185ebd8f800adaca5d2f268044a79b987d25d16a641ec1840be8fca0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523850, "uuid": "040f8dc4-6089-4712-bd80-839197c86df0", "comment": "Malware payload (Rhadamanthys)", "value": "62ab78a1f814ad00e5ad1d2a6f0a7e44fb9035f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523850, "uuid": "cd2fbfb3-d755-4b90-b748-9513aa16c007", "comment": "Malware payload (Rhadamanthys)", "value": "3cbcbe9aaca3238f521a9e06cdff440a2b02f962e4564c9633ca02abe78af911403919f9e0e1c94cb42bcd202caa73c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523850, "uuid": "7b50141d-7f15-4942-9ab7-59f89a5cbdd6", "value": "T139B4B0252DEB515EF3636BB21AD1AAF6D67FFD333605252FE212170A0C226805D90E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523850, "uuid": "2bc10c0a-64b2-40b4-b0c0-86f16ef717af", "value": "622a88682c24693792ff46e3135c6d5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523850, "uuid": "cd47940f-ed40-46b4-8f54-bb22f4e1f959", "value": "12288:dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ:WUp1VcjPKQy4N3MRoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685523850, "uuid": "9bd12b7d-5d30-4184-b816-a915c128afab", "value": 521792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685523850, "uuid": "6652a338-f6f2-4d5b-8262-9dd93caeeee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523850, "uuid": "1bd90c70-0184-451a-b52d-ad5979fcd16a", "value": "b4cbe89d7566e05654b18f3954b8c759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7311ec37-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533876, "uuid": "7762c91e-034a-444b-a0da-b00fd95d377e", "comment": "Malware payload (Mirai)", "value": "905f3a5ad84656eeff173845375093f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533876, "uuid": "b3766434-d869-4177-bb89-50b79ab74036", "comment": "Malware payload (Mirai)", "value": "cba79c2b9f1ddf7e9a429b6fa23b5672a2e0030784262dfe09ef2fa0fac9ff20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533876, "uuid": "976d629c-fb11-4591-b736-c23518611ada", "comment": "Malware payload (Mirai)", "value": "01669a615ba0922cfa0fd2e13c6e6875882adb4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533876, "uuid": "0a687fa7-4114-476e-a81c-b8048e072912", "comment": "Malware payload (Mirai)", "value": "8d465ceace90247e6038f41eab9a72e8d8fc5cd8d194f9117d4bbab912d8eafeed635d58a94352baf941a6932dc95512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533876, "uuid": "ba9a77f9-8a4a-4dcb-92b8-3225879fcd54", "value": "T12C3329A7B404ED7CF82DE77F4467040EB131B36054C20A6573A6A997AD7B2990C6EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533876, "uuid": "c5d174f2-93b7-40ac-b959-680414db445b", "value": "1536:30t3EAtEw0EwsEAqEAeJEwsiW/Kd5j8S+wZNsoTtnfaarso75Z:Et3EAtEw0EwsEAqEAeJEwsit5n+loRfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533876, "uuid": "855b12b8-984d-46f3-8cec-fe9d359c8824", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533876, "uuid": "d8951fa4-00c6-4a62-a6f6-af11778202a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533876, "uuid": "0651752a-dae4-4dbf-a0f3-44f818d98bca", "value": "905f3a5ad84656eeff173845375093f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f111e-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685533539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533539, "uuid": "a6ded7cf-2bc9-4e2c-b167-fa4a80bb2a75", "comment": "Malware payload (Formbook)", "value": "b502233b34256285140676109dcadde7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533539, "uuid": "e27a482c-c26c-400d-b0ea-4dba4b4c5259", "comment": "Malware payload (Formbook)", "value": "cca728b2bf0c9741ca58ec06d91d50dcecb2c49c2a6f029b6219c691ee798ea2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533539, "uuid": "4f8b92f8-7b61-4195-96d5-a6789072269f", "comment": "Malware payload (Formbook)", "value": "e4e89b4b78533e7486e90cb8f7770f889c8c8361", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533539, "uuid": "a336683a-297f-423d-a36f-2ad1ebf5f5c4", "comment": "Malware payload (Formbook)", "value": "b7652f742367debd6079cca77ac1ffdd316e666ffd8c9f6f7acd8bbbfb2a5a40ab80d419df93b3f168988a22cf3939a6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533539, "uuid": "57539f4c-6c72-43d3-ba6c-6e0ce3221d90", "value": "T1DD85F122F844B85ED6E9DB3609C36840813D7C8B6ADD1C8B6656730E79FB4E17722E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533539, "uuid": "56f29513-ef5e-4e31-98af-095b3260d4d4", "value": "24576:ZLKOJarDWhn+ATrDWhn+ZnaWsyF+f+CbHLvX4Ua8uHoo:ZLKOJarm+Mrm+Rsc0+C38H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533539, "uuid": "eea82287-fe02-42de-9023-2416cf6a3b7f", "value": 1720320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533539, "uuid": "3267d288-0633-4ef6-885c-044044084e35", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533539, "uuid": "45baad09-32ae-4e8f-b07e-54c479b20558", "value": "20230531SMTT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4245043-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685521637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "1b9e1587-560f-41dd-a98f-a438d8c791bb", "comment": "Malware payload (Formbook)", "value": "5fb70940bd7f21dc796a7d2f4e80145e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "7c56dff3-2e9b-436b-88ec-45913f9b2b97", "comment": "Malware payload (Formbook)", "value": "cd0120b7c1d114b73fd768a37de9e2c34fb1662a3e1dc620b34763410ccb6d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "44487387-cfa9-45be-9fcf-93d4bc913bb4", "comment": "Malware payload (Formbook)", "value": "88a8db335cfdb842f9cf5fadb7f50e69849c74c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521637, "uuid": "b5d6f033-1dd3-4703-b0c5-01d0aea81609", "comment": "Malware payload (Formbook)", "value": "0d96755e93b8453485833d98465b1e9b200bdcdc9cbf5731fd1945ce7fb1e5599825a19cedc6495ead1968d9bd9726dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "59051f3b-1561-4f0b-b699-76283e546db9", "value": "T17115AF32B2B38477DA231E34DC5663549418BF232A39E809ABD57C5CAF36647782C1E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "98c46ba4-72f4-4350-a978-b048c70f9348", "value": "bc419d73f90d0e7371ffe54ca6d357a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "47b34ac9-7dab-4208-bcf2-bf31dfb18276", "value": "12288:iA+mV7mdHOAawOnYsjTHzNHzh/eS9KRlN83723ax56pb:iA+mZ8awOYsvZTx9UqL23i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521637, "uuid": "0e3c3cb5-440e-4c89-8d9a-dc561e3dbe14", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521637, "uuid": "36fdbb06-67d7-4beb-913a-a1c2c383100b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521637, "uuid": "2630bc62-9361-4925-ad09-5033f9487a98", "value": "9002928172718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f79e37f-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685521414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521414, "uuid": "418d8a11-ec85-44c1-9704-eac359db5fcb", "comment": "Malware payload (Gafgyt)", "value": "e67b69850f2b5efadbc751e67dc673b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521414, "uuid": "69f67845-a3ac-410b-86c7-a075266bbd25", "comment": "Malware payload (Gafgyt)", "value": "cd293f409d06aba7ca4d8daa8ebb043b28d13fc898e71db27a9be80c2e87529a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521414, "uuid": "5bdd6450-d9b0-4918-8b5d-883d4e6effa5", "comment": "Malware payload (Gafgyt)", "value": "5b1999e41af47d542cf89a74c3f3b878208e6626", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521414, "uuid": "6d8e6754-ed14-4fab-a7e9-d236631f67f0", "comment": "Malware payload (Gafgyt)", "value": "2d30a9ef4923fb18a05b3ffb38b015ea9027cd21cb0f78030ba10a1d21cefc92a5a96615dee3272270ef8b419670eeb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521414, "uuid": "f83f72e1-cc56-4861-bb32-22513d9c1d03", "value": "T102B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521414, "uuid": "ccf8b989-9050-4cd9-99d7-f3e75fd339d0", "value": "3072:2d0wKSAewzi+Xn+8Uhw6W+aPmJmDk1c8xF6KjW:bfO8IBHJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521414, "uuid": "45f7b0cb-4119-4306-a326-bc3da99b0156", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521414, "uuid": "ddf4222a-8281-436e-ad78-06a2172b5f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521414, "uuid": "26ca058f-ab39-4177-b279-fa66b4e2c6e5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd687163-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685533168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533168, "uuid": "82b998f4-944f-4202-adda-9ae82d74a843", "comment": "Malware payload", "value": "a6cbc944bd385c60bcc15f1822ccb23e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533168, "uuid": "233be040-f9a6-4ac4-a02c-df9c098f8c9d", "comment": "Malware payload", "value": "cdbfa1cc96759ac3d8befcc34146efa6c24b9aaf21f6f05530b1776e9afb82bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533168, "uuid": "2524861f-8d45-460c-91a6-2e0e7ffb9252", "comment": "Malware payload", "value": "e42b5a60918e60cec04113e434e8504aa48771eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533168, "uuid": "5145e096-d23e-4a0c-8f7c-42019ca881e3", "comment": "Malware payload", "value": "f6ff6bd7a6ac07069b6006bb00b08d967ca50ec714821d81b2da3df88c103fd4e9c262a659ea081c6335b33f7f06a67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533168, "uuid": "e7d81818-e2a3-4074-853b-fe03de5018e8", "value": "T1B13296146BA88177F5750BBB58B213C007BAB60B9873D65F8E8C500D6DE271989D2BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533168, "uuid": "2bbe9143-c5ea-4cea-8646-05a4a0f2adb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533168, "uuid": "2f0d1b78-88b2-44b7-b5cc-1820121f5b90", "value": "192:u03nnroLfe/i0fffff7tC90pJL3reenvEJVLPpfNs8N2:u0XofL0fffffsKpJL7eevu7fNs8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533168, "uuid": "41fc7c6f-7f43-43e5-ac32-e0b000132e7e", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533168, "uuid": "9cf67262-3631-4c18-a829-20a04ed183d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533168, "uuid": "b6c7f74f-eb49-4112-8db4-49c47745cb81", "value": "a6cbc944bd385c60bcc15f1822ccb23e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1048b112-ff8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521684, "uuid": "535973c2-f0c9-4137-a30d-b16418b65921", "comment": "Malware payload", "value": "1e17faf75e76940f062968896ce7b7c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521684, "uuid": "955ec547-2068-477f-8ea7-3e170eb9c9ac", "comment": "Malware payload", "value": "ceaddfef12f79bd6769b802d0446844d3d13ea665c8497fe5a2d547f3726f006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521684, "uuid": "f3b23a69-a785-4000-a95b-e7a9fc425002", "comment": "Malware payload", "value": "7960ba669960d5152b808554acd345631dcac5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521684, "uuid": "88f2c631-35e1-451a-aa93-058387d33d4f", "comment": "Malware payload", "value": "ea2bc09c94a6604ad9e1141e6cd145bbe51c76c4e8fb73187dd4b6521657f59c0a80d4af01ac9570929f63d3e5b45cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521684, "uuid": "a38a0754-eefb-4e07-8942-5b3781e2b9c1", "value": "T1E98302F9BC843F8FD949CFFE4496D9E415B6EEA816CBD009685C4AE101E998DECE0113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521684, "uuid": "702a4600-0bce-4a9b-81e7-6855c179e1a9", "value": "1536:1f1+jYNENMA3nqiXmgTHgFCwCz8yYrNaxXrU2CW5HfyuaeGqwUYCA57bxfIINj:RSmENMA3NXmb299xZZ5HDGqwX7bxRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521684, "uuid": "97c30022-1ef9-4424-aab0-071fd413f73e", "value": 86872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521684, "uuid": "6e907804-7103-4736-8727-685a1a4effad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521684, "uuid": "3593c9ac-5531-4ead-a94e-48dda21abca2", "value": "1e17faf75e76940f062968896ce7b7c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b8c2b6-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520947, "uuid": "08f5091c-43b3-4045-93af-22a605917b48", "comment": "Malware payload (Loki)", "value": "b9543df2a8b44aaee251d4cd4648d72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520947, "uuid": "8581ea2a-6024-49cc-b687-a3b0d65b4a40", "comment": "Malware payload (Loki)", "value": "cefd971616a56a52fa3c0cb966cfc4c982413038cb0907baca5170e1bd585b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520947, "uuid": "0f3074f7-1c4c-4d3b-bded-bf9fff0bc299", "comment": "Malware payload (Loki)", "value": "c2a9b989ca8b136cee97aa4b69730b83615ffbac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520947, "uuid": "cd93e2e8-76b8-4d59-8fbf-e81b476747d3", "comment": "Malware payload (Loki)", "value": "afabaded29d48113cd20e37ff18e48d62e2442a48d4ef40ad3409a4ec0df6aff7d31807fb510892e5087788c8c029a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520947, "uuid": "e7acd956-d9e1-4ad0-9482-494e395ea3a4", "value": "T1B725F05063BF8B2BD47F6BF64211923087FA6AAA743ED3198EC265CF1175F400905B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520947, "uuid": "c7832791-b330-4e43-94be-52d19c1a3e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520947, "uuid": "acbe2150-8777-477a-92d0-2c09f27f690b", "value": "12288:WLZd4BA2B0xTGlxNqvNu2hZ+nUEsn9MzgzCbu6AiscPHLtJTDzlFtlTHYOQ/OZcm:o+ALaVUH999Mj3jVBJ7l79YP5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520947, "uuid": "0bbfd867-2749-4509-8545-061722bcd3d4", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520947, "uuid": "1f11f418-16a8-460d-b79c-dbfc4b65413b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520947, "uuid": "3a866dc8-f820-4946-b6f2-93d2316ba00b", "value": "b9543df2a8b44aaee251d4cd4648d72a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cad3be-ffa5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685531981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531981, "uuid": "227dd1cf-bbfb-498c-948a-1f21b5949d88", "comment": "Malware payload (Smoke Loader)", "value": "1ef27b816211ba854118e557ca6a5b79", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531981, "uuid": "7b674a5d-f2fa-45d2-a5c1-c2a470201ead", "comment": "Malware payload (Smoke Loader)", "value": "cf3ae9f22ff51fed8cf68b9d33fb356211bd1f262b6e9537bbce47829fbe2526", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531981, "uuid": "e82a195a-4ee8-44f5-a583-2471a893b499", "comment": "Malware payload (Smoke Loader)", "value": "67ac035763fdeca034397b05a2aca01efe2e867a", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531981, "uuid": "39957593-9c83-4f80-bf04-46e81f4fc5b6", "comment": "Malware payload (Smoke Loader)", "value": "a86d5290dabf184f4bc32d747418aa8dcd1b6b507143c2e2e6bbabc615eb0605bbdd64677c07a1a0e6e205067ba51da4", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531981, "uuid": "84f545e2-4828-4957-8027-f0a7ea9a1f5c", "value": "T1A6449E22B3E16831E5574A754E2A83F86B2FF4718F16A6EB335C1A2F0D712E1C672305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531981, "uuid": "8745ae77-b037-4c5b-a241-45e39b1aafe5", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531981, "uuid": "11239c14-d01c-4a5a-86d0-4bf235da842e", "value": "3072:ADe8CgYroBIw2DRFSmK3v0PmTtybI5gSI/YKsD9hzlvU3jwZyJjOcmwI5j:GmJ1w2AoOty05gVtyhz1U3DF9mw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531981, "uuid": "e579df60-53f4-4806-be31-82369afb85a0", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531981, "uuid": "9404dc2b-585e-459d-bb94-8eba8ccea870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531981, "uuid": "45048c01-ee6c-4a73-969a-46d2f37296b3", "value": "05736299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc69f86-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685520873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520873, "uuid": "6be15c91-72f7-49d4-b826-da5f4e4668eb", "comment": "Malware payload (Fabookie)", "value": "b316c89681725907f9861d6f20853b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520873, "uuid": "1e41ff2b-5746-4bdd-a512-139019483d82", "comment": "Malware payload (Fabookie)", "value": "cf713424e155ee6b2ee930ac5f7b776040c5a0c3aa21cbd7ea371018bed92a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520873, "uuid": "77b01154-684d-4af8-832f-69a1d59536b6", "comment": "Malware payload (Fabookie)", "value": "0dcffea556f3f8a8e72355ec9ab3e196b3d9fbe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520873, "uuid": "53e50754-d8de-4d8b-93b3-01ed511c9873", "comment": "Malware payload (Fabookie)", "value": "0736e04a64698ba33932d051da95dbc6b8a37ea723b70e07a44026d647829f603c97aea323f9038ca3b2bb921c5de2b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520873, "uuid": "ef3885fb-31cc-4988-b0a5-e75d20593554", "value": "T1A614CFD275E182B2E5BB4A77D830DF546E3FB8625721818F233416AF0E307C18A76766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520873, "uuid": "874b35c1-67de-47d8-a60a-5fe3c5effaf8", "value": "a35683be2dafd55c6a5af6754693f952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520873, "uuid": "61a1936c-f9f6-48af-99d1-1373358f9d8b", "value": "3072:dJv/yCxy4g3OAWbWbXiRkqveBCIlODxlUSS5Pdxoref1Qf5r4W65Mz:z/yCxoOCXiXXmO1e5PnorMyX65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520873, "uuid": "7d369167-32f5-46c5-963f-a962e88c6da2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520873, "uuid": "e5077f90-72b9-420b-a772-14a32db9d1ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520873, "uuid": "e2010a42-304f-4f94-ba6c-00f403a653cf", "value": "b316c89681725907f9861d6f20853b02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a534efe9-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533960, "uuid": "0e478d5a-3826-4356-a019-77b7ea3c5f91", "comment": "Malware payload (Mirai)", "value": "8c0a991b7b87587f3dcb6108b83e3dbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533960, "uuid": "de19e5d7-8cd3-4333-821c-5820b9fc9113", "comment": "Malware payload (Mirai)", "value": "d0cb8682de1b39406429eee8d23c69a4c2ecccedc981ab2a4d28c3d89dba861b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533960, "uuid": "cc74e258-31f4-4bc7-9e17-9bb07234ee23", "comment": "Malware payload (Mirai)", "value": "1d8cd30419a2c33e522e65e42660fe60f3cfcd7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533960, "uuid": "4b8a2084-0f8b-43a4-8925-b984a6ee2fb5", "comment": "Malware payload (Mirai)", "value": "b502005a7645b41a9a704b82d92b88c68d024efea3a75fb1edfd0bb481cc3ed6c4d76e6f762254a00c8ee33155ab614e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533960, "uuid": "025eecca-7940-4361-917f-7ab14d7e1da9", "value": "T1BF03E751BC829A37C2E1137AB6AE4A8D336167E8D2CF7217DD214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533960, "uuid": "2e047d71-078b-41c3-95a9-99c86b741655", "value": "768:kg4QCbvsG5f0OlnlUlQOBFdApwAUb9z/W56v+bgO73HUXoTB/NwwW/:kRbEG5fXlUlbH4aScv+7U2LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533960, "uuid": "c5e07863-fa4b-4de8-8543-41fd651b27f0", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533960, "uuid": "c8cfe44b-a3b2-43fe-a094-a027682906a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533960, "uuid": "c1082465-82c7-4462-ab04-a5ec5177f087", "value": "8c0a991b7b87587f3dcb6108b83e3dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2abdd83-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533660, "uuid": "5c3f1db1-82a5-43d4-aaec-e5163876c355", "comment": "Malware payload (SnakeKeylogger)", "value": "a0b4a1c89699a189931bb1b43fa8e1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533660, "uuid": "834ecc2a-3718-4168-b373-5ea999753d73", "comment": "Malware payload (SnakeKeylogger)", "value": "d26f10eaa0513aec677c5aa206d6f8165a311840264d33c2c21ca6a5fb1e59e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533660, "uuid": "6f9bf164-f800-46ba-a37b-a62f3949f995", "comment": "Malware payload (SnakeKeylogger)", "value": "f51aafc55d19536b20eee1b046fd06a4e40ba322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533660, "uuid": "1e08c399-dda3-4bce-b382-20ad712d63aa", "comment": "Malware payload (SnakeKeylogger)", "value": "e7e03fdc5e68afbffc393d141598ba555291657dcfe3d3808c0c65f1fa4128a88f45557d9d69e8d14e4bcd5f0741b236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533660, "uuid": "fb49ba21-76f7-4ef0-bd9a-62a3acb527fb", "value": "T16B257ED5F1A4889AEC6B09F1BD3A643024E7FE8C54A4810C569A7B2B75B3351309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533660, "uuid": "d78020b6-4def-4db2-a320-d7fdf896051c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533660, "uuid": "31516e1e-20a1-470e-b645-06f92947a8b9", "value": "12288:mfzAMTihh6xhZ6OrMHZ0RbPZoNgFI3q+HkSGKRpgTX7mR8qQHqPKuD:DMUgh8yS2PZ+g63hEpKREqFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533660, "uuid": "3986a95c-66b2-4882-bdec-da08fdb89a91", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533660, "uuid": "f2c52991-ac61-4090-bfb1-2aaa085989e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533660, "uuid": "3e4870dc-cc35-4af6-8edb-1034b79867a5", "value": "SEVK\u0130YAT BELGELER\u0130 VE T\u0130CAR\u0130 FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626ff269-ffa0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685529982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529982, "uuid": "ebaaad86-6015-4862-8d76-160130ac99e3", "comment": "Malware payload", "value": "7df5032a27455e66458577a7ab63eeeb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529982, "uuid": "49d18613-c7e8-4a0c-9837-35906c51e3e7", "comment": "Malware payload", "value": "d472426a835393081a537a8d85580ed25bdd49d78277b5cd8995a1abfc20fc36", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529982, "uuid": "d4f744f9-299d-483d-a731-a6c74b59bf98", "comment": "Malware payload", "value": "b071fe0c123049d834207893d40295acbcfab340", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529982, "uuid": "eda24bc3-abf7-4f0a-aa26-22b07ccc15b3", "comment": "Malware payload", "value": "93925291f17e0526d29fac65d33341c3815eb313f66da413fa47f1efa4e14439911bdfd3966d0f0ab769c5e4613e466b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529982, "uuid": "08675902-1ac8-4aa1-9b6a-07f5607d9602", "value": "T11274AE12F840C033E4B1157588B8DB79197EE5260BABC5EFA3C81A7E0E262D35735B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529982, "uuid": "5ab58a4c-7fde-4e77-8150-72bbc8e226df", "value": "1076712a964b4d783c73471f220a061c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529982, "uuid": "94fdac70-0907-4426-ba90-b8f5a0f411ce", "value": "6144:iB/FH5Ns1b+RNu4jK2bupLJx8fIacPzCILd8Bwip304g59PxZx5:GH5e1b+R8OupLJx8fINPzFI04g3JZx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685529982, "uuid": "4bcd71b3-30c9-48dc-88f2-580686c62c27", "value": 344424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685529982, "uuid": "7fbbb26c-4c8c-4de9-ba06-62288d9d31a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529982, "uuid": "60d9c5bf-88f4-472a-847f-611a9f8fa985", "value": "gjirvm3.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d3c7fa-ff92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685524101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524101, "uuid": "6b3dcf92-c138-4ac9-9b30-a0a491095029", "comment": "Malware payload (Gozi)", "value": "d24bad9f74a3cb645f25500552860d7d", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524101, "uuid": "43e2a098-77ab-410a-911a-b9efb0fd9a81", "comment": "Malware payload (Gozi)", "value": "d50570c1b4d064fb1f6e855d0c27ac1958a7a32c3cef5e6373094d82647f5bd4", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524101, "uuid": "efbd67a9-7b61-4a52-a4b6-ed7cd27e8c98", "comment": "Malware payload (Gozi)", "value": "1f178b5501b0cfba33be5391b9cfa9c3eb20bfb3", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685524101, "uuid": "a07b5c18-04d4-43df-a87d-8608df511c85", "comment": "Malware payload (Gozi)", "value": "029e59e7625b4094b5c12376216f89118b324f9017091ecbb3ef7429df9c8ecc5d2080c8fbd842b7b9c73b2591acf163", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524101, "uuid": "b0ccda5b-b6b6-4a90-a0d6-09e366990a7a", "value": "T159B4BE1CFA478531D6AE213019EB567A162DE8208B2491FF2394CBBB3EEC1D25D3571E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524101, "uuid": "75eaaa62-0810-4a87-bce0-0939aaf8df74", "value": "2834d6de694a1e118fce1c518a77096f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524101, "uuid": "1f7cb425-6c70-47b7-b2bd-1c2082781172", "value": "12288:CCTVqq1Tb1bfFBfDtNK+UmDFZIdP03d5700R:LToq9Rf7tNK+HrId03dxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685524101, "uuid": "dcc3d2b0-c190-4199-8a92-3d69962485bf", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685524101, "uuid": "b64addae-8a9b-4e17-bfcb-d48b07c04ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685524101, "uuid": "12d4606b-8dae-4a92-bb41-9cc54979d341", "value": "64770e200bf47.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6452f3dd-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685520537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520537, "uuid": "20122161-d4da-4c36-bc7c-21885bfb8aa0", "comment": "Malware payload", "value": "3c2154f7a57d029a358ca79570235c06", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520537, "uuid": "dab985f2-99b6-4cba-8b78-ec829a119ce0", "comment": "Malware payload", "value": "d523606b3e494432753a1379b994e1a48e73508b4b41744069703e74819dce6e", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520537, "uuid": "2159b3aa-3763-4cd3-b4c7-6f124bbe15ca", "comment": "Malware payload", "value": "a925f4a8f7a19442df0778907f2649e6d12e38f2", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520537, "uuid": "d2dd62a0-429b-40b7-a84c-4d47189dbcc4", "comment": "Malware payload", "value": "96336a8794d9988775a70ac909c2104757a83e9b22b9e907650d2f20f74b49c72cb84ffee55dee2b4aec55d8c7c7a304", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520537, "uuid": "428a0830-49f2-4a95-bd83-d51665b18f49", "value": "T13AA3E1AFE45851B6C2C8FA712B184C1FEA179AE776E11D12EA1B1ADD0032CB2AFD4454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520537, "uuid": "680c8073-14ff-462c-bf80-f2593dfff791", "value": "1536:mr6pd0Zo0A3PufZo0A3PuSv8o2HIbD4TZV/yFaAzodrAZAk/Zo0A3PueZo0A3Puq:k6pm6G6Xd1E91yrKAZA26n6McNI6Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520537, "uuid": "acf0803e-b635-4ea4-ba98-c807dcf502c8", "value": 100136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520537, "uuid": "2a431a9d-42d4-4995-923e-46b7d98ea398", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520537, "uuid": "9685194e-0adf-466a-bc75-84ce2e74c96c", "value": "Automann- Order2#44096.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1729c48e-fff8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685567652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685567652, "uuid": "f22d7e97-cc43-4db8-bf20-5ed4bd325498", "comment": "Malware payload", "value": "d3d0e583f559cd324c9bdd21e6e64c3f", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685567652, "uuid": "593d3531-1a26-44dd-a1c5-bc1e31a0c787", "comment": "Malware payload", "value": "d576e72aabe45762335883c1ef9b2cbfd91eb0dca41df1486cf845d5a43ea404", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685567652, "uuid": "8d22f304-1d07-449c-a2db-2ebf44f1fb30", "comment": "Malware payload", "value": "001b33c3d2a46589881a9c6038576b31c309b908", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685567652, "uuid": "1a892d8f-b027-4e33-9376-ebb0cba5b48b", "comment": "Malware payload", "value": "8a538c9bd3d5d56f9a141c50fd2f7ffa3a6532b2543fb601f49d1ded301ed01bf98a6a13d9cad2aaf2d9d4aa1949111e", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685567652, "uuid": "e1acf9d9-3b4e-4b75-8a36-02c42e6fc0d6", "value": "T1111198B65B5E9022C9F1CB420D4B925ECF6081A198C00A14B8FE4E209E39126A39FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685567652, "uuid": "7c414574-3fac-4220-a61b-bb61ef97dc36", "value": "24:KOVtyCiM4f2UsFTxnswvpdPNuR71q2z8JAh/:KOVtyCiM42UsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685567652, "uuid": "b1cbcc31-6e53-452c-beaf-8703c39a3726", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685567652, "uuid": "a9e94f49-6ab0-4e10-abbe-0dfb28307fbe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685567652, "uuid": "a7d35bfb-2876-47ac-9c0c-54160ec15c30", "value": "gSER25FF.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3379ed-ff7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685514837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514837, "uuid": "62f00fc7-5c0e-43b3-aedc-2a3dc238e853", "comment": "Malware payload (Smoke Loader)", "value": "f2d806649b52fa2b9c971bd3d99a46c2", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514837, "uuid": "faba6070-b075-44e8-9cfe-c92d4bbdd98e", "comment": "Malware payload (Smoke Loader)", "value": "d57922015161e3384aa16923df485962f4c2748efc5428abdf2186d92310e889", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514837, "uuid": "725ca50e-3638-494d-9dac-1fe50258c51e", "comment": "Malware payload (Smoke Loader)", "value": "559774dfabc7712b3c546c203c6b9616ca7fad27", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685514837, "uuid": "e284bfff-2aff-4b41-86dd-12c3e71afdc9", "comment": "Malware payload (Smoke Loader)", "value": "5bdce0af7e210b92d0178c5d0d624309ad219cba417eaaf36c87bab76674061f97838974b8106f40b9cc46ed000d1a3d", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514837, "uuid": "b8617702-0d9e-4680-bf00-74299efef25d", "value": "T1B4448D13B3D1A831EA6746719E2AC3B86A2FF8704F5666DB235C5E2F0D712E1C672305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514837, "uuid": "c2353014-e1e9-45d5-979f-fa54442591e5", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514837, "uuid": "c4686dc5-7bb8-4acc-8b0e-1d49196d235c", "value": "3072:i7uom4GTK8F8qbNoXPgLaZPkqjLIGFbPJ+Vf5loW5s7NAmz1v2cVbPD5wgStIER:suf9TSqbUNLIGhPJovo9Aq1FrD5wptX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685514837, "uuid": "79a054b6-79bb-4942-903c-1f1c64a8d591", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685514837, "uuid": "fb23a81f-88ac-4416-8f20-660475256588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685514837, "uuid": "99cc53e3-d1b7-4211-9c79-d41670d98875", "value": "05733399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1723395f-ff78-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685512676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512676, "uuid": "1e32892c-f615-48bc-b9cd-c98e320fa974", "comment": "Malware payload (AgentTesla)", "value": "f3d187a952a8496f4e840a85594197b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512676, "uuid": "208dc728-fd3c-409a-ba2f-237536e84ad1", "comment": "Malware payload (AgentTesla)", "value": "d5a65545a8086f67e2f8e56403c0149b3feb2515d7f21295809a6e6f611dcf33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512676, "uuid": "b4b88f82-6e4e-4ff4-b87b-fbd7268cf37e", "comment": "Malware payload (AgentTesla)", "value": "1626917a74ce3dd0d113afc359d88b240a953b6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512676, "uuid": "c92b5afb-879e-4365-b2da-d70a0a8ea39e", "comment": "Malware payload (AgentTesla)", "value": "87d84b930a3e9ce4ae5645134800ac054494c3339063ee448a7ca21e1f44c4b59e56ada219caeafffad10b4050ccf523", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512676, "uuid": "271169da-d3e1-4fb5-92fa-b2572e0fea40", "value": "T1EB15F148BA26368FC457E9B58E341C74EAA9E466432FD247F00B156ECB0D8B6DF501F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512676, "uuid": "8b90ca21-9995-455d-ad49-0532dba904cb", "value": "12288:WAMTihh6xhZ6OrlZKZXzlKwkHaG0M+NHG12wQ0l2qaMMJfiRoCJqJ7gwJBT3qrb+:JMUgh8ylZKhRC5J2Qle9JKRFJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512676, "uuid": "2ca8e512-c34f-4ed3-a403-3e489165b07a", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512676, "uuid": "948300a9-fe1e-4182-86bb-15d0ec75c73b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512676, "uuid": "1977e05b-1b9a-4254-be9b-440abb7d787a", "value": "DATASHEET-VALVES MA9881.