{ "Event": { "published": true, "date": "2024-01-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-11", "timestamp": 1705017782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "aafee48f-c59c-4064-a827-5029daea74b0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83617fd9-b044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loda)", "timestamp": 1704951880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951880, "uuid": "c2ebcc96-396c-4699-8162-e2d04bff2cc7", "comment": "Malware payload (Loda)", "value": "838d874bf630974e28861a3d5085e09b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951880, "uuid": "a656e12d-81bd-4c0d-9b9b-1118bb4fc297", "comment": "Malware payload (Loda)", "value": "007d4a581f70c7d0a86307123df5d769c3d948dd9b7d5c4ec3b274f2b0bf3647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951880, "uuid": "4da5baef-1696-473f-b8c5-9f374edec788", "comment": "Malware payload (Loda)", "value": "e7aa41f2b685f4108d484e6b0d29c344293ea763", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951880, "uuid": "840d9e37-8939-4008-b26e-8719a52e8fa8", "comment": "Malware payload (Loda)", "value": "39a3b97c549885b003d34798d627f33c5f8b1b4b2b4a83210345b602be55fcb2b371d30730a71649002e43ac021e13e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951880, "uuid": "d2318dc4-eb20-488d-b54c-f6422aaefe0d", "value": "T13755D01373EE83A5C3725173BA55BB01AEBB7C2506B4F49B2FD8093DE920161921E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951880, "uuid": "77b0e8fe-7faa-45b5-9a0a-318e9cbdfbef", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951880, "uuid": "78c8a553-4c9e-4bf2-9f71-f018f8d358ae", "value": "24576:e4lavt0LkLL9IMixoEgeaQway4e3nMrJclk1MvuduAHEq9MmCS:Jkwkn9IMHeage3nM9zMvudWaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704951880, "uuid": "5d697ffb-824e-412e-ad1a-ac4b48ff788c", "value": 1313280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704951880, "uuid": "54837b94-d36d-43f8-8d5f-0bb71e48c98d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951880, "uuid": "ae1cd438-71d2-42af-b3db-749bcf0935f2", "value": "838d874bf630974e28861a3d5085e09b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8c46ca-b067-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704966899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966899, "uuid": "fdc575c9-fa60-487a-a12a-a8d676376386", "comment": "Malware payload", "value": "bbc02715bb477d3c4abc3902991a3ca0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966899, "uuid": "fde84f4c-2ac8-4c7f-a8bf-91df18ab17ee", "comment": "Malware payload", "value": "00be083ae02b1ec2da1849be10b787f4ae8aab21a11a435510bd807e9e3a8d51", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966899, "uuid": "6cbeff1d-9a4e-4c93-a42d-862e597efbe8", "comment": "Malware payload", "value": "e1e012aa6d5a027d75ba8e7c3668dd69a9e83f9d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966899, "uuid": "38000678-1bd9-4faf-a152-8eb6c1824719", "comment": "Malware payload", "value": "470ef2dce90ca85c8b3f5d2acc19451c3fe808d7c07d43115379228d3ef38b97614785c1ef2fd27c844a850f9114719f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966899, "uuid": "d82676c3-499b-44d4-94bf-c8e02570da7b", "value": "T1DC412BA8E2B7C138DC5F0BB808F56B37753528006E617E49E7148D08598DBA31EC57AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966899, "uuid": "f72343e5-e75d-4864-92c4-28b5a3f049f1", "value": "48:9IPITEywSNeU1dj7QEz2vz8xcf1EgokBN2yF+z/:mklEE6zFfyghNxO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704966899, "uuid": "b70d6c03-9b0b-49bb-850b-45ec58c0ee08", "value": 2268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704966899, "uuid": "6d4c22af-5817-41ec-b607-e871506ae40b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966899, "uuid": "260151e1-2389-49ae-8d3d-dccf36a16c22", "value": "BusinessEmail.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcde0c5-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1704978550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978550, "uuid": "68511ec5-ff2c-44b0-9b96-7cf430cec842", "comment": "Malware payload (DarkCloud)", "value": "c4010099f019c02e76552ec127969131", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978550, "uuid": "66a92d12-aa29-4616-a2e9-0a3e5945256b", "comment": "Malware payload (DarkCloud)", "value": "00c4073d3cece00275c1e1be5147340362b989177852b7980ba31f0c07ae836d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978550, "uuid": "8e33dcdf-a55d-4bd2-b77e-8be7786da674", "comment": "Malware payload (DarkCloud)", "value": "468743bcdefd1d1c07af3a1414b952339280952d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978550, "uuid": "1bf8076d-66b6-49d9-b2b2-451581df8100", "comment": "Malware payload (DarkCloud)", "value": "e5225576ffbe7bebc26e4b1c82d26ec34d573022d577da5efe62f7d5abcb8f5c6ec0b81f0fad6b2bd304e372eb202cc5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978550, "uuid": "bfd54fe9-cd93-4c57-9fc0-a78e51310791", "value": "T18C943A16E651202FF053C8B1EAD5A26BA8296D3A2588EC17F7819F0875315D7E8F133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978550, "uuid": "60137312-c494-4156-9dc4-56c8b181b39f", "value": "966d9996c62d870333d6853769a84f18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978550, "uuid": "e6f3dffa-8c5f-45e8-9d0b-c7eb62908e74", "value": "12288:ndVkMuJ5ACU8299NlK7Fzpy/p2/TI8UjYKkJj6GmZU:duJS+Fzpkp2/08qYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978550, "uuid": "1e5d300b-9f78-41c5-96c5-ee434e139e64", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978550, "uuid": "dae75039-b855-4041-9e19-27037e2b7699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978550, "uuid": "33f4dfa6-6b21-4cea-8ba7-da09687b9b71", "value": "00c4073d3cece00275c1e1be5147340362b989177852b7980ba31f0c07ae836d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7878cf17-b06a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704968182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968182, "uuid": "a890736a-749a-4e08-b7f9-7cd52936cbda", "comment": "Malware payload", "value": "c7d78e5acdd7dbd2d1fdb8a1eb861c79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968182, "uuid": "e31b8c40-9232-4339-85b2-9f69a33537f1", "comment": "Malware payload", "value": "01e57bfd68aaf8de3af7e865c815a2e88b01174a7ae2856928ff1e10391bed9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968182, "uuid": "05ab3e36-cf47-4769-8485-31bc30945aee", "comment": "Malware payload", "value": "f5e07ef7d89441d84c42d077f4c947fbe1ad5711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968182, "uuid": "0a8e90b4-1733-4f38-beee-6890fa26337a", "comment": "Malware payload", "value": "2e59066cfc30d36e7514f18e357f9356c2aae69436c01975a87ab739c0374393e358a0b2d0d38aa317553105354e3568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968182, "uuid": "07840e9c-dde0-4f2c-9d25-a29363ccf00f", "value": "T186B523227AC18832E26325360C2987A1593CBE711F528ACF67E47E6DEF346C0E935757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968182, "uuid": "ccd55085-45f4-484b-a0cc-615c9d5fefd6", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968182, "uuid": "b6bfd1c4-a5d6-42e2-a45a-b8269e8c4a49", "value": "49152:1monDIpyDP5Sptn5cUXo4iLLKOqiqXbbO7q0Lzy:1moMpyDRSptn5cUrm2jiqXbeTLzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968182, "uuid": "d14ac2c5-aaa6-4518-a0c9-99a71d3c2a9b", "value": 2451829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968182, "uuid": "44f9729b-25fd-4678-8520-353b595263e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968182, "uuid": "8d51b4b8-a956-4ffb-a763-41529767c598", "value": "SecuriteInfo.com.Win32.InjectorX-gen.3077.31116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb98bad8-b080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1704977771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977771, "uuid": "940a67e2-7137-4f9e-9ef3-2dda7e440250", "comment": "Malware payload (SnakeKeylogger)", "value": "f39e3eee01d43a61e564ab6b6f9b89e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977771, "uuid": "fab5645e-2bcc-493c-8c9f-6ee5b6b52a12", "comment": "Malware payload (SnakeKeylogger)", "value": "029fbcceb82323987309e3f0f2f3a6626b8dc2894c868f96bcb8105405018b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977771, "uuid": "8d024f3b-b13a-4375-b5c5-21b835cc10a5", "comment": "Malware payload (SnakeKeylogger)", "value": "3e8751bd602971fe55cfcb549bd08d4c2d063bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977771, "uuid": "5fc3897f-749a-4810-b064-1048480885ec", "comment": "Malware payload (SnakeKeylogger)", "value": "5cc7842dcf233ea0e92a39c8cd120876eda754e24d137cac1ead677e04b142a6de90191c617ab9a603b5d176d0fe1464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977771, "uuid": "542b0ff3-f643-4081-b645-83245f9437fe", "value": "T13ED3F6583BE48818E2FE997702715110C779F8434A2BDE1D1AD1E85E2E3DBD18E1AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977771, "uuid": "f9f9cede-8960-4591-ac5d-c063f1f0a732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977771, "uuid": "58b16afd-448d-4c13-ba82-44a9cec3efc8", "value": "3072:UMorDWr82YOI1wEfeUCBFv7Vm1Tx28ugK+dbS3FDZsQ9wvxTumVgbY:42YOcwEfzRw8ugKqbCXm2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977771, "uuid": "ad19bd05-e61f-4b60-a71e-8ef10e178cb3", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977771, "uuid": "9e847b71-d4f8-4fe5-a33e-1599247b9edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977771, "uuid": "4dc2bc14-7805-474b-ac5f-4a1ffd205642", "value": "029fbcceb82323987309e3f0f2f3a6626b8dc2894c868f96bcb8105405018b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5d2044-b046-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BazaLoader)", "timestamp": 1704952537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952537, "uuid": "a67aa3f3-afdc-48c7-a470-3c4629084df0", "comment": "Malware payload (BazaLoader)", "value": "44b2aa7a54dd604d4bedc5434a03a846", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952537, "uuid": "efa755f2-385a-4f52-a5d4-8f54f9ff05a0", "comment": "Malware payload (BazaLoader)", "value": "043aa637e4f804322c03ccdccb3f5030c3009b3f3f3da2a6506163007e123674", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952537, "uuid": "2d301be5-6e49-491b-9e91-3c9abd11568c", "comment": "Malware payload (BazaLoader)", "value": "48a80b045427c3d4e5050d945529bf1f40f2dcf2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952537, "uuid": "6679b9ff-5e1e-4bff-b589-a353ad9f93fa", "comment": "Malware payload (BazaLoader)", "value": "ca22da1c9d3c5cae0fcbce4dca1d86aeb8f8db127b794ece2f8ca5b16c0c12978b57a62b1dbc6230322a006a343f07a6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952537, "uuid": "0c90b411-7909-4585-bb9b-a9873b406011", "value": "T188A69E5E9E86D16B86DA7FB039E03C25CAD3464694B91EC97E0C46F38271BB01D63BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952537, "uuid": "536c38d4-7487-4384-b874-54ede8076f3f", "value": "7d1e46538212ac3a885211bc83f92d58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952537, "uuid": "901a9f1f-ceb1-4062-aa60-90eabcc50163", "value": "98304:O5MI6QJ9pnF2MGBLkKOgRTFKRg5WGbrXCQ82ewTXqt5qSbFqSr+7U3WsfG3:6MItfpFIQgRFf5lfXtewT6fISS7vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704952537, "uuid": "09f97daa-3d94-4903-918a-f7174a8892eb", "value": 9828352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704952537, "uuid": "71879646-874d-450b-b39d-c18ad4a58663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952537, "uuid": "f25f13c6-458a-4327-938d-1989c1605bc7", "value": "44b2aa7a54dd604d4bedc5434a03a846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3f0f94-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704939087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939087, "uuid": "0fe26305-29c4-40ce-b960-d874c1be8bb6", "comment": "Malware payload", "value": "4c25cc29b185b6b5d47409b8a84685cb", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939087, "uuid": "278e52ae-a971-44cc-b690-a31e55ba3636", "comment": "Malware payload", "value": "0581cb2189352aa512ece3d67863a16d13e1c5fbf3f374cbb9330a911546329f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939087, "uuid": "644f56ed-549c-4064-96c3-e6b75aa551d3", "comment": "Malware payload", "value": "b367f776a243f52645968e43f3a284b98c0b95d0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939087, "uuid": "352fa1d6-143a-4259-84f9-09bd49443fd5", "comment": "Malware payload", "value": "65100d6718734c91f052c5a9c0afdf5174f005aafd378a7e9ee7b167fbbab7c7bd07ba7ad4d3ae5472d57949f7beb896", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939087, "uuid": "abb3b869-57cd-4ef9-ad54-103978689e37", "value": "T13F112A9653791EBBC4A353B5CC757E0C85B69C724E4EE0AEDC633880C8290E21FD1689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939087, "uuid": "a6d8e064-e98a-4049-bed1-cefd7213b37f", "value": "24:8rBJlW+Arw1JtaAilmuLR440uZITf5saAzuUn:8VJxAMJt6lv87Tf5saAz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939087, "uuid": "7e209239-e290-43bd-9f72-0608621e1271", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939087, "uuid": "874205f0-6e6e-4a70-aacc-bd065ad4b236", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939087, "uuid": "19a72d37-33f4-491d-8ded-1afc1274a235", "value": "S_NFe8959263.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1177e8-b024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1704938335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938335, "uuid": "63f44a54-f8f4-48b7-9ef1-c4da95d71d14", "comment": "Malware payload (Rhadamanthys)", "value": "2a78ab88f7a0976ab21af90016f10319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938335, "uuid": "1cad7cb6-c676-47d7-92e9-fd7e9088f894", "comment": "Malware payload (Rhadamanthys)", "value": "058dc25297c1b2b8bc2c9d21acef07934f70fc8ae0fa5830c65a7b61eeb4346a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938335, "uuid": "65d59715-3718-4258-b341-6c9b02adaf84", "comment": "Malware payload (Rhadamanthys)", "value": "d136a178be794b8d5c25e31dc72b4a1f2c0192bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938335, "uuid": "1ed20160-5856-482f-b38d-9b2ca139243f", "comment": "Malware payload (Rhadamanthys)", "value": "1cd6878f8873ee64720da7e1b0a385670db15e97283ee831caf243753550032498d6f0d812fe0648734fa0debc1d2bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938335, "uuid": "4da79d58-775b-4672-9a54-fe7ed2770fb2", "value": "T117665AC7FDA041E5C0AAE33189669192BA717C484F2123D72B50FF782E76BE0AE75354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938335, "uuid": "f5357ffd-4380-4932-9515-7093b0ef44c8", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938335, "uuid": "a9723e56-aff7-4ba7-a977-ec48b338071a", "value": "49152:qMYAUaj4i3BJHxOB7B8nsnoAOJG1WCL/FZ+orEFncvW0jG5EqC3cx06I0mWcxsQG:q6B3q7usUJGc0CKgEqVilKZPsFsPG6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938335, "uuid": "66e45586-de41-4851-9d6b-562d20b4929d", "value": 6965760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938335, "uuid": "f3c94b73-e1a4-42de-bbfd-4066363c7c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938335, "uuid": "640e0f66-f05d-40d9-b093-171c1cabc25e", "value": "2a78ab88f7a0976ab21af90016f10319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90268c7-b02f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704942950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942950, "uuid": "186c00d9-831e-4ee2-a5d7-300df5d51eb3", "comment": "Malware payload (Mirai)", "value": "90bd9a7be082dcc0795c436fa4a5ed98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942950, "uuid": "16963b07-eafb-43c1-9bf2-087a2fcf804c", "comment": "Malware payload (Mirai)", "value": "0597e7607f5c06e8387a3e131e6b21ee6551b1809aac748c7bf4053113cc5a1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942950, "uuid": "1347fbfb-6a10-4403-af6e-87cd04dc95da", "comment": "Malware payload (Mirai)", "value": "d2ad703add065b73ce60817825b0f0145a85e013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942950, "uuid": "1aa95c50-2ee5-4abd-9990-1d28d6861ed4", "comment": "Malware payload (Mirai)", "value": "5304a0558835c027b3f5e3a70e03e373c93566fb03798f65b3f863248c2ae3e3117eb94bedfa41603ec247bb2cdde924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942950, "uuid": "5cbc351a-f4d5-4857-bf76-a1ebedcb1eb0", "value": "T18B630852B8818E15C5D813BBFA2E018D33126778E3DFB2169D106F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942950, "uuid": "96904909-b390-49ec-8065-b7a4bd5d00f1", "value": "1536:StnwsWjjS5+8hEWZc+mQM4fJL4OQwzRqO1No3YpPz9I5iY5UJ/k:MWjA+QEWZbbZx4ObcOno3H5UJ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704942950, "uuid": "b561e2b9-e343-4ded-92e7-cf85024080fd", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704942950, "uuid": "699c43dd-726f-499a-a771-f264d2f9b7b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942950, "uuid": "7f3047bf-b1ea-4b74-b6ed-dc6ef46ebaae", "value": "90bd9a7be082dcc0795c436fa4a5ed98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdd64a7-b033-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704944411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704944411, "uuid": "5e20bbf4-e20d-4e8c-a2bf-48eb483a5495", "comment": "Malware