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddf1597-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685520875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520875, "uuid": "70e7ef3b-230a-4679-b37c-8f0bb998ae8e", "comment": "Malware payload (Fabookie)", "value": "bb575fc8b2908efafcaaf0c42fa32b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520875, "uuid": "5ef3a18f-d353-4728-9abc-29ebb8db56e3", "comment": "Malware payload (Fabookie)", "value": "d80d8918642110a3d2d808ace0de5ff05525baa28dd89cfa68287cc56f490002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520875, "uuid": "88b1bd38-0811-43dd-9c0a-3481bb343097", "comment": "Malware payload (Fabookie)", "value": "360aff8925c0482b886d3dc1a632ac9f05b1e12f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520875, "uuid": "f4906349-ed78-4ca0-aacf-a692d96e6619", "comment": "Malware payload (Fabookie)", "value": "645362b62274a8170d92b60287a8b1d855c8701ef4986613d09a1ee9afdbc6b9f5255d0013e7b988f3b4bf85cbd7cca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520875, "uuid": "aac8c647-25c1-440f-a507-139cb224f38c", "value": "T1DD258009BE5E8080CC1156388976D775B7627CA81F2D86EBF197BF2E6F325949C39203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520875, "uuid": "722da4ef-18d9-47f4-8de7-05238f51ba7d", "value": "5f05d39b59280bd80ba38f718e2a78b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520875, "uuid": "7441c964-b379-47aa-bd89-ab84223709d2", "value": "12288:xSJc93ljBhGbZmdWh6dSsR1xsBwIwGZ/nh/XgCLYXKPXPiXuHNH/b6bH/zx/:xSuheh437IwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520875, "uuid": "ac93dfab-3319-4cf3-b3e1-f7629d48fc80", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520875, "uuid": "e2d0d2c3-47e2-445d-814b-5e6b576b3afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520875, "uuid": "b126ac73-0197-4a46-a7b4-8720c46b47cb", "value": "bb575fc8b2908efafcaaf0c42fa32b89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c8b120-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1685520128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520128, "uuid": "be6d95cb-a1fb-438c-be91-7642befb2fde", "comment": "Malware payload (WSHRAT)", "value": "f1d9251929145c7232d1004d6bf309c5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520128, "uuid": "90621928-6cc1-464e-a34a-3523c664505f", "comment": "Malware payload (WSHRAT)", "value": "d81692de8fd3c96833905542934bb5c75fcdd5408c34f1406cca410b5fe6511c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520128, "uuid": "f0f3eded-b5b6-46c9-bad5-5b01af8bc94b", "comment": "Malware payload (WSHRAT)", "value": "f549e8742fe833551d57ef95900fb627921b8049", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520128, "uuid": "18b85315-c62b-4d46-88ec-294ddc901dbd", "comment": "Malware payload (WSHRAT)", "value": "3fe9a76a49f41a0499b24ebc7dc9989d4a90e049f4f15eb2da525bebff5a775e33875ee3625cba188b4d915d9b51c797", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520128, "uuid": "fe396e9d-5926-4d5a-b0ed-ed8ee2343a3b", "value": "T1DD1287D3BC48DB843443EF852D2DDE6113026EA218BE6943E3AC8B459F171EC6693E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520128, "uuid": "738a8c4c-bf15-40d3-9a79-08a9c3d51cba", "value": "48:0Hd230PPDakG+biHd23gPxBl2akG+biHd23g0BXXakG+bgBP30PPDakG+3p3QxBJ:0Et0R3S6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520128, "uuid": "1071a2c8-8eb9-418f-9c6f-2b49f5215d3b", "value": 9599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520128, "uuid": "20d1d2a7-5a05-42f5-b991-5ff2da9ff7de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520128, "uuid": "6522b9c2-a4ac-466a-98af-f03ba2fcbea5", "value": "ORDER-230531AS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f44c80-ffe6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685560211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685560211, "uuid": "aa23b1a3-b2a0-4de5-9725-eed961cbac1f", "comment": "Malware payload (Loki)", "value": "19cb6550343998faee16c4f604a25f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685560211, "uuid": "7a210079-f445-4b63-88a7-472170a4c53d", "comment": "Malware payload (Loki)", "value": "d8273f318e75f0e587b207409f7a326737cd152683851e698c8a6d24f97c4c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685560211, "uuid": "c640de40-de98-48c4-9818-e36b244f63d7", "comment": "Malware payload (Loki)", "value": "5276dd4083fe877a79a8c8d7d34f603705e6a870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685560211, "uuid": "6238c3de-911a-4580-842b-7e57fdc78e26", "comment": "Malware payload (Loki)", "value": "e492ad2ac1e6225fce4e7b906c72a18749ceeddb40eb42d37ea1951537b6faa0e1449cd220bb9f67706af4b171a9f240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685560211, "uuid": "a4b346e3-2f43-4b4f-a19d-0bf3ce3f0e30", "value": "T147041204EB61C167D8A20A714EB52BA37FF0E82964B9430763C07A9E3CA1BD1D95F735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685560211, "uuid": "53fe890b-6bee-4ced-b392-140378eeb137", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685560211, "uuid": "99021769-0de8-4a35-aaa0-934b38bea54d", "value": "3072:XfY/TU9fE9PEtuObaY7biQ2YA3gPCFJBTftEb1ulS0AGsglteHATLDIX2tms24vi:PYa62dbintmcJ1ftEblGskeHALM/4vJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685560211, "uuid": "ee1fd012-5566-42af-8bbf-2d547c68493b", "value": 190043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685560211, "uuid": "52c56eff-77f2-409a-b19a-b19b56d222e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685560211, "uuid": "239dbeb4-ca46-4862-9f92-9972f70fa9ae", "value": "Documentos.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d000a50-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685521008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521008, "uuid": "66c1341f-b06b-4e8a-8631-2c23ad58b696", "comment": "Malware payload (RemcosRAT)", "value": "5c7c4a198838dc17a523fc9ef2f80c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521008, "uuid": "4fc80ff5-fe6a-4259-9a39-91dc233a62ed", "comment": "Malware payload (RemcosRAT)", "value": "d935d16b1603eb83d9c8587e3fe36ba247341adb572bac99a291f35bd13d7292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521008, "uuid": "b0ba5d4f-2b56-4074-943e-299e7ec89721", "comment": "Malware payload (RemcosRAT)", "value": "02b68e1f2b57c6f37e86dfa6aeaed9235514bf27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521008, "uuid": "1b9324b8-fa3f-4585-bb34-146053fa1430", "comment": "Malware payload (RemcosRAT)", "value": "37281cf777e69507080410f0feb252759267d17a0fe264d7ad08f19a392fc358137c8f0389ec61073da98c9f6e53090d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521008, "uuid": "80f9a2f0-c8e1-4026-af00-8e5dfda4c4a7", "value": "T1C725122897FD025ADABB67B617B45234533BFE5A7731E30F5E43A88E1960B008A10773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521008, "uuid": "f1affcd8-df1d-4928-b490-e4279a05c5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521008, "uuid": "114a097c-d5a4-4112-8a0b-d76b50894f64", "value": "24576:+sIdum1lmFxUSJ0x5yRb+QKl0AnB3oc8q:cTmFxUsA5yRb+ll0ABP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521008, "uuid": "0beee075-95ea-4b17-89d7-a8f935fab384", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521008, "uuid": "d527ff71-643d-4198-bb1e-8c6d5742cea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521008, "uuid": "7e4610d3-a1c6-43b0-905b-d32e594d1c3d", "value": "5c7c4a198838dc17a523fc9ef2f80c2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a787fbfd-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685520649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520649, "uuid": "93e09645-af76-4090-8b54-6cc38f16137a", "comment": "Malware payload (Loki)", "value": "ff2a22e762ce45b0a992899cd36ed5fc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520649, "uuid": "745b45cc-455a-4566-9ab1-770a2daaafea", "comment": "Malware payload (Loki)", "value": "d98de7339baf210589130eb39d0342b0e4a2c5782d91873feae99fe192b1f899", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520649, "uuid": "4a1187e0-c27b-42d4-88f0-30fe23894390", "comment": "Malware payload (Loki)", "value": "431d777222cee9c8a06ee964e29c449bc2cd87d6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520649, "uuid": "2e6bcb31-a4d0-46d4-b5be-395fc95be003", "comment": "Malware payload (Loki)", "value": "88ff8401d92dd89380b582642634ad954ce6d0958b4da1ac495e5aaaf5fa926b652a557b28f93c6de1621eba05e6af44", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520649, "uuid": "015e26c3-b3cb-42e5-99dd-5e7b7cbc0f79", "value": "T14AD41216EFBF0A0BC5BB7EBD0B3040B0A6FCD545547BC1EEE996486FC8589356C90262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520649, "uuid": "0f78e390-ecf9-4ef4-840c-6fc1c8841af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520649, "uuid": "609a593b-01e4-40a6-abb5-330602351ea5", "value": "12288:rbAMTihh6xhZ6OrqdtTlVCEsjhdMQCGK02eL3IiutRbGkfebRAV9skoL:AMUgh8yAtn9cMQC/QhuDLmFamkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520649, "uuid": "a4ebd735-31ab-42ae-a499-6d27e0dfbedc", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520649, "uuid": "609929e5-978f-4339-9275-0e05c0e54607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520649, "uuid": "a21a9fb4-33af-4370-a4a3-c7b5bfc9a259", "value": "DHL Receipt_AWB#2048219822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d1487d-ff9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1685528195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528195, "uuid": "dbded427-3cb5-4303-adb1-44cac587c16a", "comment": "Malware payload (Gafgyt)", "value": "78ba2a837c4aa05b6dc3e4d87d716775", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528195, "uuid": "bba2642f-1761-4d3e-aa66-8c3d87844366", "comment": "Malware payload (Gafgyt)", "value": "da7084f087da561f253c2f9528253b935c7bfae9445fcac062bf64d1d4b78fb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528195, "uuid": "1922a203-be1d-4ee3-b82a-79f8ad38e1a3", "comment": "Malware payload (Gafgyt)", "value": "c37b57ad5a5f771dde72b3b2589da74e99e16f06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685528195, "uuid": "a5c9c13d-55d8-4052-b9d1-54fba7092a76", "comment": "Malware payload (Gafgyt)", "value": "a659fd5f5888cf5264d6389e581861246156f903da10b6776b9ead956d20fe43feb3562738112621cdc82859fe52f9e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528195, "uuid": "de0bc65b-0939-462f-af27-1ee314fb837f", "value": "T16F0476AA39606B6EE55887B10BF7AF70C2D4289721E2A753D26DE6045FB038D1C5F370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528195, "uuid": "387e7146-628a-4d0e-8378-3cb4ef722842", "value": "1536:DVND7KGU8FTx0KVebbr4KaHHW9KZpc02clWUP2pQ/epQDi9kniZUCTQJSbsluXYa:f5+W4umlaqQiS7xXWHUyf+lsqDpyi88s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685528195, "uuid": "80f47008-63e3-45ca-8c9c-5e058fc9ae2f", "value": 180305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685528195, "uuid": "3d1cb957-ae0a-478a-83ab-9d0348d10302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685528195, "uuid": "98ab3b5b-0396-46a0-b534-36c009f08253", "value": "78ba2a837c4aa05b6dc3e4d87d716775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac84c0dd-ffd0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685550723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550723, "uuid": "8b0f46a8-f2a0-4b5c-8591-4e663dff6fcb", "comment": "Malware payload", "value": "a1e4b0f98ef03432bfe90e5086e4ab72", "object_relation": "md5", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550723, "uuid": "17021f81-67b9-4995-865c-0c7b79cae2c6", "comment": "Malware payload", "value": "dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102", "object_relation": "sha256", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550723, "uuid": "63bb5b52-3941-402b-bacd-223285c97f33", "comment": "Malware payload", "value": "76ee4117b1d0406fa08d52f7c10d7a0b6dae90c3", "object_relation": "sha1", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550723, "uuid": "dd61fea0-8c0d-4f3d-9233-d5a346a06bf6", "comment": "Malware payload", "value": "cc1511fdab4ad60877b17d12f9714dd0ee16513eff447502e3aa73d81a30930a95e25aa16765e842c589fdc34e462984", "object_relation": "sha3-384", "Tag": [ { "name": "1685526716", "colour": "#57D2D4", "exportable": true, "hide_tag": false }, { "name": "BB30", "colour": "#4481EE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550723, "uuid": "3f906780-ea15-4bf2-8ce8-95670b60e250", "value": "T1833196EE98AF4295D6BACF36044A0D6234BCB38B47495E2240363684985DA0F0B67519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550723, "uuid": "527f2deb-d8af-450b-bd80-1a0b6cb29c20", "value": "24:9PMB3jEEuqsAsrr4fOoW5fDjJdI8yyMl9u7QbU7U77qDkxhquIAE:9PMB4Euqs/rrSOoWFJ28ydl9zkU728q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685550723, "uuid": "effff6ed-2779-4485-8505-b7aaf91f387f", "value": 1446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685550723, "uuid": "31d4237c-64b0-43cd-adbd-a60fb06fc335", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550723, "uuid": "86260c04-bd6b-4c73-8a6a-c8d8b09b4b57", "value": "doc_B285_May_31.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb587d5-ffa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685531959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531959, "uuid": "17d2fc8b-60a2-4452-90c0-e24ba6ebe5de", "comment": "Malware payload (Stop)", "value": "521673ec8970bb8c79e5b393af2c194b", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531959, "uuid": "c2b99bb9-026d-4646-8b05-346efae5bd82", "comment": "Malware payload (Stop)", "value": "dc63baabd84deecd8eea558f7998ad10e22551ec39103bf02d4ae040c6c5d30f", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531959, "uuid": "7fddfeac-551a-4a26-aacf-0125e608f63c", "comment": "Malware payload (Stop)", "value": "633d89689d4b01c497a496e0753dd10abf7d9e7c", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531959, "uuid": "0d1bea8e-7ab7-4bd7-8917-54401809ebe0", "comment": "Malware payload (Stop)", "value": "83be4386317e2d73b9690f04b0694f9179c6ed87100081b892cad9721c717d2de70b9e2e19d13118259549cd956096a2", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531959, "uuid": "54ea1480-1cc0-4911-9b0c-4496eef3c543", "value": "T1E9050213B3D1A874E9664A318E6AC7F46B2FB5710F55ABEB23585A3F0E741D0CA72301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531959, "uuid": "cdcd5394-a06a-4e2e-9d4f-800038f4aa57", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531959, "uuid": "08ffec4e-afdd-4698-8837-fdf0bd0f062e", "value": "12288:Ma03LB0TXOFWmVXaHY4GHovx1slZnNveWeUnPo06B593hsfM0Ottbx2HokzEquBk:Ma1XesqHo3s/NvFHnwB5t50ctbx2IaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531959, "uuid": "ba6292a0-be7c-4402-87f0-a2aad1240326", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531959, "uuid": "392d6cac-eb98-4dc4-847a-c640fd117246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531959, "uuid": "0cca019f-e698-48bc-8cd2-4727c7f2d1bf", "value": "04587099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d4e61f-ff9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685529240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529240, "uuid": "4035144c-240b-4d87-9d60-d592caabb286", "comment": "Malware payload (Gozi)", "value": "7676674a30fa30fa1db29446ca9e9168", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529240, "uuid": "74891f3b-a6cb-4439-a402-830380ac9006", "comment": "Malware payload (Gozi)", "value": "dd3826da51ec533b76fedae60eb1d989849125d37e11616c88fe4a83d2bba059", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529240, "uuid": "59a7fe2b-f3d6-41d1-a9f4-814314275d04", "comment": "Malware payload (Gozi)", "value": "b3bea59c635a7c26aaf0ff3bacf3e7cbb5a82f2c", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685529240, "uuid": "39bb01d7-0ba2-4ef6-8cb1-d6afd67bc698", "comment": "Malware payload (Gozi)", "value": "b739a49b7faabd935d04b15ddbdfd1af233608ebc63b69713803ef7f5076700b3cd2573151cab1b4195298da697431a6", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529240, "uuid": "e1926276-834c-4585-88bd-78adef89c031", "value": "T19D93F1B54A45A44DCC4686C56AE53DC008EAB343DAC82C9235BE8B0F7F84E163FB569C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529240, "uuid": "6b5fde4f-0ddf-44a8-b23a-a9e15f27617e", "value": "1536:YLAyV2SJTxWIxAurRVIicGbNRC/fz3fkm/yiOhbaBq1Qg+/ASleRtgtSPHB:9s2SVAicGhRizv3aiOcBqGgMASQRt9Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685529240, "uuid": "8a69e38d-7c41-43e2-a386-2431e6690551", "value": 96996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685529240, "uuid": "ab8e12cd-72bf-4f33-8054-756801056042", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685529240, "uuid": "ee6ac196-165e-48f5-8ade-a16132be22b8", "value": "inv_004278_18052023.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d493fcdc-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685521584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521584, "uuid": "39d580b2-4ae4-4379-9df4-9e2c5845d8bf", "comment": "Malware payload (Rhadamanthys)", "value": "ae579f1a57697818ade5962f67398437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521584, "uuid": "0a19234e-7562-497a-821b-0e4257870216", "comment": "Malware payload (Rhadamanthys)", "value": "ddad7b5c4546bd2bc27d66de61d76e788e48dbcdbafc1a5a4129e61c2dcc3721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521584, "uuid": "8771938d-b8a5-49ec-9498-bf43f282e3e9", "comment": "Malware payload (Rhadamanthys)", "value": "a128c9b0375101f1a79804a8d433f0bd63ce59d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521584, "uuid": "29ceba66-fde2-4935-ba85-c8eff5dff5ca", "comment": "Malware payload (Rhadamanthys)", "value": "4f71994326a8d20a5ac4b48a8cfc1e00d6647ed11fd03b38e7273fae9bf9195463748c54b8cdd2e2188ef7a62e4065c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521584, "uuid": "f626941a-88e7-4ca3-ace5-91fd8491f3d4", "value": "T1A7B4E012B3D0A831EA5306718F3A82B8662FF5318F566AEB235C6F2F0D752D1D672345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521584, "uuid": "82d0927a-6e28-48f9-9ff0-93eab6cdbced", "value": "da3fdef870d17fb0b828d20b59c7836e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521584, "uuid": "8d0391be-b8fa-40e9-8232-586be7706f01", "value": "12288:9LVT89Mp0J4OcuS5/hvfZ0yLVwnsWCxNYVr2:9LRmJ4AMZ0ICnsWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521584, "uuid": "1ddf242c-4768-480f-97ab-2eefa360311e", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521584, "uuid": "e5b5e259-7a29-4baa-a4c7-e2c4870d8d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521584, "uuid": "b5e52000-8531-488b-ad53-71da523b658c", "value": "ae579f1a57697818ade5962f67398437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab46bf4-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685521621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521621, "uuid": "be77a499-91e8-49e9-94f6-7b05e2faa24a", "comment": "Malware payload (Rhadamanthys)", "value": "9f18c7543113652f3c6da52afc3a1b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521621, "uuid": "089f1b04-2fe7-447e-ba85-c60b7457be62", "comment": "Malware payload (Rhadamanthys)", "value": "dddf2d5dfe52303b7453ea824dcc4a7b48fd9beec8a4797037ad8fcda9da3760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521621, "uuid": "ceeb09e2-a1c7-46ea-8e8c-efbf27304b60", "comment": "Malware payload (Rhadamanthys)", "value": "5dca2c536fa5256df3dd7a63f11550a389db0dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521621, "uuid": "4e4466ab-7742-4288-b875-66cbc626e616", "comment": "Malware payload (Rhadamanthys)", "value": "012eadc0f116a3db5d2e872229cde081c8709d3a4b197183b190fa380433239a805de1a17968c6a862ac3e9a7d8de0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521621, "uuid": "458dd452-13e0-4871-8312-00ce67220c76", "value": "T16D940222BAF0D032F6B748305871EB5596BFB9F31A6144CF335416AB2D206D146BA3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521621, "uuid": "01ba58ea-67f7-45ae-9ef8-2cf60e308f2a", "value": "127d7b931dc3731e782c23c78259af73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521621, "uuid": "51efcd1e-886d-4b7c-89fe-154a0e6dc194", "value": "12288:fFxlRjzV77s0lBmGRnES0UcAyu7QZRDyz:7zzxACgAnyxTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521621, "uuid": "dec2ac50-0b00-4bbe-b6d3-3e1af83643b9", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521621, "uuid": "1e02917a-ab56-4097-9397-e95e29cf8616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521621, "uuid": "fec12a4c-6162-4748-84df-2b167f7904ea", "value": "9f18c7543113652f3c6da52afc3a1b53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43627906-ff92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gozi)", "timestamp": 1685523917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523917, "uuid": "afb8f154-7196-4ab4-928a-959c88b4da7f", "comment": "Malware payload (Gozi)", "value": "bf389ec4c1de1fc9cc8d77d51e6337be", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523917, "uuid": "b507732a-9f5e-46a7-90cd-0389f66f984f", "comment": "Malware payload (Gozi)", "value": "de3a0688a3da0f9bc025c3f9a1cf4d1428ed76b66856ef9568975d44b088e580", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523917, "uuid": "919ae456-bb9d-498b-8e3f-f25c2e96d84f", "comment": "Malware payload (Gozi)", "value": "153546906af44ae2a956365840dc42c29dc8e6bd", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685523917, "uuid": "61c7fdb1-77b3-4f1e-9b31-c926dcad18d7", "comment": "Malware payload (Gozi)", "value": "92e70f8b99a26a9f89c2c8971f1387c195be2a55bbdc0c94d7d8e8a9144274ed58e36e24956a21a70fb0aaa265bce775", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523917, "uuid": "8b2814de-0da2-4734-8dcd-cbc2c91aaa97", "value": "T13D82C6516AC37FF91B06E3990EEA2E63E4C4C116A6DB44CD7A9CB0D4634CA7C11BCB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523917, "uuid": "c3434994-9de0-4888-9eba-709cd4bf6086", "value": "384:heXe+aL9zn4GRFQ2WAvz+twaW4TlA5nrwMO3e6GNmD2NoG0y98:heyL9zn1RhimaJTiDYe6GNmD2NoG0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685523917, "uuid": "6231c214-f8db-456a-898f-7a2a3c1c346e", "value": 18070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685523917, "uuid": "f358268f-fb6d-40b7-a9f3-67257288dd6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685523917, "uuid": "121a2666-0b46-4d07-8713-cea972ab3a2f", "value": "Fattura_31_05_23.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0281c9-ff8d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521788, "uuid": "ff52ba2c-6a5b-4d9e-884d-ee22b107bb6a", "comment": "Malware payload", "value": "35a3fc5b0dea2166e07b8e36714faf1b", "object_relation": "md5", "Tag": [ { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521788, "uuid": "fff29060-99a8-48cc-ad6f-ba8bb087cf6a", "comment": "Malware payload", "value": "defb013c8d7d5d7786139da057a9ff8aa9d1af27aa66fba8493a6b310b3d48e3", "object_relation": "sha256", "Tag": [ { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521788, "uuid": "ab053abe-8f52-4c8e-82e3-b63a52908916", "comment": "Malware payload", "value": "c2a41c7e80f62a5d3e02393ce335e4c5c308d8cb", "object_relation": "sha1", "Tag": [ { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521788, "uuid": "1ea9b19b-da38-4034-99f4-b4ff35161570", "comment": "Malware payload", "value": "168233d0eb359b6c3a061be7dc156e539f4cbdfdb873263c46d3ca4acd5944ad0d3f2d652c504041f8fa548dbe5808aa", "object_relation": "sha3-384", "Tag": [ { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521788, "uuid": "76baedc5-9762-4733-8f06-dafa2c0a0532", "value": "T16D54235E4E2591E6C8C26A49EE8D62FC305F825B3FBA8B97910478E37750563F4E802D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521788, "uuid": "5aed4eeb-6d7e-4506-b8cb-0bc27209395d", "value": "6144:pV+lneyMD0QPgR+yYyLENNpBmfdlEa87It5whnJP:p7741avBcdyzNhnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521788, "uuid": "38613545-06e0-4eaa-b1eb-8c5d6e71142d", "value": 292640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521788, "uuid": "1c22d6e0-2857-40bd-9879-03656d0d1687", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521788, "uuid": "a5c1a597-963f-4c2f-b5d0-1023f11e5924", "value": "nShipment_Documents_PO2305-007_YUEQING.r02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9256968b-ffaf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685536505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536505, "uuid": "59c70fd8-21dc-4633-a2af-a8f3e3a23ef3", "comment": "Malware payload (AgentTesla)", "value": "2cdc1ec873cdfe7feaa1b2ec9c246629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536505, "uuid": "11de0702-2182-4f64-ad51-180cf647c328", "comment": "Malware payload (AgentTesla)", "value": "e1096e70a136c8e8b4a1a54512f69abc0e0f042aacf5aa023a8f4b17ca8c8a6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536505, "uuid": "81bb6a84-8c6e-4a31-bb52-07c315c020b8", "comment": "Malware payload (AgentTesla)", "value": "423e7373c9ba4b768ee18a9254de5de7648f517b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536505, "uuid": "0eb03129-24a3-4246-99fe-7116d82deeac", "comment": "Malware payload (AgentTesla)", "value": "a156bf0570cf0d5ef5e488ca6c3360b7a45bdba86100bb454a7be00b135436ceb89ad81a8c372ddb5c97b495ea8f237d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536505, "uuid": "54c06504-0276-4bee-96e0-3f97e88c3d38", "value": "T152341250A1A8C8BBE4B301715F3516322FE6BE125CA0A77F2751975C7DB20D3DA0D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536505, "uuid": "c92b360c-d825-45f3-8314-03669c38cfe9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536505, "uuid": "0c7f713a-a961-4818-b8d1-4a49adc6375c", "value": "6144:/Ya6muRvu7xyMuFrYsm/931aUTqGYfhrTSflgLmu:/YAqu741FrdPfp2tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685536505, "uuid": "76c2b352-49fe-4049-a7aa-89dbbf6e2080", "value": 232869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685536505, "uuid": "7518338f-c310-4e24-bd26-dcc8cb05fd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536505, "uuid": "e6204507-0232-4d12-a90b-9135210ffad4", "value": "2cdc1ec873cdfe7feaa1b2ec9c246629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862964e5-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521023, "uuid": "32713f3d-f179-43da-b201-d60659ef87e2", "comment": "Malware payload (Stealc)", "value": "4dd8c671cdad8019d64aa16dcf754c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521023, "uuid": "e7a7efca-75ee-4238-a73a-15b4621e803f", "comment": "Malware payload (Stealc)", "value": "e19e9a6f9e0536be43920fc3661266c58093eaecf32444a873848a7957487e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521023, "uuid": "fa55ec4a-620a-4893-93ef-690347f0d59c", "comment": "Malware payload (Stealc)", "value": "b61fb37c5c0033f75b234e5f3a001cf2bd8e0492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521023, "uuid": "0e2f4eac-f4c2-4796-b55b-652654c5934f", "comment": "Malware payload (Stealc)", "value": "3f63bfc0c03054e1ad966e686758249949c4e9445cd8bcb143e5635d877181635c720c4f6f7951aeb33e1640441290ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521023, "uuid": "d461ee7e-a027-4290-be77-c18573b7af4a", "value": "T12B643B02E2E17C54F5164A3D9E2EC6E87A1EF9604F55F7A713189A6F06F22B2C172330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521023, "uuid": "c7c8084d-1843-481d-808e-d3f5d6fdf388", "value": "1b92b40b68088f344c60bb50fd5ded79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521023, "uuid": "b4103ad4-5bb0-44ef-a45b-094df93ca02e", "value": "3072:MR+pMBHodhP1PTWFW9OprOPiQp/K4ra2J6oN5NCivk0uF+veQJqOfpS:Zpi87PEryiQ9K4fou2xUvTqG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521023, "uuid": "fd61306f-0cb6-49f1-8940-1799461cc3a7", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521023, "uuid": "f520b5cd-74d4-442d-aa92-112c9aa8bfc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521023, "uuid": "3685f8cd-b9a3-463d-bbe9-afe3e21488c2", "value": "4dd8c671cdad8019d64aa16dcf754c6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a78eb1-ffad-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685535784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535784, "uuid": "237ec29b-d3a1-4d29-9c0f-7c34344a3e9c", "comment": "Malware payload", "value": "dddcd3fa80ca9b4889d774c9a43a48c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535784, "uuid": "af2d8e8b-f196-49dd-a580-452c5a0481aa", "comment": "Malware payload", "value": "e1d0e92606aac8ff32c501ba9a8b163a304cd7c16beadc5d91fd0c8ad12e5055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535784, "uuid": "5956ba6a-9777-4827-8b83-ec7d3864574e", "comment": "Malware payload", "value": "4206b03080d58acfa41339b25270f59a48642e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685535784, "uuid": "c538dd9a-3a4a-4034-9f56-b4d22ea565e1", "comment": "Malware payload", "value": "df6b1947d187b921563571a7a5aef50391089bd2e1bacd6eb90ec8ccf6a4a2e405bc57cd486002fef2e6899507994efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535784, "uuid": "c030a908-8dee-453b-8e70-c5183172237c", "value": "T163C409606A014D7DEFF07A34EBDD937513A92E61057748CF13D03F8A3936A83BA6A056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535784, "uuid": "f7bd2d28-3605-4b9d-bc10-be8456dfa78f", "value": "9b0f3d5b7bbf517d4ff0e964a07ed979", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535784, "uuid": "87a3b290-cb8e-4470-b47d-30b5b3c21f39", "value": "6144:e1NQDI/hHSCmoaLyO3q+CYcrl6tmPV0GoJ0DAO1XwER0u+GIIIIIIIhIIIIIIII2:e126HSCmoaLyOa+Yrl5DHLm5BK27Jv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685535784, "uuid": "d7e1b667-6adc-42dc-9d83-dab90c329399", "value": 573800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685535784, "uuid": "8d4e0702-f429-4ccc-9f3c-21b7166653a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685535784, "uuid": "b6c8a8de-23f9-45db-9c78-03823396014e", "value": "fj74ejf.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3238842-ff8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685521608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521608, "uuid": "265fd3af-0647-4014-a8b7-f24e899760fd", "comment": "Malware payload", "value": "b940f06e78f7aef481aef71d5e775fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521608, "uuid": "e7cdeaf9-83cc-4208-82a3-e30fa439a46d", "comment": "Malware payload", "value": "e31f20fca41aa7a09e5d0ce3aa1e2550b589ba0bc9838e9b8c425e97322c5b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521608, "uuid": "88b80124-5ec9-42dc-9a5b-8cf2ae119665", "comment": "Malware payload", "value": "d38d9ee84638f949046a59f5a0eadf67e089da6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521608, "uuid": "d0b6b7cc-fd8f-4484-8239-81e513ad7e72", "comment": "Malware payload", "value": "117281a22f9ca74b89b5b135c4d045d98e84e007c21ed9b33f0de24badebc41e6e440442c2a8b758d7f11634af19e63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521608, "uuid": "a86f7ce1-4473-4afa-9f99-9662e2b7f998", "value": "T10A3601320532BDFE876C389194051B452CED58276349DFACFA4414EF29A1738EA7F9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521608, "uuid": "2de59a75-dc08-4eae-ada0-c646db76ccec", "value": "49152:tYK6zAl53s3948uRrf2Bf7rWwDyOc726tWbO8pU59QVHQ73keV5UhQ2U+Yl:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521608, "uuid": "53a74179-6d62-463b-a14e-a25fa90afbdb", "value": 5230171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521608, "uuid": "9ee3ad4e-41aa-40d5-b2e1-dfd56007843c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521608, "uuid": "3b2c0fb0-7c89-490c-9a7b-3ce8769ee913", "value": "b940f06e78f7aef481aef71d5e775fa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795d4399-ffc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1685545912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545912, "uuid": "bcdc80f1-1fd3-48a7-b0bd-4fda4642739b", "comment": "Malware payload (Quakbot)", "value": "fb446ce85f986d87cc2451b37187b7b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545912, "uuid": "a7daa124-d594-4358-a1d6-60529774a2d6", "comment": "Malware payload (Quakbot)", "value": "e460518c4333ce72e58967f69af6f49ced233f490a1d332905649ec2a3730327", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545912, "uuid": "7d15262d-5b38-4183-8287-6d52bcec8885", "comment": "Malware payload (Quakbot)", "value": "35fba94a7c869698c670ee6f34dc07330aff06ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685545912, "uuid": "04f97a64-cf87-44cd-9946-83c482dfb2b5", "comment": "Malware payload (Quakbot)", "value": "6432e238ac49bd8a3c3b0d377ab2c46bcb4eb852cf6ef6ad99dee10d34d9bec0d6a5b3eec62070ec299e87f5239a43e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685545912, "uuid": "2f711508-46c4-4163-a6ea-3b4e8c284824", "value": "T1C7A10277AF1D9EBDC269FA041184EC0BC5C9C535221F6D93E74B49A278ED80883B78C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685545912, "uuid": "cecbc405-5e8c-4a1a-b986-6021c767232a", "value": "96:T+1jA+YCiqkkUWUwd3buuFmYz/Nch+zgqhCc:sc+YCi7kUWfpbuQlY+rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685545912, "uuid": "ec971fa3-fff4-49a0-a427-1e1af09f5a85", "value": 4799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685545912, "uuid": "45fd1f8b-95a2-4d07-a191-23cd0ee2069b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685545912, "uuid": "da5291cc-036a-40bd-9c7f-1d4ea0bb765b", "value": "doc_A702_May_31.