payload (Socks5Systemz)", "value": "b9720bd1fd000b0df3fedae8c1063603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704944411, "uuid": "df38ba0d-c508-48df-8354-58745aadd431", "comment": "Malware payload (Socks5Systemz)", "value": "0625a9efaf502b585558b4d5e8942ca543814e60bd53603c98a76e01a9e4f488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704944411, "uuid": "ed51d399-b579-45bc-90ab-dff96ebf56dd", "comment": "Malware payload (Socks5Systemz)", "value": "1692f2cc0e41ca7ba7e1d14fe6afd8d47010980b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704944411, "uuid": "2ab87868-bb56-4871-a19c-4c2972bd84aa", "comment": "Malware payload (Socks5Systemz)", "value": "e8f1ee709a72f3521e04a04a4bcdfb84bfa962f662062f377dcdc20653779a574fb3ab09158eab1c9c243dd27e91025e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704944411, "uuid": "93db000b-33a4-478e-bdc9-dfe24258fe67", "value": "T1B626336789D2CCB7D2B1E0797807D107B9EB366523782FC914AB586BDFCB452B484B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704944411, "uuid": "868751dc-8aa7-4bad-ba2d-b41ba1c2b9cf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704944411, "uuid": "fea55aca-6e05-4cd8-8b16-a9f7246966d5", "value": "98304:QxWTcbYVthisyTKALh4jzjhpYdhefA/if3hrf0XaLpB3gSDRdfebATwNtd4dm8:nAithi0m4XfYdcr3hrfYaxdddwV4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704944411, "uuid": "4ccbd0df-8ea9-4a7e-8d09-f348bf0f6fbb", "value": 4698175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704944411, "uuid": "69a52622-671e-4eec-9b62-3f5f4bd41bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704944411, "uuid": "20a5b5ff-4620-448b-bb6d-4ee94eba1c1a", "value": "b9720bd1fd000b0df3fedae8c1063603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8fdd21-b085-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1704979784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979784, "uuid": "aa336811-d4f6-46eb-9f81-09cc76492e88", "comment": "Malware payload (DarkCloud)", "value": "84b9984a1b977cba1e528f397ee9c9d0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979784, "uuid": "358680a8-8d23-4969-b61f-af567ccaee0d", "comment": "Malware payload (DarkCloud)", "value": "06e41eef7cd522feb5cd03df1821589f5ed697177c3e9c317cb844a50edbe17d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979784, "uuid": "7b70023d-8831-4dff-9ce8-7cfd61271321", "comment": "Malware payload (DarkCloud)", "value": "cc043d4a757f76d8af3279e6f6ccbb23490937ab", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979784, "uuid": "5871cf3f-4cf6-4b9e-9957-01c86b5d62fa", "comment": "Malware payload (DarkCloud)", "value": "0f97dbcbb01a661f91f0e9bceab33680aec49cd002ee22f0968c8a6f3e48011805d88ab5da2ca9c60ab9edf2e81220a4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979784, "uuid": "05e26aa7-0eb6-4d9b-a461-036f8f3d5873", "value": "T148942A1AE651602FF053C9B1E6D4926BA8296D3B2688AC57F7818F0975311D7F8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979784, "uuid": "51ba3a56-74c6-47e4-8b9f-e2e23a5ad0ee", "value": "966d9996c62d870333d6853769a84f18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979784, "uuid": "fbe6fce2-a6bb-4426-80d6-92065b31a6e0", "value": "12288:/snMLC3c0Hs5VCRtgNu3yElSG4KmjYKkJj6GmZU:/5Lo6Nu3JlSGlIYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704979784, "uuid": "210264da-216b-4d1b-b6e6-058e99bc355f", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704979784, "uuid": "acf4e15b-f735-49bd-9a45-859fdc8484e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979784, "uuid": "82cfc2c8-6bfb-40ea-91ad-d15894ca2905", "value": "06e41eef7cd522feb5cd03df1821589f5ed697177c3e9c317cb844a50edbe17d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34eafa8-b077-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704973891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973891, "uuid": "a85d9b86-1eaf-4ff8-9b3b-006da94224e0", "comment": "Malware payload (RiseProStealer)", "value": "2f4dbdd2ed2c56e633f8eb47687a431e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973891, "uuid": "80c3a9c3-0570-4858-9968-87eac164eb2e", "comment": "Malware payload (RiseProStealer)", "value": "0b5a6b652547d225e983046733875ca231e167766c9944e5c35a50ffdcc5a2a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973891, "uuid": "8e5e5b38-3dc7-42ce-969a-b2d112a524d1", "comment": "Malware payload (RiseProStealer)", "value": "ac0bd16a68f34f8c2ece7917c5e958199c6b7076", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973891, "uuid": "1dda0345-391d-4c4e-81e7-9bed21c87756", "comment": "Malware payload (RiseProStealer)", "value": "0283beaf7ed7963a21bfe21b9f358f60f5d4c914113a54b59f2d5ab1450c6e8ea1f86a11643dcb04e4dcaedd429ed0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973891, "uuid": "69a78315-f43f-47c8-b9bf-e6e2e1aa00d3", "value": "T1AEE523462EC129ADD8DA95348E33BD1D32B12F740D50CB3CB8686B9BDEF6E64443524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973891, "uuid": "1b3e79d3-55c2-4aed-bf19-22b22d419c9b", "value": "8c64ee2e7a0f1643c7af909f5af41768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973891, "uuid": "458c3e14-fe92-4a75-8e02-774ef1062494", "value": "49152:NAPZ/ttZvtIeeqwK8yiQItSfcLuSjSfslOQwkNcP1ArlKHcMV1yuI20CMgKNVIZk:NAPZ1tNtIeeqb8yk22jKQwk2dArxMj0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704973891, "uuid": "30e9557d-cc0d-4a17-a913-93a366f365c0", "value": 3113984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704973891, "uuid": "1b479f1e-bb45-4444-92bf-22e4299d158c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973891, "uuid": "de4b93fc-641c-463b-a087-21bf8bbe52e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3c8997-b02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704942523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942523, "uuid": "466d221b-78b5-463b-9154-3a1b1312efb8", "comment": "Malware payload", "value": "f0aa3d8d0369ce79b061e3a8497b0d42", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942523, "uuid": "ffd18ad0-e259-4327-b95a-686f8ec16f37", "comment": "Malware payload", "value": "0b709c39682a018b6bd85b2904e6eea608119251c72a3d9ec542d0a9acb73b58", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942523, "uuid": "6cb565e5-3642-4a94-ac27-8f2b036569bf", "comment": "Malware payload", "value": "4cc1b7477db036dcea473fa894cff89787fb044d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942523, "uuid": "ad42dddf-e985-4151-8a4b-5a260a8320c7", "comment": "Malware payload", "value": "a645ecc5ab7e3232c10bf3770d9acd99b34e6af3a2aa23bc2be16ed0a61624c9afb0910cb0b640548ae4ec6d4c3ae911", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942523, "uuid": "987247d9-b313-4064-a283-60cafbaf411d", "value": "T10E966B44ABE84F66D4AE4B7295F1439267F2EC296B27D72F350CA1763C523804E423B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942523, "uuid": "2c2cb261-883a-48d5-83e1-46a04fdc9223", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942523, "uuid": "a1342d41-a482-45ea-aa52-1e93d7c93037", "value": "98304:lwSFPJppakuZeGjVRKY7cMpBURkNdeKkfycWRJVG:6S3pOeGj/KJMXURk/kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704942523, "uuid": "29584629-037c-45d9-882d-9b6fe6f88822", "value": 9173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704942523, "uuid": "dfc586c6-c2d5-4fc0-a294-df44e165d01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942523, "uuid": "d07a6a32-9549-4817-9bed-c0f3cdf63070", "value": "out1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dac8659-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704940301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940301, "uuid": "ae2992f5-b3b5-4a2e-b9f0-1bdf3c044a86", "comment": "Malware payload (RedLineStealer)", "value": "5421752668214c12ea7feee1f5d46580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940301, "uuid": "ed610b15-7237-46ed-8cae-c448e049fb8e", "comment": "Malware payload (RedLineStealer)", "value": "0b8b6ae77cdc328f081d5cd1a545fee1487adf46b58845526f8c7314a64500c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940301, "uuid": "9aa3cf65-a4e1-4584-9d85-a139398f45a8", "comment": "Malware payload (RedLineStealer)", "value": "30cfaab3e78b670e18ce8ff64925d739d92530a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940301, "uuid": "d43c5d95-0e17-42a8-aa07-507cc09f6bc4", "comment": "Malware payload (RedLineStealer)", "value": "c7e16e2cfef5709af7d3d9fc940b7d34bd6a7933aabf666672a7f2d40e03d29ceba6a72b688b5e4c6636eb20cd609767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940301, "uuid": "3657e485-538b-44c4-80dd-ea3db9a6ad93", "value": "T10E953394DB1B0B5ECED5097D89EB902817F8D6874273D38339AE43518052BDFC629E8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940301, "uuid": "7f56a103-f980-4df6-b598-dca32c3d845b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940301, "uuid": "5ea6e69f-5a2a-4a73-a2e4-f9c46f9db328", "value": "49152:bfJDJ0hLzvWhbFvMVbrczkdtzqlHo2Ydt6aj2bd2T:E5rVbYckt9oSET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940301, "uuid": "a1ab08f2-dce2-42fc-85c6-091a7ec45113", "value": 1940480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940301, "uuid": "41153079-6556-40ba-876a-f93cae9187da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940301, "uuid": "57479de3-3ce2-4a3e-bed3-eac0a98ce158", "value": "5421752668214c12ea7feee1f5d46580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81b6178-b06b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704968826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968826, "uuid": "3eb74ee1-5dbe-46ed-9270-d6c203ec4930", "comment": "Malware payload", "value": "8972149b5dabf81f7a446a230aac0c96", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968826, "uuid": "a8b0ee0d-09c2-4500-a30a-72d9a3a21179", "comment": "Malware payload", "value": "0e10ae1c6a1d1991e5765bc6cce380373f3344af98d15692de0882e26844cf2a", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968826, "uuid": "38bd814d-208d-461c-8538-7335ad774c54", "comment": "Malware payload", "value": "21d53afcbd52ef991d21a01dc18eec7fc6576e93", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968826, "uuid": "5379c195-d388-4219-88a2-cec07448bd52", "comment": "Malware payload", "value": "df1116e4585e5e4d7f2d4f734bd7bf8d4e64e000948feaab6e6bd9f9336518f5ac3e7495dd8151f45704dd0aa110390d", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968826, "uuid": "70c78b7c-83e8-4f6e-aa21-c090ef0125ce", "value": "T1BC72BF39C9607634D666C63CC04916E2F60E27F17BAAD58C269773CC83805974F296C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968826, "uuid": "4a73aff4-1dc0-4fcb-9d7f-68f496c5808e", "value": "384:dVPHaIFsRplqiJF/hgbMLgfAani7vdU6E9c:vPHja0iJth0cghni7vC6E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968826, "uuid": "81b8f8a5-8b29-4c79-9e80-115dfa3a179a", "value": 16228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968826, "uuid": "fccf794b-752d-4265-83b4-a002959538ef", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968826, "uuid": "8baabb31-bd62-4352-928a-1611b1ff6427", "value": "qfqe.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1357e3e5-b051-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704957275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704957275, "uuid": "96a096e3-4763-45d4-9fe0-7d72641139f6", "comment": "Malware payload (AgentTesla)", "value": "e346350c30f5b5f49c44e11644faa785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704957275, "uuid": "2cbd2a4b-4190-4a48-a0e8-25b7deabc030", "comment": "Malware payload (AgentTesla)", "value": "0eba2b6e7c10156a15d9c09d2cb7c20c34e1f024c4627159d7afb9b3be7d39af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704957275, "uuid": "4f18e80f-d328-4b13-a2b3-8d23ee4c0f99", "comment": "Malware payload (AgentTesla)", "value": "eece3786d3ac103bf14ea6754eea6c490a058166", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704957275, "uuid": "01f63553-a2a4-487d-a236-a95a6f4fcd55", "comment": "Malware payload (AgentTesla)", "value": "6562ddedcb817a27a2a734b4dcf9a0004dead6d0a59031f0470a3bd5d5ed280c62efed1fd779250bf5e1ad2af2276d75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704957275, "uuid": "aea8c798-fd4b-40b2-adec-c2d1a94a5010", "value": "T120D412082B5DCF24D1AD93FAA156226093F8AE256063EBD58EEB34F79171B4507C0B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704957275, "uuid": "7ca7e6a1-679c-4512-8eaf-2c8ccd225b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704957275, "uuid": "c0d43805-6564-418d-8688-dfbd1304cb68", "value": "12288:c59b7szMErtPxLiHtp9WAcrXIeLZEihQ81SkFJGUPJxDdT:2YzlUH/MAczeiCbsxhZdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704957275, "uuid": "6148c5f7-e9ca-458e-8fe8-edf41ac821ad", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704957275, "uuid": "4efd5cba-4715-446c-bd04-485251ee14b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704957275, "uuid": "df6e3084-a7c5-4899-a4ed-261d3ff91cbe", "value": "SecuriteInfo.com.Win32.PWSX-gen.21780.27759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fb91f3-b09a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704988705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988705, "uuid": "e2525a59-c8a3-4dc7-994e-549234a8653e", "comment": "Malware payload (Mirai)", "value": "2d13e1d7dae6c299f6cd34189f0ec7bc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988705, "uuid": "1c47ebe7-18ff-4c19-9289-71aed6ad2c66", "comment": "Malware payload (Mirai)", "value": "0f709f8e918c2796fdc46c078c526551c44309c1de16d215bd499a14a565c809", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988705, "uuid": "d4e476e6-49ec-4ef2-91c5-98b9b0f32686", "comment": "Malware payload (Mirai)", "value": "9f682998b5edaceafd5197d55f739c855481d75b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988705, "uuid": "ac5926e3-16e2-4f32-be56-1494ed941897", "comment": "Malware payload (Mirai)", "value": "0d2da0580665f19b79deb912a40f7f289158925af5985c8b75674dd2f8b25e860bc5f7b871b1728e68dd8c0f6dd78201", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988705, "uuid": "cbe20d56-afe3-4a68-a382-651b425acd8b", "value": "T10EE34C1AB5D088FEC89AC1744FAAF136DD71F4294138B16F27D4AF222F4DE215B6E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988705, "uuid": "2b92e164-4deb-4be4-aaa1-91e148999a0a", "value": "3072:V1a+VukBr/fFJ7RBPm0NfTbf8yJrdIByjWA7m:zbVRnBbfVx/7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704988705, "uuid": "2d0365f9-b4de-45a2-8cb5-6faa8ae1d71e", "value": 154952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704988705, "uuid": "4793e7f3-d584-41dd-8608-774649689bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988705, "uuid": "8e0c0fe6-65c6-4f55-9bac-b09d125078e2", "value": "2d13e1d7dae6c299f6cd34189f0ec7bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca35b0e4-b015-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704931812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704931812, "uuid": "b5cdc02c-9099-43c9-90f1-039c2c577c81", "comment": "Malware payload (RedLineStealer)", "value": "0e55a69a69ee52e73bca149cec388b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704931812, "uuid": "bf0244f9-e42f-49b6-8b33-d84257139a2a", "comment": "Malware payload (RedLineStealer)", "value": "101b9564ba11aa44372b37b1143eac0d5dd1e3f38c6a35517de843b9f23b3704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704931812, "uuid": "8e26d903-f598-4eeb-951f-7f5ab2a4afc3", "comment": "Malware payload (RedLineStealer)", "value": "42f01f868ff58df36f9e28ed8abf5028c7b33755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704931812, "uuid": "31379e3c-69b8-4bbb-8fea-0f6ce53b57aa", "comment": "Malware payload (RedLineStealer)", "value": "bb88fc6960b54ce89df8c6760e2fdb0bd8a02eb7f37f471b0578bc0970b1fcfc7da2ca92aa6893daaaf0cd8c52d42925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704931812, "uuid": "e9e6f494-26c0-4681-8295-8254d40d4c61", "value": "T1C0F6331DB8A4C0ACD6FC6A36D1D6F952D505FEE88161BA0BCCDCF508F973389DA4A016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704931812, "uuid": "18e4f634-3f43-48ad-9ba6-47ff5ff320f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704931812, "uuid": "219d5f84-7e7c-4c5c-88c3-7adb1d8caf71", "value": "393216:iW1rplWSh6sVwIH0bPJHt8YlWunkNxwajY:/rplthsfHt8UGxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704931812, "uuid": "0539a6c2-ba11-47d0-ab67-d8742fdf771a", "value": 16153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704931812, "uuid": "cd8772d8-39ff-48f6-b1b8-9e7044b17fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704931812, "uuid": "a4146874-0712-4642-aba6-304c9e1a206f", "value": "0e55a69a69ee52e73bca149cec388b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e7ebfd-b071-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704971123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971123, "uuid": "36a55bdb-6030-4345-a6a2-028e74019301", "comment": "Malware