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48ec1fe-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1685533207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533207, "uuid": "261cc530-6105-4941-b679-63ae29082221", "comment": "Malware payload (Formbook)", "value": "f4ee0a7f9aacd2f8d7b9ede747b81061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533207, "uuid": "ebd22323-2191-4c00-a8b6-64e919032598", "comment": "Malware payload (Formbook)", "value": "e48b16cfcc12ff2ee80f1536f842eb7216ffd0326f2a938b150691316b9efc67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533207, "uuid": "0fb6ec61-8660-4a66-88b3-5335129a94a2", "comment": "Malware payload (Formbook)", "value": "d671fb3617da5ab681b0c8abb93f2910e37001dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533207, "uuid": "9a67fc70-3bce-4373-a530-729266145a85", "comment": "Malware payload (Formbook)", "value": "3bb47c1ed2252cd711b31ab240a326eba918534ab6a9ce3756a1f6961248bda65c226d214a435b08eed7af7e9e665c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533207, "uuid": "3030250b-1e94-4fa3-a2c1-b2bf2bdd35e7", "value": "T1F554F1AA750670DFC89BC5B2D9DA1D289B6473A22357C1476007239DCA4EBEBCF140E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533207, "uuid": "401ac59d-7c9e-4014-941d-2899076563ce", "value": "6144:lO6F6L9iDRyQmJd1ycrkUKIHBeWg6k/OqHvj5:lO6FI9iDRz648BeWBqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533207, "uuid": "0b0da6d2-a5ac-437e-9d95-1a61e582bfc5", "value": 296512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533207, "uuid": "abf3b6a1-0ebb-49fc-b339-fd2e46b4883d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533207, "uuid": "b4a1f74f-ebce-407f-b49a-ab83fdcd3677", "value": "PO-04182023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a020f2d5-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533951, "uuid": "9d8220a4-1a28-408b-8222-a52ef46d9027", "comment": "Malware payload (Mirai)", "value": "8955856362919c79e8a4793f1a7611ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533951, "uuid": "ac031bd0-d812-4b24-94a3-dbcae859c54b", "comment": "Malware payload (Mirai)", "value": "e49839d1b5b0d4d75de2a7dfba4f42bd62e72b8f2797db1ea2256c01b404e03f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533951, "uuid": "bf7740e6-3436-4baa-9df1-74c42ea4530a", "comment": "Malware payload (Mirai)", "value": "c1378ebcd3f6cfcc65f15a8650f23308ecaa416f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533951, "uuid": "1dab64e5-4534-4857-9a4d-8157ea3f0db1", "comment": "Malware payload (Mirai)", "value": "0886238c4037772b6ff8deaf2fe6bff7d266ba2dab8b0963f9c30ba5fee755b4798d8626dba5f3101a69e321b076adbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533951, "uuid": "7d0f5234-38a0-4a32-8712-3039b1f6b563", "value": "T1C483D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533951, "uuid": "e9d60a3b-3c64-4d34-af3b-ad5430a01b15", "value": "1536:iVLymx1KZzkj752dCexuV/8UZlDwfkJ4MYfWt:iVLyIUsFezxu5VD1ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533951, "uuid": "7bc4654c-5094-46fb-95e2-4b384f073923", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533951, "uuid": "e2375860-2360-492a-abe0-f386d0fb3cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533951, "uuid": "1f8f51d3-1482-40cc-8fef-52f7c0cfe33a", "value": "8955856362919c79e8a4793f1a7611ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05ce3c4-ff62-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685503592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503592, "uuid": "b23a2ad2-ba66-4890-ab7a-911d0c3a72cc", "comment": "Malware payload (AgentTesla)", "value": "45ae94c5bc224705165f9230b9363621", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503592, "uuid": "197cad56-538c-438f-abaf-14e07a76521d", "comment": "Malware payload (AgentTesla)", "value": "e4f3aa1d60e49f6b486a6fb5f5c5cf70299b12b6eb30556ce30c69c29d818c01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503592, "uuid": "5a990912-9333-4b0c-a464-e67ce0e72818", "comment": "Malware payload (AgentTesla)", "value": "c958adc462b1dccea4edfcf7caff83fcd863eb5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503592, "uuid": "77be19b3-ec36-4fbf-9cea-d1998df5a03a", "comment": "Malware payload (AgentTesla)", "value": "04768b0018bc8080a092f051212f4c5de28cbbfe11b2328065ae4638084f35c4c20266067f9961448ee2574c1b5e8fe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503592, "uuid": "1d0701c5-9427-47ab-8dd9-6523c7168912", "value": "T1B5E41219EF7F0B17C6A2BDBC5630817597EDD940947FC1ABED9A546FCC08A30AC91222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503592, "uuid": "95093c88-5ec1-43fa-9f76-b4847db0a630", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503592, "uuid": "eeee124d-d2bd-42e8-9f19-45d28052f74f", "value": "12288:i+AMTihh6xhZ6OrCeb/7NbLm6fFaSY4b9r2KLxmxR91XTkOnq0r:sMUgh8yCeb5T3YKrF2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685503592, "uuid": "982a700a-95b7-4542-88c0-7af6eb43efb3", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685503592, "uuid": "8a51aea3-5c87-4211-a382-41ba1df6ca30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503592, "uuid": "038d2a98-1d54-40be-bc5a-de997ee784cd", "value": "SecuriteInfo.com.Win32.PWSX-gen.9679.10211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ded9a8-ffcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1685550329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550329, "uuid": "c259e736-f4df-4253-aaa9-af49d362945e", "comment": "Malware payload (AveMariaRAT)", "value": "03312b9801f771da48fb136804cb9978", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550329, "uuid": "b6c5970a-0e12-47d3-b845-668155585e10", "comment": "Malware payload (AveMariaRAT)", "value": "e52f7e186b1cf6ae1dae771ebaa171a1455987d441642c07a180fe359038dbe2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550329, "uuid": "46db9f4f-afd1-413f-a2ce-accba70d0239", "comment": "Malware payload (AveMariaRAT)", "value": "57340f2b24d63ef2fdc4ab3bb97ef7a0f1f87519", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685550329, "uuid": "bdd6c18f-0e9a-46b4-9bdb-e6d43d534109", "comment": "Malware payload (AveMariaRAT)", "value": "61355efe91152677a65ef6eaaab033e4e015e1afa5a7533d4005348fb8305ea29b506346106b07600456c7472d612308", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550329, "uuid": "94e366f5-ae25-44ba-85f3-08caf3d75e36", "value": "T181E4E16ADEEE553FC4A06D79B0321134A3F8D121506BE389AE235C7FC4497B9AFD2052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550329, "uuid": "3b4470ed-3041-4aeb-9d5e-adcf4baedeb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550329, "uuid": "e224f88d-8441-4b33-9e15-a40b789b5915", "value": "12288:O96VAMTihh6xhZ6OrcNy9Y92Zmvnw9U9kyFbpj5FphHxq:SMUgh8ykqYIZ8nwhavhHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685550329, "uuid": "dbc64748-d025-4077-9b63-617ab3ca1ad6", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685550329, "uuid": "3355fbf2-8562-45a1-b4b5-f74e2f3b9c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685550329, "uuid": "4a304fcf-4b26-4ec4-96f8-d11bdeedf123", "value": "QUOTATION202331050889920.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db992f0-ffc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685543745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543745, "uuid": "66141698-2fc9-4aa7-bc8a-cb3540e97091", "comment": "Malware payload (Glupteba)", "value": "ce1d1ac7a7258bb6365d287f535852bb", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543745, "uuid": "2c5912b4-6837-4942-a60d-ed9cea031769", "comment": "Malware payload (Glupteba)", "value": "e5f2447cfc8d4c46948d054c6a954cd82a1cb9cc12ee4bd182f71c7d3c2ee942", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543745, "uuid": "c40848a6-d836-489d-9d64-877d19a48204", "comment": "Malware payload (Glupteba)", "value": "8d6f60095d0d580470f1d3b8346cc3b5f72b564f", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543745, "uuid": "f3c1a287-b3a8-4b13-a269-3db5eca5d4bf", "comment": "Malware payload (Glupteba)", "value": "4b42f2c75ded95b64d90aa1079b43270640935b12d0eba91dd230c38fcda1eb782b890382afab885a4325b1131a6c523", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543745, "uuid": "518c3802-c76c-492b-a80c-ce16101110d7", "value": "T16F163342F790A871E7669A73CD168AAC133FB4A48F0575DFA30C552FA9F01E485B2378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543745, "uuid": "016ceed3-c430-4eca-bfdf-c28976ff5e35", "value": "ecf9944f3c0ca13331da7daf765c4c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543745, "uuid": "59a9d984-fdc3-4e71-b871-04db42deb3e8", "value": "98304:W3eEa4Yo0sQ6JN6ulY3ERiWsgeuupMr4s5fhmp4R+mu9a7SPB:FPCX2iiWtSpLE7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685543745, "uuid": "dc9ef653-7da8-4786-b1d0-88547993c1f9", "value": 4368768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685543745, "uuid": "57695f19-e7a9-495e-b277-285fbcddc5c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543745, "uuid": "f752f79c-0609-44b1-b9ca-19cfe80a6b96", "value": "JaffaCakes118Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087b8ccc-ff77-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1685512222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512222, "uuid": "510bcc30-d857-42d5-8e71-3ce730a9ce27", "comment": "Malware payload (AsyncRAT)", "value": "c514ff7ca1abd4e92b17c1249e00569f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512222, "uuid": "fe9c5f93-87fe-4eef-995e-efcd482c7a5a", "comment": "Malware payload (AsyncRAT)", "value": "e7257b2ef7c6b3b168ad3671313943edd71572ac24421d765890a878a67556bb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512222, "uuid": "17ab755b-1519-4616-ae62-8594409e93c7", "comment": "Malware payload (AsyncRAT)", "value": "5ca2b947a3722a75b6b4299e8aa2341fac1da608", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685512222, "uuid": "a4602bf2-15b1-47dd-a492-836493bfeb81", "comment": "Malware payload (AsyncRAT)", "value": "4e8b9c425a9dce9dc8001d1c7dbcaf9ec5b36b2a8d4a033d43b542a6805bda6cdb4f2a1c404fa4504c0691e981e5a70d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512222, "uuid": "573d2f94-594d-46be-ad43-412acd2cfe7c", "value": "T179C40151EF7F1B07C5A6BEFD0B304035E5FDD686A02ED59AE9970C6FC854A31AD80222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512222, "uuid": "1f6b0b44-534d-4510-bf1c-cafd752a0d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512222, "uuid": "e63a0422-d4ff-476b-a8db-2bce41a17dbd", "value": "12288:Q4AMTihh6xhZ6Orm8pet86bqUoEjU7tkJB02EiK:gMUgh8yna86YEjU7tOBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685512222, "uuid": "af37e504-1058-4644-a7c1-6a9f0c33f821", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685512222, "uuid": "0b0bcb27-4243-4795-97ba-5bf7cd18b48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685512222, "uuid": "67837c0d-4602-46c7-bbfb-d308e8016944", "value": "x5Z0luEJ3fbsDaW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2aee00-ff87-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1685519129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519129, "uuid": "6654cb5f-cac5-4959-9e42-1a2cc9ecad52", "comment": "Malware payload (Pony)", "value": "a6c6ac644ca3f29f7fd9de2f947192f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519129, "uuid": "658c7d31-5433-4e36-a062-c36e6a23b182", "comment": "Malware payload (Pony)", "value": "e80b1723280023b1125b739fcbc94b46da10a4c702c39ca419189d052700d132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519129, "uuid": "5de35eaf-4fcb-49e6-9e11-d1eddc94078f", "comment": "Malware payload (Pony)", "value": "bcc6a38861caa9bda0d13cdf102ffca714f895d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519129, "uuid": "79b54e95-0bab-4990-8f4a-2106ed99b8b2", "comment": "Malware payload (Pony)", "value": "6150cd9b02a7a3a6746a46837924a7712d61b87b3a7314e2daea3f955c331cd5c2b3ae46ccfcf203b3aaff0580bd2dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519129, "uuid": "80460f0d-7cb6-4b39-9864-0b8a7d2355e4", "value": "T12BE4DF563697AC09FCACBA310DA69560C860ED717864CEBA61B4FB3E59332049F3071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519129, "uuid": "3eecd8e3-2be7-4197-888c-e85122928ca2", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519129, "uuid": "7cd02f5f-ede2-4f1f-bab1-254916ce10e7", "value": "12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHU:Url6kD68JmloO5TYI1lOq6sb8hTHAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519129, "uuid": "e6bfb701-1a02-414a-804f-e2d847cdbc87", "value": 719138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519129, "uuid": "accd0483-8fec-4f7d-8a49-eb8145251115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519129, "uuid": "54c05ab0-d106-439b-af71-50e97df7dd11", "value": "a6c6ac644ca3f29f7fd9de2f947192f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787ef8c7-ff8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685522289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522289, "uuid": "6e9feb14-b508-44e6-bf70-877fb3fc7153", "comment": "Malware payload (AgentTesla)", "value": "c332f541894866c101840b77191efaa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522289, "uuid": "a84d4a4e-9bf7-4e44-94fb-193cbd79c9f4", "comment": "Malware payload (AgentTesla)", "value": "e83805100a3fa98e0b2b134a5c39758ae565d82bf77dd3c9f15d03ea54f01637", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522289, "uuid": "ca4b7ddd-0297-4ad2-a2d5-93fd3ae9a2b1", "comment": "Malware payload (AgentTesla)", "value": "2a5e0b762a61c926c1aa3a61b3dd1fe56dea0f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685522289, "uuid": "92829118-a066-408b-b738-97d7e9a8bff0", "comment": "Malware payload (AgentTesla)", "value": "22862262068766d1840fd79b0085bfc47d116cf952677a9135a6043332194da19e660e22528054a0fc8a298407cd550b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522289, "uuid": "b3ccdbef-2300-44d4-af7e-3e89d908585d", "value": "T1C664E05A3BF82F13E03A5BF5E9B150404BB5397A6964D22E8DC2B0EE2471F504A90F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522289, "uuid": "06d70978-e359-4cf9-9ee8-eee874d92e5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522289, "uuid": "ef5f8e1f-5ad3-4d45-942b-7ea75af1f5b9", "value": "6144:b46t6kN4X+4hUkSO3nGmTs4XWx2OLk2upvw9WxkgMLeU4ZINBkJT42K:rIu4hZ1BTAdLd8vwEkbSuBw4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685522289, "uuid": "1d094488-c281-4cc5-9b0d-29d482f91478", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685522289, "uuid": "03dbe6f7-0f5c-4ee7-bf08-a77ded33f71e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685522289, "uuid": "f97e6b34-8a5c-4fe5-99b0-ec87a0f9db8d", "value": "c332f541894866c101840b77191efaa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80441dc-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685519899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519899, "uuid": "b5043cf3-ac98-4892-ab95-3b18b7d1d3d1", "comment": "Malware payload (AgentTesla)", "value": "f2444f79a409551f62cfc4cd3af8323f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519899, "uuid": "37e65508-2020-42d6-a0cd-bb97bba2f1a8", "comment": "Malware payload (AgentTesla)", "value": "e922cfa32a7d1cc26ee8fffd5d8d5bbe64603969800753f8c035137a983cf523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519899, "uuid": "79a95376-e79f-419c-94b2-8859d1f4046c", "comment": "Malware payload (AgentTesla)", "value": "c034c48f93b2466b3e881bcc63bc9a411c668142", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519899, "uuid": "3007a917-de2d-456a-a68a-027e5b666ae8", "comment": "Malware payload (AgentTesla)", "value": "5ee310125cac859f83dc4119c45ff0364774a059174f7ff1d5a7c050c5b343c4290063ce68ff91e8788b4bf70245b21e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519899, "uuid": "89af25bc-6190-441b-a6f2-b125f9bf16fd", "value": "T1E565F122F4859C6EEBDACB350EC3A486861C7D57BECE68862345731F7A321E1974324D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519899, "uuid": "c67928f3-d89e-491a-8add-630c6384da9e", "value": "24576:sLKzc2kJkDWCQYOkKD2kJkDWCQYOkPnaWsyDg0bY0Me/Mx5d0EHqWCM:sLKAJk+kCJk+kjsWg0bVMe/M6EHJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519899, "uuid": "dfe5b4ab-a5d6-418f-8a0b-20058c750104", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519899, "uuid": "f53d3e43-30e4-4b33-b78b-20b9a638f558", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519899, "uuid": "6221667e-3bcf-41e4-82ee-50c8d9c9231d", "value": "Consulta de precio B12A0102.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eff7b8-ff57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685498546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498546, "uuid": "a11bc039-e54d-4785-9167-fbbfdc76239c", "comment": "Malware payload (ArkeiStealer)", "value": "8ac1a031fe2b324ce725b33291865bb9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498546, "uuid": "1772b5fb-77d4-4beb-a846-47f2e4f6a517", "comment": "Malware payload (ArkeiStealer)", "value": "e96f81681418f41f6450e7c75cb6f669faa400eea0da19cbf5a77da4cf36332e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498546, "uuid": "ef3670b4-704e-4b7a-82b6-78bc8c526c57", "comment": "Malware payload (ArkeiStealer)", "value": "44fcd523670184503a4d32d5aa22951d72d73732", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498546, "uuid": "b2d1cadb-5853-40ef-8ec2-a847427fff30", "comment": "Malware payload (ArkeiStealer)", "value": "635fe6cbec8d1d63be12b24060bc52ac091f57adac5879c28a2dfdff326f7c8cc4aad9f592b87df4152de4fb160a3191", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498546, "uuid": "e5eaa0a9-da26-4df4-8938-a2589ef290e1", "value": "T11964E11177F1D0F2F6BB4534D930CB64AAFFB862A679855B3394076B0E30AD18A39312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498546, "uuid": "14355303-1f7f-4965-af31-6a3d6f3d2f4e", "value": "27113c217d53f26eb8f070c56bd3d296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498546, "uuid": "a3825662-8a60-412a-8ac1-e48bcb45b5d0", "value": "6144:Tm5TArJNIkseK/yc4hyhdVFJ5NQOeqtXwU9LE7qHUZnvY4AchIlokNiW:cTAXI0K6T4fzNneCxZ3UZRAUI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498546, "uuid": "49f89a26-7d2c-4478-9e45-cc56fb26e6cb", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498546, "uuid": "cc9a3998-e481-4c31-8185-6853838aef09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498546, "uuid": "91d3f732-c1e2-4521-a31c-ddc98a9dcfce", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02caf232-ffab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685534546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534546, "uuid": "dbfdb012-c64b-4542-85ef-9e9c70b521e3", "comment": "Malware payload", "value": "0843ef0d0d94e991d1c9ba259217c069", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534546, "uuid": "e4d795ae-10f6-4820-ba46-4e1322e22200", "comment": "Malware payload", "value": "ea731e7c7b35131b463a95c47d04566b47f17d39720e123fd343fc16c04706f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534546, "uuid": "5c606d35-7949-4dbd-9b40-4210afde5295", "comment": "Malware payload", "value": "8e17f7c8acc7b9f99607983a7db1ebbb6e6f2a54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685534546, "uuid": "715c2b4a-cb76-4199-a03f-98db3495b50f", "comment": "Malware payload", "value": "fb7a7c8aebd46bf34ef9e8b0f8a37bfef280bd9ca1bc8b99d1e4717a5e488553c37db06d991482cb17dabc9d02de3420", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534546, "uuid": "12730992-615b-4b56-861a-2e854b5e89f5", "value": "T176735B4077D1C8B1EA7E59380464DBB06B3DB9219EE09EAB3785167E0F702D1EE31D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534546, "uuid": "13f9f6a0-65b4-4cbb-815f-36b7cabb4710", "value": "5f5e0ab977c13ce93f83a330b585ad76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534546, "uuid": "57de2c3b-2edb-4357-a592-96c05fab5b28", "value": "1536:iQdKUILYqexqUG0XSDcy4Z1jsWitcd7MW5wfyOS:ihLYqRUG0XI4/97Mww3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685534546, "uuid": "f2e80995-75e7-4792-b1c4-7c121a123a28", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685534546, "uuid": "6012930e-f812-41fd-9340-a896ca5c3a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685534546, "uuid": "02b6f510-d170-41b6-91d6-23e8daa0ceaf", "value": "SecuriteInfo.com.Variant.Zusy.470531.23587.21693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5572e9-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685533247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533247, "uuid": "70ee8bc2-1df0-4f34-a38f-10b84f7cc4c1", "comment": "Malware payload (AgentTesla)", "value": "0c321e2af918638e23f45fb6b8eb0a8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533247, "uuid": "2bda5d68-0912-4de4-99e7-f18e84702bf6", "comment": "Malware payload (AgentTesla)", "value": "eb2ea034a42d0f38e56cb044d0430fc69da6a5d28cedea28527326ddbccd8f26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533247, "uuid": "d68aab21-bc51-4acc-b6ad-68f2cab775e0", "comment": "Malware payload (AgentTesla)", "value": "6374d619e365afbaadc94d05be427cad47fcdce9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533247, "uuid": "87119085-864a-44c3-929c-ecfb6089c9f4", "comment": "Malware payload (AgentTesla)", "value": "762550b445bc09061a61b11770ef8b41a0909770f2d09e4f454cb8eeec9ae52ce1d998ab8deec1022cea39caa57ca6fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533247, "uuid": "b34f3df8-d4b3-488d-9268-eabd74e7e748", "value": "T11EF41761B1D910CCF6F32A1296FB41F47A1BB6D5B83C999D0DC9992D37E7800CA93362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533247, "uuid": "0cd8f793-4f86-46b0-9032-18668a07d0af", "value": "3072:5EG8wfkYFEhNe4VTdRnTT8w4TWJa415rkjjDKJjHkUmZZqsZg6GpL+og0S7wQzSM:MwfkYF+aZq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533247, "uuid": "56465b71-5874-4f09-aa9b-083e6bf88097", "value": 791198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533247, "uuid": "8dccb840-441e-445f-8abe-81c0a772a3fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533247, "uuid": "c0f6dc3c-c990-4e90-98bc-be285b19b1ff", "value": "PO-Specific products,Financia.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91553750-ff7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685515029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515029, "uuid": "76bd4732-21cc-480f-814c-33145cddee79", "comment": "Malware payload (njrat)", "value": "59ab45c79348e51cf0cbd4bc8057a0a9", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515029, "uuid": "9c58195a-80e4-43cc-a847-9f2f095e69d6", "comment": "Malware payload (njrat)", "value": "ec0d2563fa0b8322327578c8a026c118516c9d7e3cf83a702cafa111122064da", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515029, "uuid": "ca385f6f-7f1b-4c7f-9f43-7b4716269b40", "comment": "Malware payload (njrat)", "value": "f22ccb018c2e686f8ddce58d61103f835b2e353d", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685515029, "uuid": "edfd1601-cf7d-49ef-9cc3-84eac9a4633a", "comment": "Malware payload (njrat)", "value": "905d4f36c7a6b0c5dbd004d643c23f90b603a3e61c1ae1ae0f7a7369aecdb4f0d72b3881ff72284e521b231aaa773727", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515029, "uuid": "b7e7948f-6f10-4297-9ccb-fdad60b2ef36", "value": "T13A93C64977E93564E0BF56F79471F2004E38B4871602E39D58F219EA1B33AC44F89EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515029, "uuid": "08781544-5938-423c-a10d-a6f32f83a5de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515029, "uuid": "676ccafe-2596-4ecd-8f19-b90cb2465176", "value": "768:QY3nQbwMaLJ7chQgIKt0eBD+QhnXl5a8zGwCpXxrjEtCdnl2pi1Rz4Rk38sGdpl3:Ib7alYIKx5+QdT6rjEwzGi1dDUDlgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685515029, "uuid": "a883e19d-b7d1-4cb6-894d-7d28c2bbf196", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685515029, "uuid": "8bed0ea3-60fd-4ad2-bf2c-5a476d45dec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685515029, "uuid": "b09b1e35-0585-4576-906a-9ce293553e47", "value": "07607499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8730a375-ffbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685543359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543359, "uuid": "3257539b-576a-4a96-8ac0-b59d0abc859b", "comment": "Malware payload (Mirai)", "value": "57247cab87467839480c61af4a10619e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543359, "uuid": "aaeccae2-d54b-4693-912d-44d47c9f833b", "comment": "Malware payload (Mirai)", "value": "ec70b32205000e1c2c85356e6f008c5a6efb862c71884c081e55c1477dcac400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543359, "uuid": "5734a5e8-7aa2-49df-936e-6125cd615444", "comment": "Malware payload (Mirai)", "value": "688c00538f18723079f97e409b96adf2d8d95421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685543359, "uuid": "bb05f0fd-dc98-42d3-af37-c9addf63e82f", "comment": "Malware payload (Mirai)", "value": "642ee85727b92dbcbf7f7cf298a1843aada753c1f9b50091a1379e5e543c3417199a1e77448599bdfac681e452b06476", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543359, "uuid": "f57193e5-d0bc-425c-9c0b-0bdf1fe0212d", "value": "T1C503F12AA98774D0D5F08434D4369923126D5A64E8C53313F78D4F67BE32C67A7FCA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543359, "uuid": "43cbaada-808d-41f1-a5a8-35850843de63", "value": "768:ICt8xQyKEXdvcsU2fPmwY4gLMh310IJ4XZbO6xHxq3UIQe:IGSzJsvb41h31HGYuHeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685543359, "uuid": "d8a646dd-69e8-4526-b851-d37984932662", "value": 37912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685543359, "uuid": "b3d734ca-8ac1-40e9-8b74-2a2c6d455601", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685543359, "uuid": "238a048f-f068-49c1-9a75-059dae10801a", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.21505.14553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cfb01d-ff55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685498011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498011, "uuid": "6669c4ca-03d4-4c3b-a64f-422ec01b135e", "comment": "Malware payload (Amadey)", "value": "8b6bbb1e3d4cd828945d08477255c85c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498011, "uuid": "a0793417-2fd6-415c-88b8-2bd5a2abb3ba", "comment": "Malware payload (Amadey)", "value": "ec7218b6706e34b0ba1dc8be9619a8913efa54c96e9570bd93cdc418b43e8aa1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498011, "uuid": "49fce807-6d70-44d0-9c66-4b592ad765eb", "comment": "Malware payload (Amadey)", "value": "486eba543492cb3ee63bbfe3ec737ba5906daa90", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685498011, "uuid": "35732a42-4fac-4a4e-a3e1-2eff5e27b994", "comment": "Malware payload (Amadey)", "value": "9c89ab15b793c635e9cbef2a64fa066701106299f761ee2295ee73a5dd19d55a4e79de465fad82743e6632b75a16da34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498011, "uuid": "4ae62802-4564-4559-9006-77d22a60ade1", "value": "T194367DA95BAFE119F48BD1337F107FBE4183DDA8769D0224C080925C2B4BB497B959CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498011, "uuid": "db255f90-6918-47cb-a6f1-686aa660507d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498011, "uuid": "643cba01-8574-40fb-9228-4e6a09eba05a", "value": "98304:udBY9slh4DJF1QWHc5ymiJA7MNMrL3HW4PD25u:udBYh+WaaSrLD78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685498011, "uuid": "d557d6ad-8f18-4886-b72c-bd03c850913f", "value": 5128704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685498011, "uuid": "61f7755c-cfdc-4595-9d5e-4d457da0237a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685498011, "uuid": "3e25879f-8797-46ff-923e-3a5d3e4e29e1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40fbe80-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685533529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533529, "uuid": "d5e85830-49ca-4867-b84a-97c9e7285af8", "comment": "Malware payload (AgentTesla)", "value": "29209782a391d3d257c0a8a946eb39fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533529, "uuid": "842a32ce-c7ed-4f43-a0a1-8d1e16cc0601", "comment": "Malware payload (AgentTesla)", "value": "ed94c753064971e38dee3654d724be05e1707b20e4fe56f7c585ebec22dc3c5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533529, "uuid": "3cec2581-1c41-4b82-bd04-106e4de05eb5", "comment": "Malware payload (AgentTesla)", "value": "07a67e2f25b50213fd8f5d2dcb59f24bdbc0ed8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533529, "uuid": "41ea4ba3-e713-4a50-bc23-bf7263c7ce44", "comment": "Malware payload (AgentTesla)", "value": "767ff5cf39f1f8755fc08a1fcf60ab6be23d48a2c255f11a446d9ca2ca101b7c8d8fd12da7de06f5a640f318f79f78cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533529, "uuid": "86965967-140d-4c38-a024-ed8ff3a9dec5", "value": "T18B65F122F445CC6EEAD6DB355E83A48A850D7C5BBDCE28862345731F7A331D2A75320E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533529, "uuid": "88cffe97-7ad5-4f67-b2ed-8b356b20faf1", "value": "24576:qLKIPVNQ2zEbufjODWXXIMVNQ2zEbufjODWXXR5naWsyi1v99pIQl2RBn99gVONt:qLK0VNQ7ufjOcrVNQ7ufjOczs91V52Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533529, "uuid": "33700f23-3cdc-4c8b-b914-bc8aa83b89c2", "value": 1498112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533529, "uuid": "36cd6c5c-e20e-4493-8463-d4af013f3821", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533529, "uuid": "4a8ec1cb-9dde-43cd-98a6-bc8d20008dac", "value": "RFQ__06Q011740_7037208432_106.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfdedf0-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685520204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520204, "uuid": "3a0d4558-c779-4bb7-8bc1-776ccde76903", "comment": "Malware payload (AgentTesla)", "value": "0c72c8ea1ad9fcd0c3b336aa6ac60820", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520204, "uuid": "690cd341-c9e7-486b-a4c8-f9093d50056c", "comment": "Malware payload (AgentTesla)", "value": "ee327a9da88ded013dd5fb693b0e623e0ceed3030100b8f46e1272955e11edf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520204, "uuid": "aa0d1047-263e-47f8-af8e-6e452e833eb4", "comment": "Malware payload (AgentTesla)", "value": "63b359fa9823eda6a4c312904dcd40b1295a86c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520204, "uuid": "5d0fcf89-115b-4f34-9a63-28adbdfa229d", "comment": "Malware payload (AgentTesla)", "value": "ec7a0b7a6381fb23b5b61591fdec71e30821c3c0dae1dc98181e0fe67d6089bb0d2d44dda90261a70107513919a6b533", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520204, "uuid": "f2acab5b-e35d-4147-a45a-bbaeb7fdca1f", "value": "T135C49352A2ED0084F3F22B406BFE91B47B27F9D59839C95D049C896E67EB900CC62777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520204, "uuid": "5dad4bad-f8d4-43cd-9bb3-0dbf4eb96aca", "value": "6144:ewfkYFTdeeeee+eeweeMeeeeebeeeeeZZqy:+YFTdeeeee+eeweeMeeeeebeeeee3qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520204, "uuid": "9d52311b-a039-4f91-9179-8490ae64df19", "value": 587680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520204, "uuid": "924f02cf-4d18-4fb0-9844-8fcf7830146e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520204, "uuid": "c5af8e6b-28cb-425f-8e02-1a5a7dbf98ce", "value": "Listed product.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4e1cb2-ffe1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1685557975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685557975, "uuid": "bdab4c30-ce0f-4513-831c-3fcbec029e85", "comment": "Malware payload (NetSupport)", "value": "63328c7d7ed6136a9cc36fb0d813a140", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685557975, "uuid": "f917276a-591b-460f-b76f-09ca96e1ce6f", "comment": "Malware payload (NetSupport)", "value": "f00ad844ce61ad9ad2e465b7a8faf960f767f15d133bb8e1911c8b114998e886", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685557975, "uuid": "6cc4d6e2-b0dc-44ee-8699-198697042dc0", "comment": "Malware payload (NetSupport)", "value": "70134bb3c6cfd29cc5ce9dee42a5d2c5c0d113c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685557975, "uuid": "bb666b95-336c-4191-9675-d0ea558bc59e", "comment": "Malware payload (NetSupport)", "value": "fad232adf0cb5ef3ed41e2206f78d6e70cc14be6e2f79938c694898b230a04d94468ab46a49c377100d8e03591e6be6c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685557975, "uuid": "31b56242-0e19-496a-b9d0-24d7b760efbd", "value": "T12E230DF8A9D390A4A523707F5B1FA844B1D205070C18FA057C5CA9506FDE92CBB78AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685557975, "uuid": "a827d677-fdd0-4142-9a13-f8fb11d44259", "value": "768:/y2MmuxpUC7Aa7AoSQnMzIrQxLov4Xkh/:/yAuwCN7Ag4Ir34g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685557975, "uuid": "a4b22780-d4ba-4721-9045-76b10427c2df", "value": 48713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685557975, "uuid": "92787957-b6f6-451c-8471-cbf4455ad183", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685557975, "uuid": "09540426-3fe0-403f-91f0-894db878e065", "value": "doc1260.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ff4bc6-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685519821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519821, "uuid": "057eb6e0-4d01-452a-9a4e-1375ef29404b", "comment": "Malware payload (Loki)", "value": "f334a5e2d5344d9600079e90634a9549", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519821, "uuid": "3b6e1859-7e18-4677-99e1-ef128421cf8e", "comment": "Malware payload (Loki)", "value": "f2145feb384e99bd19d1d7abb9d0353227ba0ee3f2071730e751e7d4ea30960c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519821, "uuid": "4a4db64f-780b-4c86-9849-83697802cd35", "comment": "Malware payload (Loki)", "value": "3547e535be00928fcf733bb60b78d1119d1ecabd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519821, "uuid": "ee707525-7e8e-4c3b-9b81-aa5fec38e1bc", "comment": "Malware payload (Loki)", "value": "9b176d218a0d32ff5cbb62a840eb6a8f4e7b29acec611e9e037147c9b66ec47858536c0191131d37f80fc2ca1066c4ff", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519821, "uuid": "eb0f9cf0-d3fa-4732-b24b-bb9de115dae4", "value": "T1BB65F122F499CD6DEA96CB745F83A485860DBD47BECE28462345731F7A336E2924330D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519821, "uuid": "dc454f80-a0f3-41d9-9ea3-0449c6fe608b", "value": "24576:qLK2Dm1smPDWoME1smPDWoInaWsyv2+hD+yXv/DeiDnl:qLK24smPrsmPmsw2+l+yTVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519821, "uuid": "8c05762d-0d57-4b9b-a79d-5241fb9c4f48", "value": 1498624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519821, "uuid": "df7a1ccc-1e30-4326-b522-d6772a01dbc5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519821, "uuid": "06259472-17ef-470f-a1fe-1bd81cec29e1", "value": "BL Draft copy & Shipping Document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10c1390-ff62-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685503593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503593, "uuid": "74b6641c-2e52-44f7-8d29-722e0bb7a694", "comment": "Malware payload (AgentTesla)", "value": "1b15c7d871a0071ee6c4648df420dda8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503593, "uuid": "af9772c5-1d18-4e48-9511-d97a5cb90827", "comment": "Malware payload (AgentTesla)", "value": "f2168fe0192cc2c215eb36164e3f646177934df2681703551ac90ab73875f37d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503593, "uuid": "0dd41c8d-96b6-423b-9814-7a8129adf8c4", "comment": "Malware payload (AgentTesla)", "value": "2351c19ed2e9f89d59792e28cfa436b25fa89de9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685503593, "uuid": "2016bc78-0d68-46eb-be8d-cd20a6898630", "comment": "Malware payload (AgentTesla)", "value": "54b348689117efe1cd17322e4dd6728e22e5fd9328580fcf5a34f0d55cd21091f28835707f02edd8526ae23a72da38a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503593, "uuid": "ac24252b-da50-4501-a31d-044607fda5ae", "value": "T1BFE41256EF7F1B0FD5A6BDF94B3440B49AFCD541906FC1AAE987087FC818A34AC91422", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503593, "uuid": "8d1a3369-808d-4cea-be67-e523f012bda1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503593, "uuid": "d1ae6e6e-d214-46b3-94cf-7a63a97bd40a", "value": "12288:XDAMTihh6xhZ6OrMMeKsxd0b4V4lOrzSjyaJ5dKtjnOQfW/6jpVwhZdu:0MUgh8yMM1gdy4ilOrzSj1wjOh/6chr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685503593, "uuid": "27326d11-230b-43e5-8c1e-0ee17105ed30", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685503593, "uuid": "b7c14786-8961-48d1-afd5-340cf286637c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685503593, "uuid": "af2f9884-4d23-40a0-934e-9be5efd2faf6", "value": "SecuriteInfo.com.Win32.PWSX-gen.30582.23346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71724dd-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685519870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519870, "uuid": "2cbe79d2-ea7d-4ebd-a2a1-2c7cf4a1b573", "comment": "Malware payload (Loki)", "value": "4db4b31af32b30e7eab2469e785eb3e6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519870, "uuid": "507c0107-b49d-4c91-bd95-9b228e0fc133", "comment": "Malware payload (Loki)", "value": "f2b08001b18c443c97b1e02949336ef1ff452871d57641ec422481b91f7088c3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519870, "uuid": "220f852e-f9b3-4090-a7d9-cdb426a9f030", "comment": "Malware payload (Loki)", "value": "c396e7b7fff582c695394b7ad994ba84e2df120a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519870, "uuid": "fff138f1-0663-48cc-b291-520532fc839f", "comment": "Malware payload (Loki)", "value": "411d71cdcfda221be6c0a2e9cdbb74bd8ce0240b061d194f0532dd4f115a059ee9a0502c16a2cd933b3a1b2086c6d45e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519870, "uuid": "22117aa7-2185-4bde-ad8b-34d0035c9148", "value": "T188650122F885DC6DEADACB745E836485851DBC077ECE68862345731F7A336E2A74320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519870, "uuid": "238aec7d-f91f-485f-b5c3-430eb108ec14", "value": "24576:dLK8puDWByavcuDWBya4naWsyI6Lm4Y+RN2viLi08Ibgn7:dLKqu7ufsYk+/22Ymgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519870, "uuid": "defdcfee-7b08-491f-b194-64ec416ad137", "value": 1498624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519870, "uuid": "0af8590f-a06f-44e7-ad23-481e4ebf7d39", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519870, "uuid": "5715f552-649f-4d07-a176-6479de38c4f4", "value": "CI, PL, Draft HBL, Draft COO & Draft Insurance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aa3e22-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533905, "uuid": "e3c1c0e0-0500-4211-a758-787ea6842e48", "comment": "Malware payload (Mirai)", "value": "e32d1e20eda227b526d8a2bb25a7a605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533905, "uuid": "2e83a155-cc69-49b0-a062-b5a1a9223cae", "comment": "Malware payload (Mirai)", "value": "f33568f6f172fe98d0f571aa7e5baae29870ac075b4adb517533893152dac0f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533905, "uuid": "c3de9948-b373-435b-a613-f729e3c3193e", "comment": "Malware payload (Mirai)", "value": "9189b86d2139a284a1addc0df504639c874ed5f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533905, "uuid": "c496eccd-059b-4cc6-a380-979c08a2c129", "comment": "Malware payload (Mirai)", "value": "3cc9bffdbda6770498d4c97a5386c6bff8d3c9900b3d8f7c345c1f6cd924fff45dfc24f60c2f13ef55abb2e5edf9483d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533905, "uuid": "72650200-cc79-4bc6-a177-323b2219893d", "value": "T102634C99F801DD7DF84BD77E44570909B530A3D143831B3A679BBDA3BC720A92D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533905, "uuid": "663bff0e-11ba-45d1-ba8c-95dc6189b15c", "value": "1536:PqofWOSA7smdDZD43r680vTf1kx1h7VdJzLg9x2K/QbI:Pqo+OxZE3rCf1u1ZV//K/KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533905, "uuid": "5d9f6079-cc6b-438b-a413-8eda55aafe78", "value": 71808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533905, "uuid": "5957a4a8-ae76-482c-9bb3-be31e17aa6e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533905, "uuid": "a0127356-fdec-4f21-81ae-369cd12a131d", "value": "e32d1e20eda227b526d8a2bb25a7a605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4be36a-ff89-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685520201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520201, "uuid": "5d7a9e7f-e771-42e8-b1d7-d4a27db28746", "comment": "Malware payload (njrat)", "value": "c34847ab40c8b63a4e101e695523888d", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520201, "uuid": "71067529-1d6b-48d7-98fd-56d9ee27b65d", "comment": "Malware payload (njrat)", "value": "f401d3eaa05785e0a1516f45eeebe598f3d660fcb48a217fdb24a3c2777c8ed5", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520201, "uuid": "f4fb2880-7deb-479f-a2fd-6eb5f9262f9a", "comment": "Malware payload (njrat)", "value": "938a1b906f0e92f5efdf0fac69b173f70ff1c03e", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520201, "uuid": "25811e63-7d77-4f94-939d-213a02b18363", "comment": "Malware payload (njrat)", "value": "da4d22d01bf2c923089ecb2a7b368ec0e1e08ea83a124e951c367674f2edcc64c786bad9aa07e2693c69d0f6fdb75997", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520201, "uuid": "8afc6513-778e-4eb0-85f2-c8d84cc500c1", "value": "T1C6349F5223E61125B1763B9CAFB291344B1BBBA5697DC23E06BC340A1FE3940C4E57B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520201, "uuid": "f543a9e6-4298-499e-9ec3-e966dd73babb", "value": "3072:99u999i9y99y999999999996999999999999N9999Pj29N:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520201, "uuid": "b39dbb9c-c04e-4244-963b-86f1ba05cdfa", "value": 251354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520201, "uuid": "43888488-8e94-4440-bc38-5a5d456f329f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520201, "uuid": "bad2fcb7-d905-4744-9c7f-7b2c67a74f02", "value": "Cobro Juridico Historial de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c5ef3e-ffa9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685533914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533914, "uuid": "3ca6ee72-50a1-4ab6-a06e-ff5e29747719", "comment": "Malware payload (Mirai)", "value": "11810026856cc8f502ca3e6131964d70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533914, "uuid": "31383a2c-9195-49f0-9fee-0bc41150101e", "comment": "Malware payload (Mirai)", "value": "f4196baabafe1bff5049e7f210af20b5fd4a125ce4166a5eef71804b909ce75e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533914, "uuid": "f91daa94-b7cb-4f12-ae3e-9f7b7c31a350", "comment": "Malware payload (Mirai)", "value": "acc5d529dbfad1fb6461bab7beef7bbc53e1a41b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533914, "uuid": "a3d927f0-7484-4582-9dd8-bacd95b7a46f", "comment": "Malware payload (Mirai)", "value": "a1eebe22be67b809619ae502a00e29dec0ab35a7038b0646150f5542bf65e39f9bec464686366a6aa229e129d98bf62b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533914, "uuid": "7f20ee8b-05fb-4c86-ae3d-5ba4b656a272", "value": "T1EB534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533914, "uuid": "9b998514-04c6-4d9a-865c-15fa90020384", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/MyV8SpXCpEM4k/J9KCrMvuBxANUr6FV+tMiwW/W:MvolWm+l1pXgdDKCAWBxANee++bWevF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533914, "uuid": "ec2deecc-79f2-4346-a51d-1184c1631d7d", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533914, "uuid": "638bb97e-191a-4824-b19f-aa98d2aa47d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533914, "uuid": "2a78b981-649b-4194-9195-7744314a139b", "value": "11810026856cc8f502ca3e6131964d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce111e8d-ffa7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685533170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533170, "uuid": "81919afd-cfed-45b8-bedd-c7c8c79e8403", "comment": "Malware payload (AgentTesla)", "value": "0b34c0754723aadf1c9b8a5c29c952a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533170, "uuid": "6d1e8b28-3818-4242-8f39-0cc1f495654e", "comment": "Malware payload (AgentTesla)", "value": "f441db62942b1b699b8bc0a85387d1cf91a84fa1bd8772ecbc2b55e2e92d4cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533170, "uuid": "c8d45221-9feb-4c9e-9f2b-bf0b8c1e42fb", "comment": "Malware payload (AgentTesla)", "value": "d3906d022861f69469d349ed3d084c128da7d893", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533170, "uuid": "f736da33-d279-4d62-bd96-2dc677083610", "comment": "Malware payload (AgentTesla)", "value": "7c437a6b4b466bddad54e9ea112fa7d5ee1c6d8d16a2e580b5feda67799b3b1d52ac78bd9b02a30816567842a572530f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533170, "uuid": "8ee8ce34-1ded-4819-9ea2-4a039b2a0ffb", "value": "T106E5F1963780C596DE9C42B68252C1B023659EBAD508D64B7BCC3F6F3FF57920822367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533170, "uuid": "a5b1561d-61d6-4b0e-b986-a332d81468af", "value": "49152:WnoyoWrAnzcL+gh12wNQ57H5I1GGfgIjqKoe:Wnoquzc8wNQx5GLjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533170, "uuid": "6931c6d7-fb18-45a6-bec2-99a3008cf046", "value": 3080192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533170, "uuid": "0299569b-59dd-456e-a87b-5c6902003cfd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533170, "uuid": "09ecff29-af8c-4709-978e-f28de3a92e27", "value": "MACHINE SPECIFICATION #30523.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68640a99-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685520544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520544, "uuid": "cb691751-18ea-4db1-96f1-d3cc7d4e0f31", "comment": "Malware payload", "value": "ae8040ac03d347fce6dd9c028c2a3a83", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520544, "uuid": "69cd0428-f874-4b96-902e-44dacde05894", "comment": "Malware payload", "value": "f4b8635acc3265ff36ce492cf46d53991f2fdb281268e1964acf8ba4a0f26c24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520544, "uuid": "4460beef-1b8a-4473-8397-aa53d7267c1e", "comment": "Malware payload", "value": "9e4117588695ac04cb585497111232213181d5ac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520544, "uuid": "18afb598-6c56-48a1-ac35-c0261fd0a959", "comment": "Malware payload", "value": "c0632f9d5b28b9f6e28ef2c814f0d0303de949beec06ac903cd50a9285de6e6b97ce2a8452643b38fca15a441bc7cc6c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520544, "uuid": "ff615650-70f1-4d4a-9356-6146987679c5", "value": "T199A3E1AEA55481B6C2C8ED70BB1C4C2FEA135EE7E6A11D92E51B1BDC0432CB26FD4458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520544, "uuid": "de8a27d0-8336-4740-9ee9-fd2e00b95864", "value": "1536:Lr6pdMZo0A3PuaZo0A3PuZv8o2HIbD4TZV/yFaAzodrAZAkqZo0A3PuzZo0A3PuB:f6pW6n6Sd1E91yrKAZAv6e6vcN16Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520544, "uuid": "1443058b-3fca-4fe2-936f-53211a620389", "value": 100140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520544, "uuid": "39665ae2-820f-4bb3-bae0-df6592ca4a88", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520544, "uuid": "2e85939a-4f57-4078-a904-71936df6d4bc", "value": "company profile.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064e92df-ffa5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685531975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531975, "uuid": "065286fe-2a0a-4ac4-821f-532dbec4156c", "comment": "Malware payload (Rhadamanthys)", "value": "20cf3d1f2ead66e1f7ecbccc40637278", "object_relation": "md5", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531975, "uuid": "dd8ec754-dcaa-4828-99d5-2c1c6e51e657", "comment": "Malware payload (Rhadamanthys)", "value": "f4f213fc4f8755dc9d057266a292aa0f2d52da76499dc871235bab1413b04242", "object_relation": "sha256", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531975, "uuid": "919b14aa-87db-46d7-99d8-ee79e9947381", "comment": "Malware payload (Rhadamanthys)", "value": "a9bd3d8511540007f8aa93f5f6c4f581c5f803ae", "object_relation": "sha1", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685531975, "uuid": "78325352-6c51-4940-8b5c-e04547fc36e3", "comment": "Malware payload (Rhadamanthys)", "value": "65b4b1ebb3c00a8ee7903a9aa78635ed718f3a92b8dfbb804b2f9670c0244d6fd9eff6de0fbaf85f732835a1750468c1", "object_relation": "sha3-384", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531975, "uuid": "ac660f14-38a9-44f7-8b26-5701ef4a9f49", "value": "T193B4E11273D05834E6271A728E6AC7F86B2EF9314F556BDB235C1A6F0E711E2CA32341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531975, "uuid": "6f8f49ce-e6e2-41d0-b811-8c0b672f0aab", "value": "4715153511f0bdc6b9dc2ed71a50afc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531975, "uuid": "eea40ee8-7e71-4a9b-8f01-d9febfd72f68", "value": "6144:y6JYK3zEVSGQF02OIfz7ofyuju0N7z8FmyR3i8PEKJqJg6avtdD9iXrZLcnUXufk:yu3zEVS70zIfU9Nn8LbGJgJtl0XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685531975, "uuid": "b76fc183-6d93-4398-8fdd-a904bb40a737", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685531975, "uuid": "585107c8-40e4-4d81-b468-11a91dcf2cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685531975, "uuid": "f3ca6cb7-f05e-4799-af87-b589aae6593f", "value": "05310699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e443b140-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521181, "uuid": "07b728e8-c709-46c4-8e84-f14aa2aa0770", "comment": "Malware payload (Stealc)", "value": "a04ef76aadaaa66bf05923c24fa80ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521181, "uuid": "d7b6d16c-79c0-410c-be07-86cacd0cc72d", "comment": "Malware payload (Stealc)", "value": "f5915d3efdd31d03fdcd84c9ea109232417c4861996a3e6eda16c7156fb59042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521181, "uuid": "05536e45-d245-40b4-adb0-aa178256fde1", "comment": "Malware payload (Stealc)", "value": "0c98d3bdde6531a84d1dc68e8f57b3290ff80b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521181, "uuid": "02869159-3921-4d22-a590-5762ed90208d", "comment": "Malware payload (Stealc)", "value": "803995e8a2914f76ec2ce22d07330e6016758009d074276c4545b2615e894f51af2a012f35ab077d97505e0ed2b5ba9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521181, "uuid": "ceb55ac7-eefb-4ff8-b9c9-3ea09c21e656", "value": "T14244291392E17D54E52B8E729E2E87E87F1EF6504F5937EA121ABA2F04F00B2D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521181, "uuid": "de41d172-1b87-4257-902b-7240e3144574", "value": "9844fba67f0c450c411fe3395f872b3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521181, "uuid": "e62d9a47-13a1-411a-9244-f628d5212e62", "value": "6144:9QE1dSV3pEQWJ016PVH0nVkR0K8x8ROka5:eLVGQWJy6Pi1t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521181, "uuid": "4a178a51-9a39-49d1-80cb-ff83aa7f3047", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521181, "uuid": "6ef17d73-46bd-4086-b651-951adef0eb1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521181, "uuid": "3b2e2932-67b3-44de-81b5-0d0732135f2b", "value": "a04ef76aadaaa66bf05923c24fa80ed6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de646a1f-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521171, "uuid": "9dd1e44f-9543-4105-8574-cd0555330eb2", "comment": "Malware payload (Stealc)", "value": "faa65cb23f8b9fa5e6e0ed41fd136553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521171, "uuid": "7433ac98-7790-4bec-b2ef-1d7da95c712d", "comment": "Malware payload (Stealc)", "value": "f5f1893062f88beb22773850b6e330ac082f319a36098574b402033dd18c4800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521171, "uuid": "b5fbdc0a-6b52-43a3-8eba-5958d3fca221", "comment": "Malware payload (Stealc)", "value": "7efa2cf568e6034e6bf271ea618ba77461eb79bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521171, "uuid": "d0edb93c-cacb-4733-b8e6-b828f7c32695", "comment": "Malware payload (Stealc)", "value": "9979ce69826868f0f896193af464c49887dc7c258c294e53b98753874643faf5ebb4ab7234ba6c54e21dec7d74944083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521171, "uuid": "b3181717-f45b-42b4-a090-85f944d003b3", "value": "T163743A0363E17C60F5264A728E2EC6E8761EF9508F5537E75B58AB2F09712A2C172F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521171, "uuid": "e491022d-9ead-4ba3-844c-018fa228cfe1", "value": "7826118a518ad3bb6f3d483135c427db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521171, "uuid": "3f6c0edc-e4d0-4a56-8548-d9d4e4e33314", "value": "3072:G7RYhTOdNk7dpJpFMj9sYcWP3+9PDMfiiEWk0nmC/6sZsfdS:ARMqNcM5sYcWm9PDMfiLwmIlEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521171, "uuid": "0e6efe50-8ccf-4105-af8d-9f40ad06f9c3", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521171, "uuid": "8c209554-0bcb-47fd-a4fd-043fad466727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521171, "uuid": "7b94343b-dcfa-40d1-8d4c-5ac366633ec8", "value": "faa65cb23f8b9fa5e6e0ed41fd136553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c98ce4-ff8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685521021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521021, "uuid": "a74a4ef5-17f7-43de-bf1f-5a5cb0476b94", "comment": "Malware