payload (Socks5Systemz)", "value": "52d9510ce6b13a56cdee710edd31f436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971123, "uuid": "cc47d82f-5517-4a61-95c6-739280033df4", "comment": "Malware payload (Socks5Systemz)", "value": "12799551e5f50de2d5bec3973d53e745d66b4f41ede09197630a8b6cdac296c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971123, "uuid": "adb0685d-be02-4c0b-a2b9-7c7acf60b319", "comment": "Malware payload (Socks5Systemz)", "value": "ae0c3ec25c95b065f7ff1a29921e94ac38d667a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971123, "uuid": "b06012e9-9e8e-475c-b3c4-c8e1c53c17f6", "comment": "Malware payload (Socks5Systemz)", "value": "0f45a5da6595e50240009d889a39eb8f28c7476c117c9009ad551a96efcaed76cccd010da5728be420c4a8cbfb1667b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971123, "uuid": "567541b7-b335-48c0-b61a-bbdf3a3d0c82", "value": "T14C260241E598FCC5C80B20F3ADB9E995201FFB5D467989263967B60B99F32433827D0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971123, "uuid": "1aa6fac2-9519-40e0-920e-afc460f3c848", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971123, "uuid": "4d03a8a6-9b7c-45e5-8566-6971028b5d71", "value": "98304:OiQk9+0qInd6yMACFxt/d8CgJxT50xkzak4VY/cZ4M6FXpko:7Qk9nxnd6G2yTT50eJEexdpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971123, "uuid": "2eaecaf6-c01c-464f-a464-bffb62755c01", "value": 4812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971123, "uuid": "f1c837ce-46f5-4430-bd77-9825c745463f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971123, "uuid": "42bb7bc0-b342-494b-9be4-2a60d6e29059", "value": "52d9510ce6b13a56cdee710edd31f436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26d1735-b068-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704967474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704967474, "uuid": "bc1fd12c-2976-4a90-8f57-84af4fd8ce2f", "comment": "Malware payload (RedLineStealer)", "value": "03094848771ca3dbc5db25ed9653e535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704967474, "uuid": "fe0d054b-38a4-47a2-a2d5-b30bc497c429", "comment": "Malware payload (RedLineStealer)", "value": "15b386a6b3114004205aec7e70b00065aa7f847ca3de172cb3d0e0566a91ce20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704967474, "uuid": "04db36b4-099e-4496-94a4-7398838e78ca", "comment": "Malware payload (RedLineStealer)", "value": "dcb3c45f9bcf5a03e4fa89c0f4d08abede82b227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704967474, "uuid": "c8cb34a3-90b3-43ff-8374-586bd98bb753", "comment": "Malware payload (RedLineStealer)", "value": "db5fe82c881e5807ad830a0affda45ee75ae81dc1d92566fd3e397a5db8c51d0fcdb955c2659090089329561bebc6824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704967474, "uuid": "98f11d16-5d95-4398-9dc8-91494489f6be", "value": "T1FA469D527684DD11D0BA6636C9EF410407FCF8463A73EB1A3A9F33AC21527E61C4A6DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704967474, "uuid": "46321a1b-1fd0-49a4-8070-44ba86b7b9ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704967474, "uuid": "48b3b71a-3489-486c-a3ab-8e5388cb3fe3", "value": "49152:wlHpBPRpyKnm1aHuuIGyfxsN7K+4pZ6sKq7ew6q8BLlKezexgm0RWF8NgwVjkFyY:wbBJpKam6Y8zKYdRxNg4iyKSYoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704967474, "uuid": "68aa095a-7362-4753-8ac1-212f1a771545", "value": 5633680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704967474, "uuid": "587b6f7a-8b34-4fe2-8bbc-621932351b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704967474, "uuid": "86f7e3a9-c5da-41b9-8c76-a9dee55086e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10eb89a-b02f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704942937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942937, "uuid": "64ab34cf-3faf-4bc9-a449-bd2ed9c1f1ca", "comment": "Malware payload (Mirai)", "value": "827e408b2ba768f62b4ddfb20ad1cd81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942937, "uuid": "bd9a1ca4-345f-4844-98f0-d64870bdb8ac", "comment": "Malware payload (Mirai)", "value": "15e3ab21fd0421032745734a0e1f788934785da7fec500914da23894b37bbfec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942937, "uuid": "ac8d0bfb-3d71-4f89-b574-1ec761690e2b", "comment": "Malware payload (Mirai)", "value": "cb82783a76197bfd56853a41bbe48b4ea2761685", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942937, "uuid": "b0d7ea53-fad1-4646-be3a-4e4a3aec67d5", "comment": "Malware payload (Mirai)", "value": "a1c119016ce724d77a93a1c48b7a7b381d5e2a062f588fd45bfe487f5c8f674b2ac26d1f3056ae54b8683c3cb8fc328a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942937, "uuid": "c81e51d0-292b-40e3-814d-32ff9b2615d3", "value": "T16FD34C46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F86BAF0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942937, "uuid": "948eb4e8-0620-4388-8e9b-ebd5bc2f8db1", "value": "3072:ew9Lg2RRhpRM54ya5F2n0tuiC/gH5CEuqZ+3l2M/9iSYj:N9LgaRhpRMqzOuuiC/gZCe+3kM/9pYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704942937, "uuid": "330175c6-be80-4155-b27f-5ed372585a89", "value": 131939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704942937, "uuid": "1e4753c1-3db5-4801-8ee8-20093894843b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942937, "uuid": "76744cde-418c-475e-95a1-e289a603ee79", "value": "827e408b2ba768f62b4ddfb20ad1cd81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef30ed28-b0b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705000594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000594, "uuid": "a684d42e-2a21-4fd5-9f36-7e0413df075b", "comment": "Malware payload", "value": "6a83b387757563547c3d1383f49e4ce9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000594, "uuid": "1af38939-f293-428d-b501-519e6f4d2346", "comment": "Malware payload", "value": "16c6939e58bf7f1431c6ea29cc30b221f4d1773d07baadfd15143d4b7becf081", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000594, "uuid": "78a2b934-8c2b-4340-8811-4936e6f94bd2", "comment": "Malware payload", "value": "73d08bd87251671ea86de7da19366498100ed159", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000594, "uuid": "f9343145-66bc-455c-923f-ee27ab34546d", "comment": "Malware payload", "value": "66bb2e63add4f72f6193d9e1e24308374e62931a7c2545413442e6f7007a22b57f81b983bd4ed770be7cfa9f3feab528", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000594, "uuid": "844b3aeb-736e-4947-b8fe-f0253fc12e37", "value": "T1A1143B46AA408B13C0D72BB9FBDF424533339B54D7EB63069528AFB43F8679A4F62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000594, "uuid": "c786b0e3-b03c-4154-9047-961c1b6274c8", "value": "6144:FmOVXzKCmauH3eHTi0ogN15vKaSi5M/RciI:FPKCmauH3eHTCerRSii/SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705000594, "uuid": "6ef51962-2406-4807-acd5-27c28d4d859a", "value": 204710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705000594, "uuid": "5f65ef2e-8d63-4bed-a8a9-2b0191762440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000594, "uuid": "6cfcaf55-ab20-44c2-835c-6a94ea855937", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb6d807-b080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704977556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977556, "uuid": "ad81647d-d61e-46d7-8b6c-9d1e201ce280", "comment": "Malware payload (AgentTesla)", "value": "03b1da2d97e0865198182dd73f748a90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977556, "uuid": "aa3a11b7-5298-4073-86fe-dc30242b94ed", "comment": "Malware payload (AgentTesla)", "value": "1793b6d629599f4709ba967ebfc2e07e77bc42d07b475467fedd94c53dafafe0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977556, "uuid": "8dfe1fa9-e394-4c0e-9084-58dbf1d9690e", "comment": "Malware payload (AgentTesla)", "value": "e2eeb478ad0d8fb32ed024c03f3f3e68f1d3a58a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977556, "uuid": "c763763a-fae8-4bc1-a10c-ccb723ef77d3", "comment": "Malware payload (AgentTesla)", "value": "899969a7602ee1c7c105943014526df4a9ce9de0b9be2298ad61f5dcd6624d62c597df871e4153171dea27787ade6869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977556, "uuid": "697d128d-4dac-4f55-8797-ed5d201ba543", "value": "T11D340E037E88EB15D5A83E3782EF6C2413B2B4C71633C60B6F49AF9614516829D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977556, "uuid": "742f0ade-17d5-4acb-9152-f0ebf823e0c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977556, "uuid": "943fd3b6-b941-4e60-a341-0eb730f31fa1", "value": "3072:mxo+u7nCht/wkI0TWU//9i9l85r2VO3x50dk:mxo+u7nCht/wkIVXlPOhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977556, "uuid": "30f6a14b-6b69-4f6c-8cd0-42a9341359d7", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977556, "uuid": "c65e23f4-3c09-4275-a8f1-86126c9838bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977556, "uuid": "2131ca4b-14a2-4199-ad86-7e2b7d28b74f", "value": "1793b6d629599f4709ba967ebfc2e07e77bc42d07b475467fedd94c53dafafe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f0c67c-b07d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1704976317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "b7b1ae68-e609-40e5-89bf-3ddd6032dd94", "comment": "Malware payload (RemcosRAT)", "value": "a6849832500aad21faab613bbe7fd37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "d7cef5c7-bae7-4e52-b5c7-7a91f55e2369", "comment": "Malware payload (RemcosRAT)", "value": "17eb1a2f794ad5e02a0d96fcbd42fcfe328eb4a10bdda74d8e5cb1dfc46e4fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "eefeeda7-092b-4355-a3d3-14068f498ef1", "comment": "Malware payload (RemcosRAT)", "value": "cc691ca9bfdd4bcd07d97375559155f0acdf21c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "401a87b8-2ae6-49b2-885f-bf40d1062606", "comment": "Malware payload (RemcosRAT)", "value": "63154385ad1f44f9e1a845d1825691fc65b1d00a744360451f0fe80cf0798bccb36eca39fcbc06399e2b0ecb2557e545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "39879fc2-6fc7-44ed-865a-b0c56c393800", "value": "T1DD7533A586FE9588D9AF407238D7C3194208EC11CCBC46A5A6B5F2FACD7A72776034F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "d13aec10-562a-4807-8a37-b75439e1e644", "value": "2ad075ffe9d4155f2388e390518b6054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "e5dc05d3-3ac6-4fe6-8f68-4f7c0369dfca", "value": "24576:l9yc4fW0mzue9ZqXiWmGrLVkbiENWHFpjBYyli6cedPuL1jd6Ba0v:l9y20qZZArLqbtWTtYyliJeFu5RY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976317, "uuid": "db005ea8-a12e-44ee-8bee-aad9ff611a17", "value": 1602488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976317, "uuid": "b1d7a44b-5e68-4013-be63-4002c9531232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "34076630-4703-47ff-9e21-99503b564899", "value": "17eb1a2f794ad5e02a0d96fcbd42fcfe328eb4a10bdda74d8e5cb1dfc46e4fa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73e2ace-b07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704976985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976985, "uuid": "245c244f-230a-4014-b617-defec89d1901", "comment": "Malware payload (AsyncRAT)", "value": "77ad55a2c97b0ffa8131f3a559de8b03", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976985, "uuid": "51c4ca2c-f9ac-4168-9f9a-75dcf76b2dc5", "comment": "Malware payload (AsyncRAT)", "value": "1864a38b10dbaa7cc52167986e7575d6464c3eee49a971f3c78fc87d7e16492a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976985, "uuid": "185cd93f-9ee6-4b6c-acaa-7b78c461a76a", "comment": "Malware payload (AsyncRAT)", "value": "5daf36baf335bd5c5f20c3fcfbf35bd244ed56dd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976985, "uuid": "a16ca22d-bf7f-430c-9dcc-118ada36c296", "comment": "Malware payload (AsyncRAT)", "value": "fa51b99e0ba735c6d9c7c5058c3670e881c76e43b44d95b144ad4a73d9170ecd5fe0c7b6862548295369b0e9b1494744", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976985, "uuid": "ac035a1c-f8dd-423f-9ad1-8224a2321ad8", "value": "T170535C003B99C956E2BE46B4ACF215410AB5C6772112CB1E7CC810DB6B9FFC64A527FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976985, "uuid": "bcee2838-ae73-47d8-a7ba-14c678b3da9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976985, "uuid": "71a58275-bbcf-471e-ab83-c94a95b6876c", "value": "768:65KZlQd8Q/Qw78vEC8A+X6UMwNDWs8D/2e1+T4VSBGHmDbDvph0oXTqbjvoSuc2P:zZKpQ8P9NDCrmYUblh9YvuznpqKmY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976985, "uuid": "bb68e89e-3ae2-47d4-a06e-a85df4448e45", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976985, "uuid": "99c3b1b2-3c8e-4bf0-a6d8-80e22fd76047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976985, "uuid": "a09fa31f-c2c9-4a30-b61a-5c41b8f82327", "value": "1864a38b10dbaa7cc52167986e7575d6464c3eee49a971f3c78fc87d7e16492a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938e7a40-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704939022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939022, "uuid": "433a4eb1-e799-4efb-8bf1-c10ecf14ff73", "comment": "Malware payload (Formbook)", "value": "2009622d584babb952a3347a408c6f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939022, "uuid": "30b1bf5c-2f64-46c7-a083-62cfd32b4331", "comment": "Malware payload (Formbook)", "value": "1b7c29ec3b8b5e6d2ef3535b36990ad6dec6c2cd2800bb237717965b23ca8a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939022, "uuid": "db7bfce7-5474-4d52-9bc6-828f36c1a95e", "comment": "Malware payload (Formbook)", "value": "148f131684dc58e044f319f03d4b18f17b3ce592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939022, "uuid": "d707f367-c6a1-413b-a647-17c61bcc67b0", "comment": "Malware payload (Formbook)", "value": "eb460edcb5419bfd36d785c92f3566755a9293c9a01caf798e9a06286b51d5625633640d134253dbebc5edc903df01c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939022, "uuid": "3aaa898d-b28c-43a9-b922-cad8e7c051e0", "value": "T1FD351202BAC298B2C4724E325D75A711ED797D206B65CFCF67C00A29EAE24C1D731FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939022, "uuid": "f853545c-fdad-46e7-b2ed-e89f7e0102b3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939022, "uuid": "7f0fc425-8614-4ca5-b679-b242b385be37", "value": "24576:yTbBv5rU/xYCVBDRPbdnBldBv++3SBGa6mXcqIAXiAQFSDU:UBmYCVZRzdnBlT24LAXiAVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939022, "uuid": "df6d6f62-9634-4033-940e-0553c1c10b30", "value": 1134446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939022, "uuid": "6f1a4bfe-174b-47a8-80af-278e7b57ea51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939022, "uuid": "e2824b13-9190-4e54-84db-7813bdac43aa", "value": "Quotation-3927377773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3880427-b075-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1704973033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973033, "uuid": "86977965-2dda-418c-ba9b-9dd64f5bf77e", "comment": "Malware payload (RemoteManipulator)", "value": "0377166caf38438de4232fb6a86893f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "remoteutilities", "colour": "#B9545C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "rurat RemoteUtilitiesLLC EXE UPX", "colour": "#3D156B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973033, "uuid": "25f822e7-29b7-4efe-b4a8-70b389759e62", "comment": "Malware payload (RemoteManipulator)", "value": "1c0b5baceb177598bafee74d48d91567428e3033521caec287021164db19b96e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "remoteutilities", "colour": "#B9545C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "rurat RemoteUtilitiesLLC EXE UPX", "colour": "#3D156B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973033, "uuid": "a88762ae-99cf-40e8-895a-b4cef9a76d9a", "comment": "Malware payload (RemoteManipulator)", "value": "67d46b924111c8d1ea88ea9f45499d469f926495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "remoteutilities", "colour": "#B9545C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "rurat RemoteUtilitiesLLC EXE UPX", "colour": "#3D156B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973033, "uuid": "820bfcb6-f064-45b5-ace8-137be8cf4a35", "comment": "Malware payload (RemoteManipulator)", "value": "177aa7df702661868e23c4cb29fc172bf42151c3ac32cb6d797eeae9e564f8a38f6a199dd050073adf44018137f3f763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "remoteutilities", "colour": "#B9545C", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "rurat RemoteUtilitiesLLC EXE UPX", "colour": "#3D156B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973033, "uuid": "8b1842e9-036a-4daa-b0d0-6917b04a95ae", "value": "T1E40733C7F7E00919FDBB073199F65F0C4A3AFCACAB2A130E09D5F21664639520866697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973033, "uuid": "f295fed4-8c44-4f5c-aafb-1fcce2b90fe1", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973033, "uuid": "d81e0be1-8c57-4a73-9245-89fdd641bac6", "value": "393216:JAFd1z11zFoBV360BGwbh5GyktRUuc3G/lr96rLG09hk3Doi+:JAFn17S60AwetSu6G9Z6r6Shk8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704973033, "uuid": "5e087151-b3e5-452f-9954-c3881a082f07", "value": 18167808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704973033, "uuid": "8712399c-45ef-4c17-be7d-3b0850f84617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973033, "uuid": "434c6c2c-098f-4898-9847-e3caa1a90987", "value": "\u0415\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0438\u0439 \u0437\u0430\u043f\u0438\u0442 Medoc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b508d3b-b087-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1704980508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980508, "uuid": "eca4700f-6c42-474d-8233-c50777d143a8", "comment": "Malware payload (Stop)", "value": "de8d1752bf8dd628a5065c19f83af296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980508, "uuid": "09b8d6bc-a9aa-47eb-bc62-557ba258e371", "comment": "Malware payload (Stop)", "value": "1c1db50e2876a312fc1b8cf6f3234d157f7accc140b14b47318c735d97693f3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980508, "uuid": "4537f492-7f63-4510-b957-a408f011d4f0", "comment": "Malware payload (Stop)", "value": "c774109e88b1c71a1f3c92f1dbb04a3151b45966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980508, "uuid": "23c88361-4fe7-482d-a3dd-cf581aa3a49d", "comment": "Malware payload (Stop)", "value": "83642b5f6b076cad12200bbb49efac601ec3506bd29585cc901fe3d1b39a6c1743e59fce3132d1452ad8952234b93741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980508, "uuid": "d51a30ef-5c43-4fea-9b43-98718beb3756", "value": "T1D2E4123178B18077E2F74236E47141649A7BB9122BB589CF77A8832E0F622D04E7D35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980508, "uuid": "6a893de4-fa9c-45d8-b250-b1f857973430", "value": "99190d8cd877eac8f1ec8c4c753e3a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980508, "uuid": "3eec9d95-9582-414d-92b8-145145015065", "value": "12288:c7YRBR3jnqYEmQog6aXk6mG/6/BybShRgxMYtsGStU9WJ/8CSjdw+mlkF9Xrnd:1BJ+rfuGSpcS5JvU9WJ8CMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980508, "uuid": "1b2241ef-ebf7-4171-bfb7-65db4230a35b", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980508, "uuid": "aa3ef92f-9eae-411a-a631-70af7bea842f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980508, "uuid": "1a0eb7a5-087b-4bff-b9aa-7aeb7e9f2ad7", "value": "1c1db50e2876a312fc1b8cf6f3234d157f7accc140b14b47318c735d97693f3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df71ef8-b090-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704984486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984486, "uuid": "bb9a9d94-9157-451d-8f32-08f8534f83ee", "comment": "Malware payload", "value": "b616a68a7def0a2ceb4a52e9d0a04862", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984486, "uuid": "83eb6724-05b4-4036-9cfc-5ca1e79bfc4e", "comment": "Malware payload", "value": "1c37b630dfef62d41a02282e7a8c7b1619b36b933eb77d7e6c262258f0103d10", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984486, "uuid": "ed8b7d3a-eb88-459c-acae-56e3832708f9", "comment": "Malware payload", "value": "63a15a85243637868d6253cea202a1450e503765", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984486, "uuid": "ce2e7cc7-63e6-4a50-9ba3-6c9d40cafc72", "comment": "Malware payload", "value": "54ad9a4ea4a8f9cfc8e8e63a97acad31776b8a0a88da657ae227936104c71dd42e4fd97dd702c51be1a19db6e2585f30", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984486, "uuid": "3b8fea97-ab94-45a2-bc3b-5f7d8cc9ac93", "value": "T15873222DED50DA46C905F93BC4F3B100C37971C76223872E6A669DBA259B32795CE0BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984486, "uuid": "0a25f429-5094-4d09-974c-f91feb6ca9a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984486, "uuid": "825c51e4-d45e-4347-a569-2c5aa0657185", "value": "1536:KBQVFSBvBxBxB+4BvB7B7Pc72RUwMhp0wMhv2JU:KB8FSBvBxBxBlBvB7B7Pgjb0aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704984486, "uuid": "45bc0fff-c4b8-4ff7-93bc-d1f988587607", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704984486, "uuid": "706ea5ce-7836-4a95-96e4-555a400d32c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984486, "uuid": "48572ac7-0bde-4ccc-b5b4-05d3cced2bcb", "value": "17049844844c91418df05caa784d7b01efd38530d3b9f4085141b3efa51b2282b1bd03abee258.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ce154f-b04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1704955365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955365, "uuid": "2c131658-ac0d-4e97-88c5-b6d9eac7a68f", "comment": "Malware payload (Meterpreter)", "value": "f44d72ee04d861930cb47567e81b9bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955365, "uuid": "4f2b9a0d-cc6e-4ce2-a7ff-241f8a4d5dea", "comment": "Malware payload (Meterpreter)", "value": "1c66a4cfdf79926a56c1bd6ac25381b2deeed980fa28606ee826fe01ef49c4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955365, "uuid": "4bd1e7d5-9b61-4407-8d87-ebbfd96f1ce1", "comment": "Malware payload (Meterpreter)", "value": "694d26a997ae7f6731c8aeb4fcb0e51aeb6705b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955365, "uuid": "06f9fa45-f8b8-4859-95e1-d806c9e58a69", "comment": "Malware payload (Meterpreter)", "value": "ca31e87d48abc7993babb02243908a178da75bb9fe699159e8958d78993f4fe0d32159051b21cadbff12becb7145099a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955365, "uuid": "0bdb6ea3-bf9e-41c5-aeab-5b6d18acc1c5", "value": "T1EAE1B5033B144DB6E8BC093C0AD3FDB771998E2A2F3F83728E180317292322478E0904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955365, "uuid": "69761d4a-30a9-4153-8a0b-b42cfffda83c", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955365, "uuid": "845ddcb5-1c18-48f1-b996-a89e0a129f69", "value": "24:eFGStrJ9u0/6f8nZdkBQAVz6WYfYKLq4QeNDMSCvOXpmB:is06gkBQSiQYQSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704955365, "uuid": "39a23b4f-b231-44d4-b3e7-ed8291c6eacf", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704955365, "uuid": "039a10e2-9876-4fd0-8b12-a3d9b0444ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955365, "uuid": "d97f66ed-1368-4224-8ba6-1d4dac4660a9", "value": "shell64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b32a0e-b0b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704998479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704998479, "uuid": "0556d938-bb3c-4d86-b30c-60d66485f6b1", "comment": "Malware payload", "value": "ce7c0c0e6965157e4c2c716b858afa37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704998479, "uuid": "31ccd89e-f2f8-4c85-bf10-9fe20b25f090", "comment": "Malware payload", "value": "1c6b17bfcc95be957e2a0a79281b810c05a993111b142d63fb1e32a351d789c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704998479, "uuid": "977f43cd-087c-4a8b-b72f-25b34c1d2112", "comment": "Malware payload", "value": "92e49af4692984f9e9f7d8767f74c23657bb5e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704998479, "uuid": "c0b9ea68-82d6-4e3a-9026-cf5dd76bbf1e", "comment": "Malware payload", "value": "1daaca9ad4240bcb9ce37b28b7284ee838f03b68a7bb549d80c2a6e1a09deecac4f074198d600fffbe83889d9cfaced7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704998479, "uuid": "556ab183-5547-47b3-8e57-34945d1fd115", "value": "T16A74A55382E13D44E9758B73AF2FC6FD770EF2918E4977A911199E2B20B0076D263B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704998479, "uuid": "9383b904-b531-434d-8d45-1bc0997cf5fc", "value": "e50424ce4e0fbfb6f4c826e64064c742", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704998479, "uuid": "54ca4478-2994-4b07-be5e-bf8760a83fc7", "value": "3072:YyN4L+dRymGchJ23gtb3dcwE5AtxJn+tx3Y5tGq0Px:YI4LQQmbYwtrdcSzcfkGq05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704998479, "uuid": "73f63ac5-5125-4523-adad-eec1b7356548", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704998479, "uuid": "24fff8b9-cd0f-4229-9b75-b482d1613cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704998479, "uuid": "f3e94901-055b-48ef-8315-c1f7c1be507d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e866b5d-b03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704948919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948919, "uuid": "6b45ec92-6f08-425a-a887-14a17078611b", "comment": "Malware payload (Socks5Systemz)", "value": "ee662511c5f8dbf74f7b8b5151464bd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948919, "uuid": "fdfef084-1eed-4e83-844d-de2ec947450e", "comment": "Malware payload (Socks5Systemz)", "value": "1fa544646d6c53b124a6c43bdb0479fcd254e74dafe992c537ad40d7b7d0a850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948919, "uuid": "87c49979-a4a9-42ae-bbb2-021810f3616f", "comment": "Malware payload (Socks5Systemz)", "value": "5423c7913005bc5f19ab13cef9c405f97b54614a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948919, "uuid": "97991b3d-98bd-461f-a015-8cda0c4d37c1", "comment": "Malware payload (Socks5Systemz)", "value": "9fbbfdebf683a49617e318e193d25588658c1093c53b339f0c6801e7ecf0fc615a463f7f5c3a804542b0c9e131dacdb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948919, "uuid": "52bd3179-e8b3-4458-aab7-bf933c7cfaf4", "value": "T13F3622144F6DF95AD1D048F4AEA0B6ECF574AE612EBF0246ACA3B96FD579B4C3E05000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948919, "uuid": "25b1734c-c217-485a-a901-9393bdcf7e90", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948919, "uuid": "169fde73-02b7-4d57-82ae-a88d47df3d48", "value": "98304:ti/pvA3Q7k+4dniEoqAmVTNKjmijbsjwZjUNHlyBmvVPahUhlFNTndZ7kq:0/pv0ekNdhoSt4jpbsjwiNHam9PXFx7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704948919, "uuid": "dec2e5f1-9931-44c7-b0fb-e1733bb5950d", "value": 4872754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704948919, "uuid": "c635b437-2358-47aa-9945-f61875e015bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948919, "uuid": "9352cc9a-960e-4ab5-bb5f-463e035eb9c4", "value": "ee662511c5f8dbf74f7b8b5151464bd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f83f5da-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943257, "uuid": "c9e62aad-3e8b-4f80-bd40-39c2a6645a8e", "comment": "Malware payload (Mirai)", "value": "6eeb28726b5dadc758ae067dd1ff01d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943257, "uuid": "22b197ac-ea2a-4ed0-b364-ae7ab59acefe", "comment": "Malware payload (Mirai)", "value": "1fc5df840917e7503fcac4be3c2886426fbb9fa70f4d3b45f5b1ec8baad56bf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943257, "uuid": "4cc6bf0f-360c-4b08-8a9e-da92f456e33e", "comment": "Malware payload (Mirai)", "value": "614b16b36ab64f5e2d0191dbd6fb8a29303e7586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943257, "uuid": "7ad6e5f0-23fb-43d6-8d61-8a60cfd0ebda", "comment": "Malware payload (Mirai)", "value": "f6c1b811081505b1875ec86f75ff361950906958896e9ba5a4e55389ca1643fd6dab8584dfd2ba822446c43934ae6ae9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943257, "uuid": "cf84ca2a-2999-47c6-ad7c-2f9d058a03dc", "value": "T1B633D79578D25A2AC6E4237AF9AE40CE332073E8D1CF3217CC151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943257, "uuid": "850c0336-cefc-4b15-9f55-8c580eae839a", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHMoA7WhKpQo:S5ZIs5LL5nYoAihWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943257, "uuid": "f38f57b8-c3d0-4c9c-9f82-a19462c2feca", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943257, "uuid": "f848683e-cc0d-4b61-9b76-7650248635ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943257, "uuid": "ce8fb7c3-cc18-46ca-b179-a71f7b29734d", "value": "6eeb28726b5dadc758ae067dd1ff01d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3df62c-b0d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705015170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705015170, "uuid": "2ae049b7-02fa-4ee0-b2f5-4538f3b30fba", "comment": "Malware payload", "value": "3d66b6b5f045562cfe1b082c20ccbbe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705015170, "uuid": "c750abb4-650b-4fe4-a54f-710c4f114721", "comment": "Malware payload", "value": "20ec3bec0465f43ae42fdd9a1689c7cd9290e8fd4f97eaaf7bf94decb61a09bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705015170, "uuid": "511fee47-59bd-4a91-ae45-823eaddda0c5", "comment": "Malware payload", "value": "6f8f27f84d3c65bff09e27a5cffa354da86ce2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705015170, "uuid": "e47270b1-a62d-46e3-b367-28dbf0a3354e", "comment": "Malware payload", "value": "45bc98522681d2b2a948d3243e36610a5eac55911c77f0f84c5291594da7b2eff225538e4b9c77c41e446b7e9f2abc6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705015170, "uuid": "319cd1fd-28be-44f8-af27-d46bba59cff9", "value": "T1CFB5230237C480B0D563253B15656B506A3CBD61DFB68AD3A3A03E2CEF719D29B39763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705015170, "uuid": "727b6c77-4146-4e06-8ac9-01e9f5acfec2", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705015170, "uuid": "da19afd0-9d68-4692-84d8-a9c7af82ba3f", "value": "49152:anGImUnDnszjURXVNFn6YqQrzgOWUwgedfCx/z0g7+mmgc:aGInDszqzxqQ3lWXge4x/ykc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705015170, "uuid": "723e7fc5-9b80-4c73-975c-4c17f51bb948", "value": 2451084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705015170, "uuid": "e7235abe-417b-4002-8c9f-36b0d522f602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705015170, "uuid": "6d37ba15-a5e8-4cb9-a74c-dc77db9dfd22", "value": "SecuriteInfo.com.Win32.DropperX-gen.19731.891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f312933-b056-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704959416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959416, "uuid": "a7f2b1d9-2d01-4c92-bf3e-29e5545e7b47", "comment": "Malware payload (Socks5Systemz)", "value": "6bf91b07dee48c48359b2f92f72b3e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959416, "uuid": "6554a158-5e79-49c9-a6e0-bdbc73ec5c56", "comment": "Malware payload (Socks5Systemz)", "value": "211560aabd0a46ef0dde5f5a94bfefa3d1cad47ae133f526844d19dc623aad20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959416, "uuid": "74731e86-f183-4ef5-b77b-1b6f2ef6b029", "comment": "Malware payload (Socks5Systemz)", "value": "c8cc840035cbb6bef239f5647c079fcc6de87d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959416, "uuid": "d2170262-4bfc-4fc0-85ce-15f587a2181f", "comment": "Malware payload (Socks5Systemz)", "value": "84d7688b47b7f61ec89f8e809f55d222a68e82f42e7d5622188130994c7c23a6c9baf75628cf3dff46fcb3e511f159f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959416, "uuid": "54048d0f-b3c5-46f0-8faa-942dd099b04f", "value": "T1973622158B7DED46D28149F4BEA0F6ECE0249E616EBF06036AE37C6ED879F483D19104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959416, "uuid": "d0520c2a-ac35-4f22-b190-f70544afab76", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959416, "uuid": "b3111295-6046-4197-bac8-8d7c88a2e823", "value": "98304:5i/pvA3Q7kfCZwAHUbfc+SAaH7fXgK4ExtEsG6fHXyUcW1f/wCnJV9yyy4Jkw:o/pv0ekf1l477fQox2bOyUL+CJV9ySF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704959416, "uuid": "d6736d22-5ebb-4fab-915b-d8f38600381b", "value": 4874594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704959416, "uuid": "9aca4592-e933-4d6c-b4d5-d7fd83f4ecab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959416, "uuid": "fdb8b803-c58f-4cb3-ab0d-860b16394bfe", "value": "6bf91b07dee48c48359b2f92f72b3e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824fc17b-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978507, "uuid": "39fe13ab-38ff-460e-8568-56f3349c740b", "comment": "Malware payload (Mirai)", "value": "6dfcfde8265da75417129c59f6d0297d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978507, "uuid": "0da05622-99f9-4673-b52c-43616d194537", "comment": "Malware payload (Mirai)", "value": "2515ccfd8d711ed45f684c62c5d3acfbbcbc13fa4e0f851e0656eb2d7ffc781c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978507, "uuid": "a99a6841-d73c-408a-8748-c07fa012d0c2", "comment": "Malware payload (Mirai)", "value": "65b556189559488479996f6a5e7567281ed4c810", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978507, "uuid": "f1ebcdfd-4ee8-4e47-93f6-9f055ca4e7ca", "comment": "Malware payload (Mirai)", "value": "695d1a999f5d7d949a9100de915c80013f7cbdf6226ae47e33d0a9f1d19a39095ec8b171a12d1faf7793a81ae7a82b95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978507, "uuid": "8ef3704f-453f-40f4-b3d5-8a2b761f746a", "value": "T11A14B81E6E228F7DF2A8873047B78E25975D23D627E1D691E1ACC1101F6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978507, "uuid": "28c6aae0-1b81-43ab-8c21-4f143632ea0e", "value": "3072:+BXszvk+gLStJgCMjw6EYTfSau0mCVDYr9MA/xRUgIeEA:+BX0vk+W7w6ALRmDCjPUkEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978507, "uuid": "f4b7be51-67e0-442e-ad10-8b9fd5252dd4", "value": 198840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978507, "uuid": "b20ca950-98b0-4f07-9434-41ce5431e9a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978507, "uuid": "17aa5753-01ed-4e6d-b781-c41a1809e459", "value": "skyljne.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f5039c-b08b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704982301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982301, "uuid": "861f79c0-e876-4509-94a1-bbcb7a2eb0af", "comment": "Malware payload (AgentTesla)", "value": "e5e28942c9bfd5d8493ff3af44e323dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982301, "uuid": "c3043c2b-d079-40e6-9574-209ee7dbec14", "comment": "Malware payload (AgentTesla)", "value": "26680ffe5ffede770697186e8107ec7251f50414502e4574d39bee3cb67f156d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982301, "uuid": "af292d8b-99cc-467c-8e65-375589a87e99", "comment": "Malware payload (AgentTesla)", "value": "d7066b759ad4552a287ecaf8fe43bd767181980b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982301, "uuid": "07918007-74d3-49e3-8382-cca9a598b2f3", "comment": "Malware payload (AgentTesla)", "value": "52acf679650d976c84dff2dbbf2ede2c1239c6ebf66a665b896aba6373c63acc61963739c41c0f9c934d2af741502de5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982301, "uuid": "cd8df706-adc8-4feb-9259-71b9d36e87b4", "value": "T122E4125C1BD89F32D16E137CB05800626375E603B293E3AD4FE2A1E96C67BD14E15E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982301, "uuid": "f64fd761-ba07-4eb3-8a34-9e268026a570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982301, "uuid": "4b6f88c4-fbd4-41dc-8668-32708059967f", "value": "12288:vkwoIc09rP+F+J6SLTeKNTvgqQLVb+13ysrktZa7ob8NcmFNT/xb/h:8woIc0gF+J6aNTvsUxrktw7o8CWTJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704982301, "uuid": "1bf553a7-55c2-4646-a2d9-f7a7ae9c266b", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704982301, "uuid": "ff4018aa-1719-462e-9c3e-61672c1fecf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982301, "uuid": "3b6d0d09-125a-4a81-8f1c-05c4901d1661", "value": "SWIFT MESAJI 11-01-2024-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3f812e-b06b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1704968831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968831, "uuid": "807c745f-6c0c-422c-9029-9758f9ddf15e", "comment": "Malware payload (VenomRAT)", "value": "5b96beafe91b18688f3a3da85ab1627a", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968831, "uuid": "05636398-626a-44d5-9093-8349bf738f54", "comment": "Malware payload (VenomRAT)", "value": "26d19bf8f5b21152256f078fdd31a2749d85fb05a2bc34ff1de557b54a4dfca4", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968831, "uuid": "866c969c-affb-46ce-baf0-925f4bdd332f", "comment": "Malware payload (VenomRAT)", "value": "dfbaaec2da3f8a159134e3ca975c67c8173333e3", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968831, "uuid": "07a1101e-2b9e-4868-8c08-5e8b51013bfd", "comment": "Malware payload (VenomRAT)", "value": "446d112b2efa66342ed5f7c7a24e2ff559dbf94a2a585938f985487a0ff50e31422d5f2cde876173139f6ec9fc29a8ea", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968831, "uuid": "6eb037ba-69b8-4012-96fc-6926f7adfcb2", "value": "T10252F7B42AA735B27294CE735B83FC252E510979BD94757D31E0C39EBE24CC0A864ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968831, "uuid": "dd87740d-c02b-4d1e-904f-e378c185c8e3", "value": "192:bLFvTGXtjimDiBVi1ci6xoOHWGkxUxQxMux9x99T8Eu7m:bLxsHAfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968831, "uuid": "a813320a-a0fe-4230-8c38-ea6ad7bdd089", "value": 13397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968831, "uuid": "edfaa610-4a07-487f-b148-14ac84b2dd71", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968831, "uuid": "60eeff8e-c2f9-43d7-af40-cf5d439e7676", "value": "ppt1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021669ce-b06c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1704968843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968843, "uuid": "6aa312ca-8e0f-4af3-9826-78168694b773", "comment": "Malware payload (VenomRAT)", "value": "f57918785e7cd4f430555e6efb00ff0f", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968843, "uuid": "b0d78e67-5c69-4caa-8ced-0fed5fa77520", "comment": "Malware payload (VenomRAT)", "value": "27ec0c704261af619ce67a04c2f71b34e5c74110970b555208afb4aa65b4a723", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968843, "uuid": "a68a55f1-aa8e-41c2-8f28-647c8e373b62", "comment": "Malware payload (VenomRAT)", "value": "32250ccd91feb4af14012417f087a06606c7f509", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968843, "uuid": "8a78bcc2-bf98-4577-9682-30ba61c02a1a", "comment": "Malware payload (VenomRAT)", "value": "50bfb43530b687b9a230c36d5c6f03aa3e2c1c079cfe387c10086a611be481eb1793c89f60e1a66a46f92d6e2dd23209", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968843, "uuid": "0be877b7-a48e-468f-b39d-84b59e1ff722", "value": "T12342C2A95FF9543CE6E74F8242E7607CBA29DC020A0639C185E766ED1965BC42BC38DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968843, "uuid": "c1376eae-ff0f-4a0e-b1b1-d85d31b87d17", "value": "96:UBdYhJgry+RpVW4aHYYFXYtSYmYoPlp3JYgXGuJYWCpDYsZYs9:UXVc2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968843, "uuid": "5984b18e-4b5d-4f6e-a5b4-6a9252444c09", "value": 13104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968843, "uuid": "943e50da-6fd7-432a-84ee-5ed2a0753c19", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968843, "uuid": "a0760be5-a1f4-4533-a3e3-2229d5a03013", "value": "docx1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfc6d08-b06b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704968809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968809, "uuid": "1468f396-f5a9-471a-aaee-e9c5e3bc9106", "comment": "Malware payload", "value": "335b8d0ffa6dffa06bce23b5ad0cf9d6", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968809, "uuid": "89f54d40-c59b-4381-bda3-d188aec53114", "comment": "Malware payload", "value": "2aa569b95d506b163ce498b9bb864a28b560029c574b1abd4558016d26a0093d", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968809, "uuid": "cda8847a-571c-4ea8-994d-91005d8fdb2e", "comment": "Malware payload", "value": "71b7b47b7fd2f562f742951b5aa38f4cb1222d32", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968809, "uuid": "93d80bee-5957-46a6-991a-f2a0ab938bf2", "comment": "Malware payload", "value": "618e8ab6737c4a3d60d581c0db35518b01019a986a20d213e9ba07e7ea2af459e5bcc99c2443cf4eaca3cf039f9e2a75", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968809, "uuid": "7c8973c3-88c7-432c-8056-68a7d674eb15", "value": "T14E643A282DEB502AB173EFAA8AD474D7DD1EB7B33B07645910A103864713E82EDD253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968809, "uuid": "6334707e-d5c3-4c7a-b887-e9c8d6162ead", "value": "6144:Mj3tjZpb80eFKY5bEqrYTEUqILFmb2TUzpCMr:Y9jZpb80PY5bEqMTKILFK2gzpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968809, "uuid": "3a8f7679-4ea4-499d-ade9-e715c6937030", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968809, "uuid": "6b6c7562-278c-4d33-8b89-fab38f9730ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968809, "uuid": "45433c68-4f3b-4f23-927a-ff04f11c1229", "value": "adb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340f81c4-b072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704971504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971504, "uuid": "d17f53d2-de23-4273-b0c3-b8c0ec6c9469", "comment": "Malware payload (AgentTesla)", "value": "6cb81f021b5d726a369b97b3e3318de7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971504, "uuid": "f1c7ab93-d0cd-4a34-9504-8c58f683e7ba", "comment": "Malware payload (AgentTesla)", "value": "2bf67ccbf4e114d641eaa81a07ccf19e248ab9008d2c3d77a5be1ce937dd0e92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971504, "uuid": "4cea505e-0ac5-49cf-9cff-149fec38e3de", "comment": "Malware payload (AgentTesla)", "value": "046558d79dd88ce70240a780be82ba81ddbe43dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971504, "uuid": "350a78ef-d142-40c3-9af0-63062396ef7d", "comment": "Malware payload (AgentTesla)", "value": "196b16a2bfeb55fd5d33120ac9db8ef334659d81601f6b3e9414e31a2fe23402a19490dbb9c5871dfff73a4c03b0c289", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971504, "uuid": "7efc1984-348d-4029-ad20-17b732f6eb75", "value": "T1AA05D015A2F91F59D07A67F482A8160103B77A9A6137E34D2DC9E0D73F72B020E17B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971504, "uuid": "c5fb9107-290a-45ab-8845-3e96fdb4c16a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971504, "uuid": "074d415f-c59e-4c24-88a0-92614d7d493d", "value": "12288:hfYNr4RjCRxP45+po2TJoIzmYrYXQX4H9V9ZNquBdo1bToXtOZE5gIPWaAEvSrG:oRk+pJTJoIxrCQoHLDXoBo9LS4AEvSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971504, "uuid": "d86c2dd5-32e1-4120-9ac9-f29d51ce5fe2", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971504, "uuid": "ff75209d-907b-49ba-84b6-6c5ef56f6330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971504, "uuid": "d115818a-50c4-4391-844f-d6b75d054713", "value": "2bf67ccbf4e114d641eaa81a07ccf19e248ab9008d2c3d77a5be1ce937dd0e92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689a2a55-b081-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704978034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978034, "uuid": "f2e69518-1208-46e5-af1b-d8cbd4b3c58b", "comment": "Malware payload (AgentTesla)", "value": "b85ce469aaa9172dbb48de3a9146360e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978034, "uuid": "d75d38aa-7ce4-4912-97d4-a51192801893", "comment": "Malware payload (AgentTesla)", "value": "2d4e78ac81b6f5f1c75db900ac1bd0f2dbd22918808694977565b6bf436d827d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978034, "uuid": "f576d3ca-29e3-4ebb-9b4e-2dc736014628", "comment": "Malware payload (AgentTesla)", "value": "0c7b828082aba36cda6a8a71dedd48ced45599d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978034, "uuid": "0eb38f70-13eb-4764-97af-a7f0ea69462f", "comment": "Malware payload (AgentTesla)", "value": "176d8cb89ab3236e28e53580e0ae411baab9ff30663c323c27a4dcad53ab31199047a34c5c22c7dbac96f99d1e503c22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978034, "uuid": "fd5a1f57-7b5b-4a9b-bd49-cb0876bd74b0", "value": "T11B0522697174AB3ED83A43F4C93A218443B2BD3A3A61E20E6DC731DE1471B426D51BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978034, "uuid": "9c56a1d7-169f-46ba-875b-b38396ed902a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978034, "uuid": "6efb6664-9632-4af2-a60c-4426029d5583", "value": "12288:9WpbtW8G34/uK45+po2VmuHEEA4vnM6Zz+E7SAlVPpXPR3OknnIkzSmNunG:N34/up+pJUuxA4v5zf/HBXPR3XnXumN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978034, "uuid": "926cfd7b-5ae7-49e2-a4bd-c5a93205acf2", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978034, "uuid": "01d34199-e5a7-4039-9642-e6bda553c04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978034, "uuid": "1c9b9785-ab25-4d57-90d9-92b35482e293", "value": "2d4e78ac81b6f5f1c75db900ac1bd0f2dbd22918808694977565b6bf436d827d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928cabe3-b081-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704978105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978105, "uuid": "739cc427-5701-40bd-8702-be70f3070f4a", "comment": "Malware payload (AgentTesla)", "value": "4d52ebbb40c58cabc7d4571855935d70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978105, "uuid": "9911b577-6cb9-4b1f-9742-c87bd0713fdc", "comment": "Malware payload (AgentTesla)", "value": "2d9a0704386d3f8838cb40d5f22952c2708e98cb9e359e0c3e106b617c26de64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978105, "uuid": "e53d94b2-2ab2-4e70-bdf1-31ef66244c78", "comment": "Malware payload (AgentTesla)", "value": "1d81f8c7c90f0381f5d096efe6fb2926e598af5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978105, "uuid": "47eff190-b65c-4948-9049-e13e976b6a7e", "comment": "Malware payload (AgentTesla)", "value": "b93fea66576f9b9ceec017a0cc62b72d01983a3bbef270a2eaf6f6f7a2e9dea5e779c4b999e761f624d4bad4549c675b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978105, "uuid": "2c04730c-8cf6-4fff-9569-910f51f336c6", "value": "T104D423C7339E871BC6BF1FFB562CA6C05A952A53BA45C7182DC030E61709F960EA01B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978105, "uuid": "5d36c0f9-0c29-462e-b8a2-bb5dc11c1f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978105, "uuid": "78ccff87-5bf9-4b0b-b2ad-e22c7812c61c", "value": "12288:kJ45+po2Toa8W5FQlCJeazX9Cwjajn8OXdyPWJzPG3JHJACu1Y:kU+pJTo1W57J9tCwInv4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978105, "uuid": "3c4a90e4-9a42-4056-bfe8-dc4b1b40e787", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978105, "uuid": "c9ebb03b-d141-4496-add2-686518d51d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978105, "uuid": "14e396a9-0231-445a-a68b-9708c77b35ef", "value": "2d9a0704386d3f8838cb40d5f22952c2708e98cb9e359e0c3e106b617c26de64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52ebd7b-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704978646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978646, "uuid": "b85f6864-7c4d-44ba-8f46-33d892a8da2a", "comment": "Malware payload", "value": "7eb89697126c383db773a6c2adafe4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978646, "uuid": "ec672e8f-d482-44a8-8064-954f6602a657", "comment": "Malware payload", "value": "323d242e0f3fd2288e5f4e13d64a9bbd91af3bb64b9ada1522ab6a4ca44cfc8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978646, "uuid": "ca2be141-0022-43ca-929d-5dd13bf051ca", "comment": "Malware payload", "value": "efd29387e76d2194b2f772ee7a248866afcbea1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978646, "uuid": "741ad54f-7c20-4bd9-99ab-bfe84cadee97", "comment": "Malware payload", "value": "ac13cc6b6c45017f3ad306f1fbd4310efe12d9347bb867b00b0bf33ae98031d69364f1b47b35f2df96c482b429fd799e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978646, "uuid": "f72bbcdc-99ea-4c92-99bc-b99288e94816", "value": "T1A5650227EF514102D36F05B18C3A25AB2A1A2D296011FEC76FD16E572677B03F86D22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978646, "uuid": "db063107-90bb-483f-bae7-a6ae250ee3c4", "value": "882495a5d0b0b3c570b0ca2487cda1f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978646, "uuid": "25e2f42a-c33c-4d67-a2f3-6529be0cacec", "value": "24576:xM+7ERpFdzZLBGI/peoRU86xKF5XdOawPij5M:xLQB7LRUM54wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978646, "uuid": "7c234a37-2b81-4ad9-ba90-253c5bda872c", "value": 1418635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978646, "uuid": "d160f3f8-a3c7-4326-bbe7-b4ed60b4aa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978646, "uuid": "cad697a8-95e9-4662-80a5-c9a6c6614021", "value": "323d242e0f3fd2288e5f4e13d64a9bbd91af3bb64b9ada1522ab6a4ca44cfc8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda7cf37-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704980405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980405, "uuid": "aad969ff-0524-4e1e-b159-fc5d0b77e588", "comment": "Malware payload (RiseProStealer)", "value": "49947cddfb3a76f719945b5e1115d999", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980405, "uuid": "03477ef5-c4c3-414d-adaf-0708496197ca", "comment": "Malware payload (RiseProStealer)", "value": "34651d44c15017bddd3fe67dfade46637267be4f3ec660797432f0e23f9b7fab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980405, "uuid": "936bc093-32ef-4cef-b86a-f08f83ca7d68", "comment": "Malware payload (RiseProStealer)", "value": "f25d70ce2ad3133da16aa531e3435087b2fd9b0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980405, "uuid": "de01011b-e741-417d-b8f3-6c7507bdd406", "comment": "Malware payload (RiseProStealer)", "value": "fce11d4485d0e475669aa6a543e8af023dba67640f9654eb2415952343134c3c3230313d8df5ddf7f40f32af9de03644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980405, "uuid": "446bb867-1eef-43f1-a6e8-c802acd7f979", "value": "T1EF3633B26BCC62B4EA7575B007E9A5C30F283C5D3221B73F276CB84714B9A7D5245B28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980405, "uuid": "26305952-f4d7-48e9-8028-94b6ccbf8fa6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980405, "uuid": "3ee29454-47c4-424d-92ed-4143cd11388a", "value": "98304:jd2Y83YbfG1Nv//2oc9r11/ncU5FWEiJ1MujzenUQEDlS+nQfvPdiHxkbm:IN3Yfuk99Z1/ncYFWEiJ1MujCUQE8+Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980405, "uuid": "19628445-1791-4451-8baf-660884b03313", "value": 5209600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980405, "uuid": "03f7cd78-d679-4fee-96af-817b5ba21798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980405, "uuid": "db9f5e7b-e773-4090-b352-f386a3fa4075", "value": "49947cddfb3a76f719945b5e1115d999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dfdf83-b07c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (FlawedAmmyy)", "timestamp": 1704976037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976037, "uuid": "9aa85385-808d-412c-93a9-9a3ee71944f8", "comment": "Malware payload (FlawedAmmyy)", "value": "45c9b54d66cbcc2de89f93e25f368a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976037, "uuid": "5dc5b3b4-825c-445f-9059-4120e20b4967", "comment": "Malware payload (FlawedAmmyy)", "value": "349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976037, "uuid": "8a4baf74-ffda-4dbc-b497-05eb80981733", "comment": "Malware payload (FlawedAmmyy)", "value": "2e5265f35f75a50c89e592e127bc80e1e45aa840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976037, "uuid": "8508c395-1027-4bba-a206-56fa8927c6ca", "comment": "Malware payload (FlawedAmmyy)", "value": "d99aa1804b9de35cb4e9c802d5a53ce29fa92f8c53984ba8091bec3b43dd3b85d73073b01cb07b914a5b67e33767cabd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976037, "uuid": "686b3b43-57ea-42da-a20e-3947f772de49", "value": "T14CF4AD133985807FC17206308A9A6B76EAF5BE540E3789476388BB2C5E79D219F1733D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976037, "uuid": "cccf8893-d61b-49aa-87c8-ae528f853945", "value": "8149c98dc17f65cb4fd5d4364b186c96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976037, "uuid": "0e0be39f-e7c7-483c-9161-78b5ac5fd480", "value": "12288:x2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hEgK:xSIp2Ydd6SVcpz1RtXpGadsbShK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976037, "uuid": "e4f7efe4-1d01-4960-ae4a-169f4b8ed307", "value": 739608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976037, "uuid": "a9285dfb-593c-46f9-a33d-54759bc2c81f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976037, "uuid": "81c55204-ed8d-433e-ad0f-12c54af9934b", "value": "AA_v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24897ffd-b088-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Hydra)", "timestamp": 1704980927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980927, "uuid": "dcb09335-87dd-44fb-ab5b-d60b87311dd4", "comment": "Malware payload (Hydra)", "value": "5ce09da6be4926aa0af6c01494dd0e5d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980927, "uuid": "86eb1134-896d-4dc4-aff1-e74c661199ce", "comment": "Malware payload (Hydra)", "value": "3779e67d696ba3ef4ba4b38ba10e07301620a45f1d89f004da5ae64f050dfdb4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980927, "uuid": "981061d2-711e-411b-aaf2-f391c57de52a", "comment": "Malware payload (Hydra)", "value": "3b69e62474a99e2fd1e657ac1732665ded099e75", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980927, "uuid": "7d8fae42-4d6e-4ecf-967d-7d15b1fa7165", "comment": "Malware payload (Hydra)", "value": "3224961d9a72a82524a86f828dec61795fb7e762cd48e16b6fd1f68f2db1ebb7fd3038977621a32be7f7377a6e334f56", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980927, "uuid": "ce78f43d-ed89-4636-bdd2-2394af07c712", "value": "T17C3523407698DA86DC7C43768F23C58B08317CA49E85A5D3B50DB3DDAAB3BC80B9E5C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980927, "uuid": "ff9c1f40-e319-479d-8d3d-5e9f1a8aad04", "value": "24576:Loh9dcs4YEVrRDtqdgTpztsjppsZbBMt4NoMmFManUEjd:OdZs/8dgTBs/0MqC+jEjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980927, "uuid": "81629ab4-b6a1-4020-ab63-58d01512a1ab", "value": 1125650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980927, "uuid": "66f167f7-648e-41db-a218-89e223749e92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980927, "uuid": "6af49c22-6ac5-411b-8d19-3d5705d8b54b", "value": "commerzbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2ba220-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704980399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980399, "uuid": "5d147182-4c86-41f6-bd6d-8c2ca01988b8", "comment": "Malware payload (Mirai)", "value": "a51eba502d044f50517ff4c757aa2044", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980399, "uuid": "1f99fd1a-0414-4e1a-a533-f3df15e7bd68", "comment": "Malware payload (Mirai)", "value": "380b12f89099b7a7e0c05dc14f9db96064b48572c64a9fc03e6b688ae4cd05d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980399, "uuid": "bb15d040-b504-4b10-93f5-bb4bc6100575", "comment": "Malware payload (Mirai)", "value": "48060edc6104a7e4320aa8a00e292bf8b2113542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980399, "uuid": "a17d9c5c-4590-4bea-9fad-443f79bbe1a4", "comment": "Malware payload (Mirai)", "value": "339ceebac42bab652bbe833f5ffb56e71f4a6c325041701945c5b2efdd588f7689a8248bee490ae3e23d309643a7d7c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980399, "uuid": "9df5c905-24c1-4777-adb1-659914a471f9", "value": "T165E33906B31D0B47D1632EB03E3F6BE093AF9AD121E4F640255FAA8A9271D335546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980399, "uuid": "54635ab1-7749-489d-8075-7c77d2f89f57", "value": "1536:Sj1NoxILLmJ0imRaxp4vYRphlHJJX43PrCfavAmWWOlJck8qWz+4QTO1Il1dzEKu:20SRaxmAlpXcremRQTgI+pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980399, "uuid": "80693a65-9775-4d18-ac19-9ffba1611c03", "value": 153148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980399, "uuid": "4277fa94-9936-4aa0-89bc-d6c245e6d5c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980399, "uuid": "1060b693-fc99-40c0-ab92-4c2a8bc61c6f", "value": "a51eba502d044f50517ff4c757aa2044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73572f19-b076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1704973328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973328, "uuid": "d5bbf979-546c-437e-b996-dcfdb21f9229", "comment": "Malware payload (RemcosRAT)", "value": "04e18fd343fc78769f0518e3d8bc989c", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remcos RAT RAR PWD Autoit WSH", "colour": "#5972C4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973328, "uuid": "f0c74299-738c-4720-a3b2-482d0e059991", "comment": "Malware payload (RemcosRAT)", "value": "3830e8249b95e86065288cb7a00ee9139d9e2fd918ff9c7e427e8684c1481579", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remcos RAT RAR PWD Autoit WSH", "colour": "#5972C4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973328, "uuid": "327dfe48-f79b-48c4-bfb1-cd39fd03dc02", "comment": "Malware payload (RemcosRAT)", "value": "ba072d27d14538c79af5df27a9328002afad5436", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remcos RAT RAR PWD Autoit WSH", "colour": "#5972C4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973328, "uuid": "fb2e61e2-72d3-44c5-a670-9fccb99961c4", "comment": "Malware payload (RemcosRAT)", "value": "abc0f5b6295c636f2a2f77f13c139df52b20f0573b68416c2e6ebde1009a5f5654fe134f7c5839c3c1f29ae1dc5fc1c2", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "remcos RAT RAR PWD Autoit WSH", "colour": "#5972C4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973328, "uuid": "49d0360d-1305-48cc-ba7f-c1dd31e2e750", "value": "T1527533B1DA1346F1FA9A907B704D9953A720DC741B30E21BE6CC46A358DDE6536230EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973328, "uuid": "ecfc17b6-a5ed-4306-8b36-a383e7f9fb81", "value": "94d9227f448338db4ec1daba801cc426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973328, "uuid": "24de399a-cf74-4d9d-9b5e-3cc5986ba42f", "value": "49152:NoP4egvpQd/xGVKGpNJ5GfgogapBecJJa1jO:NPegBQlAVPpS3p8cJ41jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704973328, "uuid": "298f837d-688d-45b5-8f8f-2e4cb14a234f", "value": 1591664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704973328, "uuid": "046bfeee-2def-459b-8561-5562e3cff7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973328, "uuid": "9bbd71ae-b117-4936-bd7b-416568856315", "value": "\u0415\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0430 \u043f\u043e\u0437\u043e\u0432\u043d\u0430 \u0432\u0438\u043c\u043e\u0433\u0430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759edb7b-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978486, "uuid": "654e16bc-caa6-487a-965e-20894f5bce1f", "comment": "Malware payload (Mirai)", "value": "46bcd255a9f018eaf4cbe2c9e520dbed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978486, "uuid": "873ec84a-0a69-41ab-a447-b814e8f13670", "comment": "Malware payload (Mirai)", "value": "38efe69f9db4ba93e17980885545a274023b1240b90d9ee9ec08fa162de4e31c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978486, "uuid": "1b9d9109-caf2-40c5-93b1-f4a10240708e", "comment": "Malware payload (Mirai)", "value": "16e71aa46624bdc400135896ac8de8667b7b501b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978486, "uuid": "25deede8-8593-42fa-a89c-e76fb685e004", "comment": "Malware payload (Mirai)", "value": "f661097411e2542f4d42b56c7afb5d0d177a8d5e8b5b6ac2e0ebf44f8116d309386cdfe2ee9091b213b61b30c54fce5a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978486, "uuid": "fccf701e-c3a4-447a-84f1-4a9e540e9882", "value": "T1D2F31956B8819F11C5D311BAFE1E028E37131B78E3DE72029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978486, "uuid": "48f8c26f-2b8e-4d9e-a14b-b121b8ab7612", "value": "3072:NR/loiHSDQAS7U8QVATXN77fYhaYhasH8YCHt/6NgIw60:f/UI7nrTXN7fkahW2t/6Ne60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978486, "uuid": "0a24c1f4-3de3-413d-8904-ee4a8b352f19", "value": 164892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978486, "uuid": "9ad265c4-fe7c-44ee-9cdf-4510dbba3392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978486, "uuid": "ab566314-950d-4988-9a1a-c3c03fba999b", "value": "skyljne.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41040e54-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704978397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978397, "uuid": "e346a133-c647-4637-859e-d3c743206430", "comment": "Malware payload (GuLoader)", "value": "2b096330de98323d0e5e71af3620e22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978397, "uuid": "a8f14147-549d-49a1-9a90-7b57357c77b9", "comment": "Malware payload (GuLoader)", "value": "396a6b2f82a81fc2009611d69541bc39c7184dff470726e2b583575e593e649a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978397, "uuid": "1fd38629-3bc7-44c9-9173-7e51cd70a7c4", "comment": "Malware payload (GuLoader)", "value": "b9f05e628ebc000976ff42736c9fc0ad03422591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978397, "uuid": "08faa625-03d5-49bd-8426-9894a161ec05", "comment": "Malware payload (GuLoader)", "value": "c8e0d8baec1b5490e95cc06b3297a7d53cd31f0068796e622d9436ea50edbdb1613d7ab4eb1d696a773cee205ffbd256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978397, "uuid": "e8fedbfd-f687-44e7-bfd7-56929d7279a3", "value": "T107E401025E43424BE62677740619F79AD261AFC0B4B3DBDBAB1136439D76302BD3A1F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978397, "uuid": "1b80e8e3-ab31-479f-b908-efe0bf51c4ba", "value": "93dfc16ed07ebeb5b405221f10d12c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978397, "uuid": "47164f51-14c5-479b-9415-90a8e9ee848c", "value": "12288:v64+Eqi7duYDWcL6TjUhbeSufP0cGiLltj64p3p8zMEWymXHazwGN:S4n7Y0W06TjUhduXnjJ2Du6zwGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978397, "uuid": "99cdee26-a0bf-4893-9951-f4207e906a30", "value": 695208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978397, "uuid": "e7db1140-2cef-411f-b93a-171053a7f692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978397, "uuid": "a4f4e55c-e114-4c16-8716-81127e46dd3a", "value": "396a6b2f82a81fc2009611d69541bc39c7184dff470726e2b583575e593e649a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3db953-b072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704971435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971435, "uuid": "51f9908d-107f-4cd2-a51a-e584289f6d36", "comment": "Malware payload (Formbook)", "value": "c169e1f817ab1c2597390c60cd74d7d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971435, "uuid": "04db0f7b-a358-4759-9eab-7214ca942137", "comment": "Malware payload (Formbook)", "value": "39ee34923fc77f5cacd1210dd87e95c101cfb53b947de24da39f82152afa0f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971435, "uuid": "76b5cda3-64ff-47cc-a418-68ed7a9811fc", "comment": "Malware payload (Formbook)", "value": "01d570b7e56e2d725e186956321c13d62fbca565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971435, "uuid": "c9c9ec61-c927-45a5-981e-723b7575f867", "comment": "Malware payload (Formbook)", "value": "cba91cf4f5442d352c1fb358d31ef61720e4670df44aa3a62c833868814e7b9399933f9372d418b4de26a94c944c9ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971435, "uuid": "252341d3-926c-4fed-8fd4-0ce8a9db9910", "value": "T17AF4121472DCAB46E8BA83FA0961910057F6BC3B0176D72C2CD2B1CF1776F608A65B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971435, "uuid": "c268deca-3bba-475a-97bb-a5642fb3e35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971435, "uuid": "0372dd16-a6f4-489a-b053-36596d9e33ed", "value": "12288:M3KE6jD/62iNG5nF8cnEOxtjr7ANDiGN+Y7n5bu2uxnvU3kjGa2dNk1/VPO6:M3KtD/61IXEOXkNVYK3kia28g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971435, "uuid": "f1da41bd-44a8-43eb-aca7-eaa5de87d4f7", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971435, "uuid": "9e87908b-558a-4885-971f-09ee3c2f1ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971435, "uuid": "384d9dd5-796b-4753-91c0-416bbb977fbd", "value": "39ee34923fc77f5cacd1210dd87e95c101cfb53b947de24da39f82152afa0f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700c2d40-b0c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705006823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705006823, "uuid": "06fca69d-1afb-46eb-bddb-dd8b3c48becd", "comment": "Malware payload (DCRat)", "value": "675295aa463ff9e51cb5e2a3da365333", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705006823, "uuid": "3376a522-dc6d-46f2-b4b0-3153c125c6c9", "comment": "Malware payload (DCRat)", "value": "3dc8f409caf68fa64a87698436f80ab9733c4842ed5f36ba3ada63f2e94057cf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705006823, "uuid": "41cde6b8-52f2-4bd5-bb3c-0997aa3b1232", "comment": "Malware payload (DCRat)", "value": "e099c1031bf86c5dbf13eac0e2ae6d308a291862", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705006823, "uuid": "9ee0d822-e22a-4c0d-b74b-c433ae7e246f", "comment": "Malware payload (DCRat)", "value": "91ae038ddf790135110b33a5cfaf38dc5b8e023ffe804c0ffa10f9aa4bc07571b4bad37e44d3ce51f1245208ce3827a8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705006823, "uuid": "673e1820-dc24-43ca-825b-f3f8bad6adb1", "value": "T13F95AD066D624E36C2A53F7194D7061D82F1D6677612FF0B3A1F61D3A85A230DE232FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705006823, "uuid": "24be419c-ce7b-4e63-a481-e2dafa5e8971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705006823, "uuid": "0676bdc8-f317-41d9-894d-6118d5008af8", "value": "24576:dw12JAVHz6C8PnSothVFC3e39dEcOulJXEcsmWCOb+c1wD6s6IwdhFJ+zZvmHGM:dcxzwSoTn3AczJXZsDb+c1w9wdl+zZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705006823, "uuid": "1b6a4d43-6e08-4751-8184-0b839c61657d", "value": 1936896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705006823, "uuid": "234f87ec-b966-4f48-83ca-25fa57b3f6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705006823, "uuid": "58d4adfb-f2a0-4288-8a4d-373a1f469426", "value": "675295AA463FF9E51CB5E2A3DA365333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b517759-b04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1704955356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955356, "uuid": "cc3fdee7-428f-4753-bbc2-103469a37df9", "comment": "Malware payload (Meterpreter)", "value": "e50914ae0bf75b279caaf65ac3a9d222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955356, "uuid": "a3970e78-2451-4888-8fdb-17c2d3ee9301", "comment": "Malware payload (Meterpreter)", "value": "3debd2ceefd8c64031ca66c3bc7165bfde2eee638c67a307642d7c6b8d9ce8ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955356, "uuid": "67c63602-3e29-49cb-a29f-7b3c65826a59", "comment": "Malware payload (Meterpreter)", "value": "be8a331627816bc0da922c7f506dab4530d0e962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955356, "uuid": "f9653509-49b0-46c7-aa2a-618ea8b62961", "comment": "Malware payload (Meterpreter)", "value": "34226b71fdc1b8d2d711883d5847d5e636eb5b0fe021653ba17cff4a9dd1187bc0b1edc553436ddec1cf41506c38697d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955356, "uuid": "7b5576b9-fbcf-4d89-9a9d-f4cee549a761", "value": "T16873BE82D6C42432D562127D26753BB65971F5FA3241C2CA3A8CCDF1EFD19B0666A3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955356, "uuid": "b411b573-4e6b-4eff-b235-74f59e56c58d", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955356, "uuid": "ee457110-ed57-49e1-ae19-79b27a1aa329", "value": "1536:IDKtviSbF+ruQk20+JTF8F3hvBF/JMb+KR0Nc8QsJq39:V1bcuQk20/LBJe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704955356, "uuid": "bdbb71e3-0d6d-45ec-b527-81c121c30968", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704955356, "uuid": "df414d93-3323-4934-a489-32b4eb6f03ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955356, "uuid": "79ca4e39-dfaa-4753-bd3b-d8776aacbf59", "value": "shell32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3590d48a-b07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704976660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976660, "uuid": "ab991b60-5e76-4ab4-a120-32bc0aaafa88", "comment": "Malware payload (AgentTesla)", "value": "9b7d6af82839a0d76fe9faa577a0f618", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976660, "uuid": "a1fbe3aa-fbf2-48fc-82af-725a4f0ef27d", "comment": "Malware payload (AgentTesla)", "value": "3fbf742d2ceab5970c771a4543e88de717140976fbf857b900b01884d55ae872", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976660, "uuid": "c95307b6-bd71-424c-bce5-675eed733c75", "comment": "Malware payload (AgentTesla)", "value": "834712bf8f831d2245e0b5ec9fa874f02a96722d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976660, "uuid": "40d1ff38-c5f9-4240-a1c6-c97e781a96a0", "comment": "Malware payload (AgentTesla)", "value": "aedc4db300b9c3699194f82962b50d43041e9325d02f3a67db9a9fbcbe7d9feb81fe06faa0de8b94e466db93f4199929", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976660, "uuid": "61fc9aee-bb6c-4336-bb51-8e532cb68b85", "value": "T1CE45A12B5FAF41E6FC6FC6B7CAD4DC17B04098EB3811D92455B36F5DD232A42248226E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976660, "uuid": "024330ee-cfaf-4ee0-beb5-0c8123817e6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976660, "uuid": "286bc69c-c70a-4795-bd3f-042b7f89e6a9", "value": "12288:qq86iMDXUVUa/HSHGN6aa3nZJSjmZcLVcxj7+HaszXgzGQiC0xl:mM4PVNza3nZXscx+6DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976660, "uuid": "015024db-ab0d-448b-b9f0-09a9638d823d", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976660, "uuid": "f241683f-df4a-46b9-a39a-2d41dc343fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976660, "uuid": "4b1764f6-d1a0-4ce3-90c1-6ce8ba76cf3f", "value": "3fbf742d2ceab5970c771a4543e88de717140976fbf857b900b01884d55ae872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b599bfc8-b079-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Phobos)", "timestamp": 1704974727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974727, "uuid": "8ecc1784-25d7-4bd1-b612-0156bb431b98", "comment": "Malware payload (Phobos)", "value": "dc2d809e46c60ee990844ee7fbdc17cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974727, "uuid": "92f90350-c7b0-4eb1-b63e-431f51f944cc", "comment": "Malware payload (Phobos)", "value": "41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974727, "uuid": "9e15d0be-518a-420e-b045-079814fd5ec5", "comment": "Malware payload (Phobos)", "value": "839ce9c0e3cab37d4de0b25460d9b0dc047bb2ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974727, "uuid": "741ddf73-cd34-4361-bf2d-f28b7fd6e374", "comment": "Malware payload (Phobos)", "value": "93b1dee7b68f266cf67296f70ab4f9cc29810da8a2ae69a19538d6de8586ac4edd9489f34dcfe1f2ed74cf5762de0b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974727, "uuid": "60348765-847d-4563-ada0-63ce8a93b950", "value": "T1EF43BF0A742D40B2CDB18670193B6F5F9FBF640554B4485B8F391E8A3ED1076E72A3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974727, "uuid": "f43bff48-5023-4085-8c2a-1954d2ddf102", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974727, "uuid": "ac90ef07-8d3f-4059-927c-bcbc86c0aae0", "value": "1536:UNeRBl5PT/rx1mzwRMSTdLpJPQG9TY28U:UQRrmzwR5Jop28U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704974727, "uuid": "01163358-46db-4a19-bb14-d82561cfb1aa", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704974727, "uuid": "cdf61a27-618d-4fe5-9b45-51d5b0990699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974727, "uuid": "c20a1f81-8d01-49e9-9e42-b854bfffcfa1", "value": "41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01557e8-b023-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704937889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704937889, "uuid": "ccf9db64-3cca-41bc-b560-cbaa21d29358", "comment": "Malware payload", "value": "6f74d543369c602f324b8a297e6754d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704937889, "uuid": "7922be3c-4b18-4917-ad6f-fa6fd3d7a3aa", "comment": "Malware payload", "value": "447656e07d6d1d6fb418d284c5667445e92a7953e2529a28e1c23d597ce148da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704937889, "uuid": "d25218d1-53af-442f-bc0c-1aed4b3d65d8", "comment": "Malware payload", "value": "0c8657d0f5acef637c133b1103d20442115b92bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704937889, "uuid": "b8e66785-8417-46bc-9c5c-f3c7cde45a2a", "comment": "Malware payload", "value": "e372602894218d899d70701974347855e109642a248150531dc797fa126dd6162468ed73f12c016b84b40f6c64664ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704937889, "uuid": "6aafec05-fb45-4500-bd6a-98dee4367791", "value": "T11044AE1171F58436F7F76A7A9970C3A44E7B78677831998E1AC506B90F257E2CE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704937889, "uuid": "cc11b2e8-8451-4ea9-a3b8-6fb4cf6cb4c8", "value": "7e32959e1e010773874596cbc1a01e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704937889, "uuid": "e95e1fce-ee31-4247-964d-146bec7010b0", "value": "3072:yQPxxFO3tJiXTDLFLhipOBieg1EcM33nkQJVmV6406hO8q/YfOx//kup2R5rAF3j:txFO3eRUABfg4nju66c8qQfOGVrA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704937889, "uuid": "1a99008a-337d-4224-9cc6-486ca96e4e43", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704937889, "uuid": "8c7dcb16-5ed7-4f21-96b6-49474932b2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704937889, "uuid": "facba14a-810b-4567-ba3d-9ca52918a662", "value": "6f74d543369c602f324b8a297e6754d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b502b5-b025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704938710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938710, "uuid": "880cb015-290e-4249-afe4-42f8897c6b0b", "comment": "Malware payload (Socks5Systemz)", "value": "6d0f48e2159943dfe9112af24bc23e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938710, "uuid": "63e1c2c2-7536-46d2-8479-3009a237124c", "comment": "Malware payload (Socks5Systemz)", "value": "48f9310ae3bd7b1b5ac53aad0ede4db7c136193369d4d2c58cec0f05ddddf84f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938710, "uuid": "d11b6bd2-b7f1-430f-a0e3-b5afb833d9f7", "comment": "Malware payload (Socks5Systemz)", "value": "ac34dbfa7a265f9d304549894a4dd58f904b6ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938710, "uuid": "aad077a5-293d-4d6a-98d0-bf26275beca1", "comment": "Malware payload (Socks5Systemz)", "value": "792e93187bb2eb781812fc2c584f0ae8c08e7d47c78d1abce3f49db66fd661436a33aca0fdea912630ba512706f6d6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938710, "uuid": "2e5f14df-8247-4028-8622-7425bb3bffff", "value": "T113263343EBE47526C1E087B6DC9986ACF73973B2D9B0735954D9A81E0B638C1C04B7B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938710, "uuid": "271eaa46-a8f9-4cba-ac82-eb803dc6995d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938710, "uuid": "6067ffd9-56a8-4177-a70b-9b58c464ec44", "value": "98304:Q3AwCn49gw8kHdkG4QShZY2zwTkT5QmzCP+2zB/8tGZzf4dm8:7wCn4ibEd5ismwQtVCPDzB6GZT4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938710, "uuid": "4ffbc73f-7a8f-46b1-b7c0-5121c33fd680", "value": 4698419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938710, "uuid": "c88c9346-4aa4-46d6-b3b8-117303d5cb01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938710, "uuid": "76a93322-917f-4a7f-b1ee-f284d21a6216", "value": "6d0f48e2159943dfe9112af24bc23e18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e10074-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLog)", "timestamp": 1704940338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940338, "uuid": "c431841c-863b-438f-91a4-714af1a5fac3", "comment": "Malware payload (PureLog)", "value": "3f7fe11ad382eda6635fd1a2bcd934a7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940338, "uuid": "75b7b129-889a-498e-b1d9-911d2e3e2716", "comment": "Malware payload (PureLog)", "value": "4acddc15352051552d4684fff6d07d18305cf7276d208adf7e2f59c5a70c909a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940338, "uuid": "1c75b9a5-872e-4cd5-9171-f3e6f749ca1c", "comment": "Malware payload (PureLog)", "value": "e1665ac58c4cb523e0d767ebd8b67c96b43612a1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940338, "uuid": "2f53a6df-c611-4052-949b-eb490bb7b15f", "comment": "Malware payload (PureLog)", "value": "6b15a5303a29a3ec669f8c74c863c7cd1a90696955a2cf4233f6c3c5999eaabda8f6873bc0c53d183bfb8faf8ee8b746", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940338, "uuid": "2caee3df-c9c7-4144-bfaa-ba54fece0a7d", "value": "T16BB5BED9F3B97FD6C18F06F396D89E1D87B1C220D76AE34B274868F44D0A7AA4805853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940338, "uuid": "844f68fc-38ae-4a87-94e2-1a9d246138a5", "value": "49152:ZMKF3jzyVYDKlWvs3nf8wkarDn2VETZPHGIDXuz:ZMiKAvOnf8wka/n2VETZ/bDXuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940338, "uuid": "0eaa8335-a6c2-4384-ab5c-879deff7a8e0", "value": 2492464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940338, "uuid": "57d5fa8a-3a84-42c7-a888-f577e417dc18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940338, "uuid": "8b6732cb-51a5-4e46-9863-a59b24df33c2", "value": "3f7fe11ad382eda6635fd1a2bcd934a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a6d2d8-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704939019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939019, "uuid": "439e35aa-01fd-4258-b7fa-1906843169c4", "comment": "Malware payload (AsyncRAT)", "value": "6b937b9cec12fb4c35f013f1616b2c5f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939019, "uuid": "033ff5cd-af80-49ec-a8b7-c4879daf7dcc", "comment": "Malware payload (AsyncRAT)", "value": "4ae4de137b7769456036f7007236717c9d1e9eb4e80863175ac7709e499141f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939019, "uuid": "0f285bc2-7438-46d5-874b-d855fbc6cdbe", "comment": "Malware payload (AsyncRAT)", "value": "7cf302f45f71fe51baf8037369b85f8b864475b6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939019, "uuid": "d79261f4-fa9e-4954-9a8b-8145d87e7971", "comment": "Malware payload (AsyncRAT)", "value": "0c9e1fd325e8865505d01e6a36594c97ea16e79ab565c8230e1d39c6709ae7793942eab1fa49edd8442ab00a759aabbd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939019, "uuid": "2f8d12bd-fdcc-4c2e-91c8-89f74142384b", "value": "T1FD81082157FA900D7173BFE16FE0BAE68D9AFB722A05A54E1000130A6962AC4CDF7675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939019, "uuid": "0c137ab1-b2f5-491a-ac78-b0fa1e712312", "value": "96:LWUaUtGoSUtGoU2WUwUtGoqqYzUtGoMf8fAqYD:aUaUtoUtaUwUtwDUtOUoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939019, "uuid": "ea349ea0-ccbf-4a69-9091-7cf954459399", "value": 3832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939019, "uuid": "9da6eecc-2fe7-4d8d-9c37-eb59cb327cda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939019, "uuid": "53fbf6e7-60f5-4d45-87c7-5d442001dc54", "value": "statement_report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83da4a0-b07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704977416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977416, "uuid": "7c680912-cee1-4736-b5e6-4ffd8e728e89", "comment": "Malware payload (AgentTesla)", "value": "406165d534ab4b717a48b274eb269801", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977416, "uuid": "7816c3a7-a156-437f-b9f1-9610e1de93f3", "comment": "Malware payload (AgentTesla)", "value": "4b0d7d7932c2361c099955820fefc4636459c3ea3b155746fc04a7193d96e5b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977416, "uuid": "59d8f9a2-24ea-4204-bcfa-81888830d7de", "comment": "Malware payload (AgentTesla)", "value": "19715662668e29937e6f771b9caf2e209a75b43d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977416, "uuid": "bdec7b33-2d70-43ce-bada-ed16b8e2e505", "comment": "Malware payload (AgentTesla)", "value": "f11a1f81c1f4cb3d9e677432af0a99ded083598a646008bb80837db4ddda2c4dd6138ba765f94ec50ed72b29100f7c20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977416, "uuid": "8f7b5557-2e2b-4ddd-b394-3f936223c0d2", "value": "T1EF24196A1348E561CB6F417CC066811C72F15603832A938FEFE299EF1B652C9F91F9E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977416, "uuid": "d8242c7c-c5a4-4ad8-8b9c-a435df3579d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977416, "uuid": "d7f14c65-13e8-4733-913a-904ec37f007a", "value": "3072:/YYT0Ot0CBbSd3QA0nLAkDyppzNUsyA3dueKDtKK5zHKz0m0ZnYxY67E/xp+://SCxxLtqhU7ANuXtKSKIm0ZnW7Ixp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977416, "uuid": "2d09d446-803d-4922-8e0b-227fd5c4fa58", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977416, "uuid": "cf5454c8-16e3-4618-a97e-d834ee0133fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977416, "uuid": "8336b468-1974-4ca9-a7c3-1e867e839a3f", "value": "4b0d7d7932c2361c099955820fefc4636459c3ea3b155746fc04a7193d96e5b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17a3add-b093-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704985887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985887, "uuid": "e97a3936-8005-4959-a0c8-1f5951b85134", "comment": "Malware payload (Stealc)", "value": "570d028648bef6ca3a2295c28711ad7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985887, "uuid": "5c6d24a6-87fd-461e-ab5b-ede68a4e01e2", "comment": "Malware payload (Stealc)", "value": "4b7763f16960cf7f830ba960eb39b6b7380570ae3e31dac228a5c378f6448ac1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985887, "uuid": "99edbe91-5ce7-4b02-98bf-6049263106ef", "comment": "Malware payload (Stealc)", "value": "284f586f98e3d671ca5f225a0df427ec7d14a961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985887, "uuid": "8f18dc25-273d-4eaf-8922-b7b6bd3e512a", "comment": "Malware payload (Stealc)", "value": "cbc57f6da058480144d918defb6b5b9cb79098e0fe6a6601373f1ae2989e906e44dead80830a85894ff4ce284e5a865b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985887, "uuid": "6cb15661-a3f7-49c9-b397-c52b3a604b2d", "value": "T10964825382E13D84E9758B729F2FD2FD770EF6508E897BA511199E2B20B10B3E563B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985887, "uuid": "5c0f7e47-9e39-4ac6-9f43-4d78df368921", "value": "ae482bd3cfff150c70fe7ca85278d78d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985887, "uuid": "7d35f21b-9bbe-4c7c-a5f5-5c3daca48035", "value": "3072:38EGKLRYIFlJqxuA7ykRMZHyggSELBYML5sIBZ2yPF:3ljLRnIxuA7yWMZSmyBNSEQyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704985887, "uuid": "835ef5f6-9192-4e34-92a8-4d0203bcb095", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704985887, "uuid": "86b49b6c-2a98-4791-8bde-6a34938f23cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985887, "uuid": "097f72ec-e822-417d-a2f1-5539c455db1e", "value": "570d028648bef6ca3a2295c28711ad7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a18aee9-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943274, "uuid": "aae358a5-2624-47df-a05f-133aeba1fac8", "comment": "Malware payload (Mirai)", "value": "c9da82e2c7da123d81418521ea134f65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943274, "uuid": "dc2ce583-1ff4-4c9c-9f56-84826b67a36e", "comment": "Malware payload (Mirai)", "value": "4c2043697a99ead23aa6a17d11762ba9152be82812422eda8bb08dd1c450f881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943274, "uuid": "3f479ecb-6520-4e29-8e85-d9344364dcd6", "comment": "Malware payload (Mirai)", "value": "ab0ea7967326b74bda4a96b2e867c99db1a008d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943274, "uuid": "5945f5c7-68ff-4931-914c-a9464ed0dfd8", "comment": "Malware payload (Mirai)", "value": "52d9bd62c26b6bdb75cdcacb30e95bf452902403fc810106b2b790a8c40bba4d0e8fd841bdd2dc5fe6907a663bcd4876", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943274, "uuid": "758234bf-a3e5-4977-86b5-ccc4246c1809", "value": "T18E73C409BF651FF7DCABDC3749A92B0628CC651A21A93F357934C818F24B25F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943274, "uuid": "6b8aaf3c-8755-4ebc-965a-e9aa6b715f5a", "value": "1536:zuWiji2uqpwkwAK9OjkMKPNVdptcFZNFrm:zhijkRAK9UkHcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943274, "uuid": "41d05d74-2c1f-40ef-84c9-e229a252be52", "value": 76936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943274, "uuid": "62347416-93b0-401d-93c8-7beafbd1bb36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943274, "uuid": "8d3d96d2-e75f-4bb5-8b4a-cb530f4de8f7", "value": "c9da82e2c7da123d81418521ea134f65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d50df02-b03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704948917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948917, "uuid": "65f57330-e90f-4265-97a5-8ff3d64edf06", "comment": "Malware payload (Socks5Systemz)", "value": "bad70ccba26d0af5d0a21b31b705ab8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948917, "uuid": "d0a8b336-6c6c-4b83-a6d8-451eefc6d96a", "comment": "Malware payload (Socks5Systemz)", "value": "4f1aa26efeafe6c4e92f7f15548fab6f23c42250d36c683cb5fa5bcfd4b8c751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948917, "uuid": "d112f278-0f44-4146-b6ea-de223b34969f", "comment": "Malware payload (Socks5Systemz)", "value": "33a7274fe9661c14db833c4eb43e65e6beab2ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948917, "uuid": "ba23e7d0-b9be-4f3d-b475-e58bc35e82bc", "comment": "Malware payload (Socks5Systemz)", "value": "21d0cbdc2600111946752317c436f7774d90e165fac0a1a292a7477b6ace0a806ca0b678df1b0863f9a04b4472c8234f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948917, "uuid": "9a5cb447-5d1d-4e01-a9cf-75b5fb4b71a7", "value": "T1A43623188BBDFD15D1D049F4AEA1B6ACE138DE612EBF06466DE7B96FC439A4C3D02500", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948917, "uuid": "d470b56e-ed96-4476-98db-13cab63da410", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948917, "uuid": "80197b85-6b45-4ad3-86af-732b652d4d52", "value": "98304:5i/pvA3Q7k5bNqI7wKg8AkFhsLY530HrrypeXe5y+ahblvXxko:o/pv0ekjqvKg8Nn30HrKeu5yZblvhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704948917, "uuid": "6b921a9e-0958-40f9-bc39-0f18df9156a9", "value": 4872292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704948917, "uuid": "4c4dfaa5-b371-46ad-8655-1fb278da86cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948917, "uuid": "d1414291-a243-4ea0-8f5d-2688de4be1e3", "value": "bad70ccba26d0af5d0a21b31b705ab8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dd09e8-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704980264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980264, "uuid": "277b8cbf-69e2-4381-addb-c7e5c58791bc", "comment": "Malware payload (Formbook)", "value": "c721b60166a9167d39bea3b521b6c39f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980264, "uuid": "0f9102ba-0dd4-484d-8f00-41177a4dfb16", "comment": "Malware payload (Formbook)", "value": "4f2139c9c1c42e293388deb00bcb9591162b58c8107e6cd8a317b40f93a6c836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980264, "uuid": "70063ccf-8c0f-44d5-ad2c-76032c78d9eb", "comment": "Malware payload (Formbook)", "value": "23b63842c7022010d40930160038f3a9c2ae8edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980264, "uuid": "90233b51-7457-47bf-816f-d725b9bbebbb", "comment": "Malware payload (Formbook)", "value": "f49c698ee385c7d1c05cea1fb05908e9f5a596d7511f2d5dbd12c2d3a655c96f087a9d918a1aaf6f4e34c9966e02e538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980264, "uuid": "5aca3e95-53a0-4c7c-9ea5-3618be8bd6b9", "value": "T11715C03D6BBF5227CC67C6ABCBD4DC27B15084AB3C12EA2555C7439D5372A8224C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980264, "uuid": "2123c78d-6550-497a-a310-eb4bde925159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980264, "uuid": "d165c0dd-609b-4b96-a927-08e08fcd06f3", "value": "12288:xRt10XUVU6EJlO5pYqgpZrXf08X5ZxkP48iSf/TWM8/yxtFFLgLJI3Ll:r3ylOk7pXf08XpF8iUWy3FFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980264, "uuid": "9e2a06f8-4329-4463-9b76-2d51ea11dd8e", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980264, "uuid": "05105d36-efd3-4267-8d9c-e0b2fd9c3fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980264, "uuid": "dc0ee85f-6cbb-4406-8527-03c9f9ea9eaf", "value": "4f2139c9c1c42e293388deb00bcb9591162b58c8107e6cd8a317b40f93a6c836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8281c2e9-b060-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704963904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963904, "uuid": "a3c5a2dc-c0f9-4f71-9cb2-523391fd16e5", "comment": "Malware payload", "value": "7317ff828f94cc104e93c259025eb465", "object_relation": "md5", "Tag": [ { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963904, "uuid": "9df014db-88b0-488a-8dc4-377ba1f2653c", "comment": "Malware payload", "value": "4fa0e396cda9578143ad90ff03702a3b9c796c657f3bdaaf851ea79cb46b86d7", "object_relation": "sha256", "Tag": [ { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963904, "uuid": "e0c7415d-d43b-4238-8f91-ab828ae51d64", "comment": "Malware payload", "value": "46bee284a2f3be9b429e014d01b5a30d0821aee9", "object_relation": "sha1", "Tag": [ { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963904, "uuid": "f9b95641-cb96-4a73-96fb-548cf82ae65a", "comment": "Malware payload", "value": "4aae0f3e4839372febf6d0f5f86ddc3e2684b5ee93208b7fd12cdda45c38d3e7eaefcac3eb7a1678318421997578da5e", "object_relation": "sha3-384", "Tag": [ { "name": "IND", "colour": "#ADA0F7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963904, "uuid": "d5fe942d-82fd-4b51-8f8a-4cf303d05510", "value": "T1FE475907FA5449EAC6A59535C9AB02D63770FC002F26A7C76A04F63C7CB67D8AEB4350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963904, "uuid": "40440c92-8fe0-4a90-b06b-aeb74c47056e", "value": "196608:4iyAee0EFuGYxn26HSJyyx9uRhS4nw8D:YAL0EFixnZHSJlS/w8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704963904, "uuid": "35c8322d-8e47-4f63-9f87-e0f9691b0b37", "value": 26015744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704963904, "uuid": "18543e1e-3678-4721-8ed2-4f89f0c4ab30", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963904, "uuid": "ef92fd4a-c05e-462c-b7ad-8d704e57422a", "value": "SU-30 Aircraft Procurement.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa3f154-b09d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704990117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990117, "uuid": "f1b9463e-0c1e-427f-9a9d-899de057d240", "comment": "Malware payload (AgentTesla)", "value": "e508efd0a94987b67e8c1b9ee25be34f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990117, "uuid": "93c0ea55-f28b-401b-988f-dfd618069217", "comment": "Malware payload (AgentTesla)", "value": "51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990117, "uuid": "04bfc3b7-a2e5-4213-8946-f25f37006914", "comment": "Malware payload (AgentTesla)", "value": "be932a6f544bb7126b5240c9733d0fa0db87148b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990117, "uuid": "c4a8f863-cf01-49a6-a01a-94d1455f4d91", "comment": "Malware payload (AgentTesla)", "value": "310391790bcd8749b66019f896bc578f55edb81024d67692a8c1258a4a5d5f6c644a61580f928066dd6a7f2c385c198e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990117, "uuid": "fa01040b-c143-4e6b-abd8-c7ebc654c450", "value": "T17D558D023387D07AFE9A92370BD6ED8156B96D150423A63F125839F9FE7F1A1053E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990117, "uuid": "3727fef7-3402-4dae-a70e-cadfd0b8b689", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990117, "uuid": "5113cb20-8721-4050-a25b-5fb2b19a4167", "value": "24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8asIhF8m3STb:LTvC/MTQYxsWR7asIvR3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704990117, "uuid": "5fd8c261-8020-4e72-8100-86dbdf3f3a7a", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704990117, "uuid": "6f94ca73-25b9-492e-80da-f25745bfcfc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990117, "uuid": "e8c4c7e3-ed41-4d78-b6ba-aeab960f85fa", "value": "Notificaci\u00f3n Transferencia Interbancaria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910667dd-b057-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704960063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960063, "uuid": "b205705f-e6e9-4474-a858-2195bc10bd48", "comment": "Malware payload (AgentTesla)", "value": "c9021f152fb1ad7a70fb96aaa3e1c645", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960063, "uuid": "526348b9-2e13-4a1e-b015-d0efe1c4d065", "comment": "Malware payload (AgentTesla)", "value": "525d9778857fedb37303bdcb4b6f8fa57c1bf8c1a62ca25365277d4efb3265e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960063, "uuid": "ad3cea5c-3b00-4b2b-9745-db475cc217ca", "comment": "Malware payload (AgentTesla)", "value": "b38914175a94279ba50951041a5273b016521c3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960063, "uuid": "7af88b70-44c2-4739-96d3-58e8fe30304d", "comment": "Malware payload (AgentTesla)", "value": "d1731223db7ad4bf6ac339af1e3b897dca432f773a7a7ec8d91e806df06271e4e8e6fe83f838463eac0faf98998f6a5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960063, "uuid": "bd638c4c-6725-4a8c-936d-b83c025aea8e", "value": "T1B4454A012791B01EEFBF9033CB46EDD8CA7ED6110CA3551E1279BCAFA5241BB712A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960063, "uuid": "e43ba315-25c6-4d86-9f40-b8f8c716a409", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960063, "uuid": "72e196c1-9410-4a04-934e-5c74968c01d5", "value": "24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aAsGBGvAbvAE71gZ:ITvC/MTQYxsWR7aA3joE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704960063, "uuid": "da1b9842-1e04-43c4-9931-7154c38cc3a1", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704960063, "uuid": "4281810f-6d3e-4091-9acd-721bfe1d92c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960063, "uuid": "8f7dda95-0fe3-438a-8178-b12b47cddbe3", "value": "Purchase Order_NO90234198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6f0f1-b080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704977546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977546, "uuid": "a49a4669-5d81-4a8c-8f2c-93a8958f6138", "comment": "Malware payload (RiseProStealer)", "value": "9ffdb37177de3e04a48a989cd072dff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977546, "uuid": "9876e0c9-aa6b-4eec-94eb-daf23f1ba70e", "comment": "Malware payload (RiseProStealer)", "value": "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977546, "uuid": "09c3556a-14be-43aa-b695-d474e7187648", "comment": "Malware payload (RiseProStealer)", "value": "50d2acc6557c6c8ad46f962d1513cfa55f193c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977546, "uuid": "b2e3e0bf-bb28-44bd-9a81-b46259b5e5df", "comment": "Malware payload (RiseProStealer)", "value": "0e45cbb0e27862571c152c07c3e4fbea1b2f18e4ab2935fbc496ce01918858f015a3d3d56047e59c653fddb4e2a7327b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977546, "uuid": "a384fedc-38d8-43be-97af-a4eba443a67e", "value": "T1913633403FD40472F5EE2BB6A8F101D31379B4669B10821E771B5B4C8992BC2E59BB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977546, "uuid": "7045c650-dfaf-491c-9db7-eac518976cb9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977546, "uuid": "7089fc02-573c-4c1d-8e48-a3d6758831e1", "value": "98304:s5Dn92RV8yMS1WSxhg8oSrFGg+5CQhm4ybCmU15OcNOQ8x7eR:gQUVgWSLgorFGbXhJOCH7OGsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977546, "uuid": "f789a186-88e7-4752-ad53-0babf72b6e17", "value": 5202432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977546, "uuid": "4492f063-082b-4069-b08d-21ded1e9abce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977546, "uuid": "4a80261e-0918-4e98-9984-f9ee54487c42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1571c3c-b0c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705005617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005617, "uuid": "76016e42-ec55-45b2-96b1-55a095164c7e", "comment": "Malware payload (Socks5Systemz)", "value": "e850f5020fb5501d14bee48d7087e589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005617, "uuid": "53dc06b2-ec41-4273-bafc-76f65dd43c7b", "comment": "Malware payload (Socks5Systemz)", "value": "56f2e82c10506d2ad399bbcd547fb4869909d7c9a64a3add918bf7534640d323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005617, "uuid": "9b88cdb3-0dac-48c7-933f-695b1053eb18", "comment": "Malware payload (Socks5Systemz)", "value": "f13d6f8987eb81173ada9be01be2a164f6b00ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005617, "uuid": "e9ce7b22-bc2c-4aee-a07c-1b2c20f41da9", "comment": "Malware payload (Socks5Systemz)", "value": "fdbd668f0d38109b19f0eb4dd3be6dded5828b3bc30f363c2ef25955be194ba1a4f64823028f5aee12fb2f71af9ae57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005617, "uuid": "8a01193a-2942-4359-9c6d-8134e82daf7e", "value": "T1AE16332099C2097AC3B2D7706C3D8A78B4B7F62B12ADC0E99EDC1D5E5DE330E1D4A546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005617, "uuid": "52e52c08-cf96-4950-89e8-5be19a6b8259", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005617, "uuid": "89dc6cd7-0cfe-4ca0-85aa-fef3a50376ee", "value": "98304:eiligBB2JqtMtultlsSUWNBD1uIyth/pXo5UOCBPA2MO3T7D5fPxIkS:rMATUulzLUWHhzq+wsWBP+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705005617, "uuid": "f71d15ac-e188-4471-a54d-6ee0dbbfa0e2", "value": 4099862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705005617, "uuid": "65e76dc3-1c55-4953-8472-e0ab7ec38f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005617, "uuid": "7555bc04-72de-4d5d-8dc1-fb5e2514048b", "value": "e850f5020fb5501d14bee48d7087e589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66af77c4-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704943242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943242, "uuid": "fef74fd9-beb5-4432-a1da-91c2570a9f2e", "comment": "Malware payload (AgentTesla)", "value": "904e1bf7f9e4eeb922aae0511b0a0b45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943242, "uuid": "899ba412-4c6f-479c-adf7-16a66c6d3214", "comment": "Malware payload (AgentTesla)", "value": "5769990f534b9e77b10af7b86276d41673e4e5e81ee2be5768f838e838299cff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943242, "uuid": "8095dcca-a6ff-40e4-bbae-ec41e5398564", "comment": "Malware payload (AgentTesla)", "value": "0a1263523b6e17adcebdc3880e8b63d00d953ed0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943242, "uuid": "df9629eb-3216-4978-8a39-c1638111e2c0", "comment": "Malware payload (AgentTesla)", "value": "a4303a98cbc83962e78a3b24c670e49798755569cfabf0fd1ef1045cda03a359ae31fcb3338e6edcb40e41e60e94e91e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943242, "uuid": "41a5d58b-dbfd-40cd-b77c-f98743924c0b", "value": "T1C355BF1333909056FF6B99734E9AF2115BFC69678123A12F13983E7AB970162023FB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943242, "uuid": "6accc698-998d-43ac-aa8b-c5a98f8b4214", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943242, "uuid": "89e631d5-bf79-49ab-aa06-739d56602fc7", "value": "24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8aUuwnoIYO0Y:0TvC/MTQYxsWR7aHJrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943242, "uuid": "33a3500a-75d7-4cc8-b934-87c7e3d40544", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943242, "uuid": "9c9d61f0-4231-42fe-9f57-56fa24c08379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943242, "uuid": "3189942f-2da3-4ef2-9c5f-23e224efa3d1", "value": "904e1bf7f9e4eeb922aae0511b0a0b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d7168f-b06b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704968816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968816, "uuid": "9e209fc5-210b-412f-965f-93d689136770", "comment": "Malware payload (AsyncRAT)", "value": "2d09f6e032bf7f5a5d1203c7f8d508e4", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968816, "uuid": "acc3b181-b3e4-49ba-a22e-dd43afe9ee28", "comment": "Malware payload (AsyncRAT)", "value": "585f9d699807c982dac2f8384a20d510736aa771653de965fe7bb2c40b4a3fa8", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968816, "uuid": "96678123-9df9-4e06-a2d7-d3a126202f38", "comment": "Malware payload (AsyncRAT)", "value": "78170d51463b944c5f4931bc38bbb2ba17fe2820", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968816, "uuid": "8189cf0a-0bd5-494f-9ed3-e5fd81da9cc9", "comment": "Malware payload (AsyncRAT)", "value": "c0f254095678bb2dcabb8bba6c0479d30da6fb8d8cf3095d0892b56de9853ed1b950c6e764e76f1ade0de8d870390002", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968816, "uuid": "1b46d742-f715-4a91-a6aa-c1eddce8e37f", "value": "T14E0110135B8BDFA8C00369C7B587C4445C1C361DA1E8660870BCB7EDDB2D86C2A22A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968816, "uuid": "5e3a078f-a3fd-4314-8261-1741e762f9ce", "value": "12:jZj8FKwV40QzMOF6rjUCgxnV5ZfaJ9Qkrq3LTQxmChgLMleEC7/8XYnrdVpC+C7E:jZjcV4bztUjUC4VfaJ91mTfn7/8InpVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968816, "uuid": "ee38031a-5130-4c1b-901f-8df330267e19", "value": 728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968816, "uuid": "fd006ef