payload (Stealc)", "value": "c741f771ae97bcc2c2d9d40788c6f255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521021, "uuid": "3793a7cf-1de8-4917-9e0a-57c03956cb2b", "comment": "Malware payload (Stealc)", "value": "f669626004a4679616cc2de2841fe2ce29da7466720871ebd91a0eedf1bc6ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521021, "uuid": "09a71dda-4548-4f23-85e0-d787bd85469d", "comment": "Malware payload (Stealc)", "value": "550cb29f679da5555eb4e4369dadc8bf7eaf136b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685521021, "uuid": "8c46e0f0-f192-4efb-8833-cef42e954c87", "comment": "Malware payload (Stealc)", "value": "8d1b11d718d711bcdb2e5a438bd639ba9c36c59837309ab86add82a381b9d1c2ce7d050e47ce1f4defbff53d2c221112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521021, "uuid": "54dcd4ed-af2c-4425-bf66-3df24a112f5b", "value": "T1CD643A33A2E17C69F5264A318E2EC6F8771EF9614F5977A713189E2F09712A2C172331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521021, "uuid": "9c93a232-0bb4-4767-84ab-082db6267dbd", "value": "d0fa90ab077085f07c566a80dea00339", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521021, "uuid": "cf9a6dfb-c833-43bc-a8fb-16d9ef22b389", "value": "3072:K0HUAkAgm09gFCNtavX/+9z1pYzQ7YagK9nB+Qo044jANV0LSkFfa5m7fpS:DUFM098v/+9z1pYkz9nB+QJUgZT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685521021, "uuid": "b1778277-d59c-4fe9-a3eb-b37ebafddc19", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685521021, "uuid": "900a64cc-ec9d-4361-985e-8b36cfd3b314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685521021, "uuid": "362b7508-14d0-4bc3-94cc-64280e227805", "value": "c741f771ae97bcc2c2d9d40788c6f255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a87a51-ffb0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cutwail)", "timestamp": 1685536804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536804, "uuid": "67781ae4-626b-422e-a9d9-f4b0d8c8de22", "comment": "Malware payload (Cutwail)", "value": "6bb40ed95f770955ea7cf27e4785612e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536804, "uuid": "88337de5-2fa5-411d-9be7-f7321c3cc093", "comment": "Malware payload (Cutwail)", "value": "f8ef3e3b18e72eebb4b18edbc90f7f5851ab0af044473fa2856fc974f0c33d6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536804, "uuid": "530c0a79-35e2-4334-8a0c-676b2d91e6d7", "comment": "Malware payload (Cutwail)", "value": "db93260f6bdeb2321fd73019af3d6182c97fd2c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685536804, "uuid": "fc72e6ec-e6b6-485f-bd94-fe5cd2aa4aea", "comment": "Malware payload (Cutwail)", "value": "17d0936305848b3fd8d4ff0f695ce6ce3ed995a140cc731a97b3e0a447f7bd535d0e95d9bf35cb1c98cc059cf3ad6e3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536804, "uuid": "cc9c9cea-115b-4e86-bd7b-b9dc590c81c8", "value": "T1CBC4BE21FB87F031ED9B143418B5B2FF146DA56103AA80FB72D8CA6D3A105E25A74F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536804, "uuid": "bd3169ce-82aa-4a88-a11f-84de8a19168d", "value": "02ecafa93e16cc93afff7f406beb81aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536804, "uuid": "d7d90455-4000-455a-b8da-bb782a38823e", "value": "12288:NJsZ3dUdAz1aVlOsBfDtNK+UmDFZIdP03d0cMvNc:rsH6FvOYtNK+HrId03dEvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685536804, "uuid": "70bed9b9-039d-4d7e-a1f7-200d95502ca7", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685536804, "uuid": "971653d5-8d72-45d2-976a-02a1a285bdbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685536804, "uuid": "391af7f7-ebf0-47c4-9ba5-8800faa29eab", "value": "6bb40ed95f770955ea7cf27e4785612e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8c49ab-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685520581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520581, "uuid": "5597830d-2e36-45b6-8d61-ff9eeea797c4", "comment": "Malware payload (AgentTesla)", "value": "e6bf7a870878621d4fbffb76b1ab6309", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520581, "uuid": "78d14cb0-0d06-431e-9ae4-d3d175c9b2e1", "comment": "Malware payload (AgentTesla)", "value": "f94d390deeb6e7c8738fc693de22e0a49e4d57681759dde58102ebeea443463c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520581, "uuid": "91274c5d-5e2c-4ca9-ac20-1fa8ddcc494c", "comment": "Malware payload (AgentTesla)", "value": "b7bacc4aa146075314de6474c8f3180eec0fb188", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520581, "uuid": "7c554e38-699f-4157-81cb-a8ef0a767ef7", "comment": "Malware payload (AgentTesla)", "value": "fcc39ffdd19411dd78e376dfc5637fba97f3267b981541bccbb1816a78552d13b78f4c15ed4e6df56d9f5ccccfefca40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520581, "uuid": "d2ec01a7-982b-4244-b0cf-43679046128c", "value": "T1FBF41285EE7F0B0BD966BDFC1730457096FEDC45A42AD29FE99A782FC93A5302C91012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520581, "uuid": "24bb97d7-6be5-491a-8dc7-bf5495d2c074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520581, "uuid": "1aad6809-1c1a-47c7-8d81-378d80c0e97c", "value": "12288:ncAMTihh6xhZ6OrcSyeQ8oshcrkCoKCz7APUtBaHycdAq+VkmqtZVhb:PMUgh8y5y7shcoC/Cz7APUaScdArVktN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520581, "uuid": "c56e2fcb-fb03-452a-a37f-303f9c15caac", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520581, "uuid": "222da505-4c0e-4901-a617-eb23881c834e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520581, "uuid": "b726c3a0-34ee-4a5d-ba1b-f8e6fe57bbe8", "value": "Halkbank_Ekstre_20223105_075616_005737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b86c101-ff8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1685520629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520629, "uuid": "d5643bf4-2048-41b5-b14a-19ead81c8686", "comment": "Malware payload (STRRAT)", "value": "0bfb03264f7d440e3fc6dbfa6c833d98", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520629, "uuid": "4848f2fa-1187-4303-8473-34e2dc2d81d7", "comment": "Malware payload (STRRAT)", "value": "f97f4ae9329f8fb8bce8650d554fc886e55a3e5aed4d501f0cdb1efcbdb9464d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520629, "uuid": "ea1263ad-5de3-4720-8dbc-4fad685d42dc", "comment": "Malware payload (STRRAT)", "value": "1d7e3328302711ff5dbab798379226a076fcba76", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685520629, "uuid": "6ddeb645-50f9-4941-8cc7-055fd92750a3", "comment": "Malware payload (STRRAT)", "value": "00ef759ec7ac56d010bbc117e9cb85a66a52901db90bd75d812c56ee2b43b6cdff59b6c939eb5e5b363d8085ee303509", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520629, "uuid": "5cb66437-a253-459f-afbd-8de655743dd0", "value": "T15063E1152F36A97CE1A789341089DD8A5C0CC06C793DCA47B7F55EE534369802BABF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520629, "uuid": "cefceb3e-3fa8-4ea0-be7b-f86961e6715c", "value": "1536:KqhVLuHHXSzVnavnbTRmAQTbgY7qfmiaHVneNaOg8z:KM8H3iVavnfVOiaHVHO/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685520629, "uuid": "914ffeaa-763e-4123-a828-fdd666d94f09", "value": 72322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685520629, "uuid": "226002e6-ebb8-4f33-82ac-3c49e663a0bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685520629, "uuid": "054cc8c8-20c9-45de-b43b-4b1b5c64afce", "value": "SHIPPING NOTICE076894756.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599b8aeb-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685519660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519660, "uuid": "3e17cb70-0aa6-4f98-8e35-48c30c268150", "comment": "Malware payload (SnakeKeylogger)", "value": "24ded4b6a9ab8c43d08d889adf17f48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519660, "uuid": "2bd1d170-bcc7-4b76-81d0-e23158548755", "comment": "Malware payload (SnakeKeylogger)", "value": "f9de572b6969fcde747af49c9b07b6851182eb62e53deeb7d792a4df485bf1c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519660, "uuid": "abf05ac1-a845-4828-bf65-d43876843419", "comment": "Malware payload (SnakeKeylogger)", "value": "bb67a33c7ff663edd7ad78afc9085a9af70a1357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519660, "uuid": "95092fa2-7e9d-4db3-a7ab-8829e96b5b92", "comment": "Malware payload (SnakeKeylogger)", "value": "1a91e42d4d8245f34f3b21d7daec51bc2e43b198cefd27ce76306ae9920b9d53a5e6c6e8f76b01f4e5bc524b4d14e3ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519660, "uuid": "92925228-e444-4867-8373-12583b4bcf5a", "value": "T144E41256EE7F4B0BC8A6BE7D8B304474A9EDD644902DD2EEEA87183FC814D356DD0062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519660, "uuid": "e2078dc3-70fc-40fc-a5aa-1ff5eb680084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519660, "uuid": "9627baf8-3198-429f-896f-175a1113422e", "value": "12288:VmAMTihh6xhZ6OrMpKkBJlAfoZYJsSWKL9Zt9jpgeC9mBkr1Er0d5:fMUgh8yMpK2AQYJsY939jpYoy1Er0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519660, "uuid": "7c710c5f-b725-49a1-b915-116362db99bf", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519660, "uuid": "69f293c8-eade-4dbd-9e11-608265ead6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519660, "uuid": "f544ca32-564f-435d-a878-2a1407f8dc88", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2faf8a-ffa8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1685533383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533383, "uuid": "e0c2c340-251d-4806-8a16-8a7e5d04adef", "comment": "Malware payload (SnakeKeylogger)", "value": "d227ba33f2a06c233131722e62dee974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533383, "uuid": "c1a1fbb1-ec9e-4e60-9330-691cff1d2b7e", "comment": "Malware payload (SnakeKeylogger)", "value": "fad5e5168ba1adf95d4199bb08cd8fc6f0dd4fdbeafd5af78d032fd23d7a93e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533383, "uuid": "1164ec1f-b96a-466b-b140-2cefd97909dd", "comment": "Malware payload (SnakeKeylogger)", "value": "d58cce2522b6b7ec2abceefc86de70a069d1e0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685533383, "uuid": "03e8f01a-1d95-42a9-9299-ffff7244b9fa", "comment": "Malware payload (SnakeKeylogger)", "value": "ee87a995376aa83feded82349c46899f39fd6973c0c9a2e6f01b3731a4b3902d84ea358d259cbe817bbff7697b6d3d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533383, "uuid": "5fe748c5-0c55-4b1e-b94e-2b9d6c7cec2e", "value": "T116820A82F3A47A22EEED06764722CF64977DBE0B9C57930E1D8535893CB33518AA1187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533383, "uuid": "f423f67e-f0c9-4b92-b6d9-98fa75d48fb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533383, "uuid": "388fe107-596a-4676-b178-675fc24856ef", "value": "192:69pYf+ClV58L73rB3zpom7f1R8kEdcEWtuLqo/bv6eY4iAbbVJ9W6a:rfnB8L7ZP387Z/bvy4HXn9W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685533383, "uuid": "fa78ba5d-7849-4c82-a9e5-791a132dfa55", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685533383, "uuid": "307c5c72-5af5-400e-b55b-a9cb42140851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685533383, "uuid": "8935f8ce-3e84-47da-be7d-c26f2a6c8ccf", "value": "Oxtaogcjm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf483fe7-0002-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685572229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685572229, "uuid": "325d38a4-2831-457a-a02b-3e3eae301f1e", "comment": "Malware payload (njrat)", "value": "c50d79f473f7d91949605c0f78f1aa00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685572229, "uuid": "dabe53f5-3fc3-42f8-b102-3853f9bcfb62", "comment": "Malware payload (njrat)", "value": "fbdd2e5779904ac37f1a5322c29bc20cae75832553a0f519ed5f23a15e7f86ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685572229, "uuid": "8d835081-3a69-4918-bc54-98ce2296d942", "comment": "Malware payload (njrat)", "value": "41ee6062ccdd264360a001c0b38ce332890bd87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685572229, "uuid": "acb20a4b-e3ed-45ce-9b70-e791d33a00f3", "comment": "Malware payload (njrat)", "value": "f7d2f22fbdbd5800904efad04ceb1f148c42bccc98235d257ba37c4d3f1ef3ad048a4a25d7d9b140fdc58f49c08c17e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685572229, "uuid": "8b85d1a4-4148-4199-969f-994e618d3d09", "value": "T12FC429D20C664286DCF64F344039361C2B74AA43ECD480AE75D9719FCBF999389E5BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685572229, "uuid": "e09252ad-afe4-41ef-a871-92397c10cf4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685572229, "uuid": "d50be2aa-2ee9-4179-b36f-d23e088c6284", "value": "6144:bv/fXljrXDKn8GITwsgAx/veIE0/Fy0loyvWvI32JMsTvq/OM+rHd3i/sk4faork:bvNDNGIEiAgnIImJMsTvI+Nim9yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685572229, "uuid": "68c901c9-a019-4722-aef2-426b7ea44452", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685572229, "uuid": "c2771748-86b0-4174-9b54-40aaca36792b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685572229, "uuid": "3d91b608-edae-4e03-ac68-67ff79c6b440", "value": "QHwolBz81ZLGWBJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60369df-ffe9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685561530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685561530, "uuid": "480a8ed6-c558-4365-a716-fcf970bae614", "comment": "Malware payload (Loki)", "value": "25e6194267679b5c08bd91603b51898f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685561530, "uuid": "bcfc1891-4036-4931-9336-def522d13b98", "comment": "Malware payload (Loki)", "value": "fd5030b33e9f626dceea517a8ff935dcd2f9d9d8d6ff9ded6f998ecee7de7e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685561530, "uuid": "ce76f8e9-5af1-44a9-8026-43824eb956fe", "comment": "Malware payload (Loki)", "value": "d76cd14e35a0fb37382d872a473482a895c33b85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685561530, "uuid": "ca5e57c6-8857-4b65-ae63-39209d7c2ee6", "comment": "Malware payload (Loki)", "value": "30f9ebd34f948610c3558d69015e7d501ada96358d0b31e846f6de944f7bba8601ae3228156fa7d1b200552eceb018aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685561530, "uuid": "0e4e1d82-1b97-4390-baa7-a33a544c92f5", "value": "T194E4E069ABBE062DDDBF77BCA570103457FCC6055816C36C4B0238BFD82AF709A511AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685561530, "uuid": "76100c92-ff43-44dc-8643-90cd1ecbb0b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685561530, "uuid": "f51f4861-4040-472f-9f18-09e8c1d5d4e0", "value": "12288:HfqAMTihh6xhZ6OrvxIpdCdkrP8F+nyxu8dPPtudcOFNv9:tMUgh8yvxIpd8mPXqu8dHtu6EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685561530, "uuid": "c92688eb-79fc-44b1-9717-ba73a8aee7ef", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685561530, "uuid": "c9d53ba5-bc6f-4ede-9424-421427b24ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685561530, "uuid": "9452fac9-d87e-4e76-824a-366821d4e0f3", "value": "kellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adf8e77-ff88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685519769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519769, "uuid": "7f0eaaab-8326-4217-9407-9f0f16481f04", "comment": "Malware payload (GCleaner)", "value": "449bd69cfcf8c2756ffa0b836acda264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519769, "uuid": "7a90419f-3b5d-4bbf-a82c-2f721148591e", "comment": "Malware payload (GCleaner)", "value": "ff83807006950b99eddcf7b5924e3eb4704c116cf19984585590fd92aa62309b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519769, "uuid": "b5bc1035-fe92-4f2c-bd53-a3d4acfc5725", "comment": "Malware payload (GCleaner)", "value": "891c7c94f9462b18e5a2b6881983585e6b41e8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685519769, "uuid": "9087edff-9103-4a30-bbc6-ca8595e7c3a0", "comment": "Malware payload (GCleaner)", "value": "ac0b56cb8b48f2acc2e93e51ad7dcde60acc922ee6bef17aea7e9c0b5198bbf5f02b24cd386c3bbaeeb95db69782a7d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519769, "uuid": "3949eb1b-a32b-449d-ab38-b55f0fe8c55b", "value": "T10485CF3FF268A13EC46A1B3245B39310997BBA61B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519769, "uuid": "e39b8139-55a6-45c5-93a1-da494e4ca098", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519769, "uuid": "bb7407fb-d7b0-4cea-9b55-f818b9650dd6", "value": "24576:s7FUDowAyrTVE3U5F/3GqKWpKic6QL3E2vVsjECUAQT45deRV9RH:sBuZrEUiwKIy029s4C1eH9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685519769, "uuid": "8e7cc380-374d-49d7-8a79-8e01d646a562", "value": 1766679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685519769, "uuid": "c9db6574-3cac-43f4-88e5-e8064369230e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685519769, "uuid": "a6ec16b6-c056-4fc9-ad6a-091cc39f5b4c", "value": "449bd69cfcf8c2756ffa0b836acda264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }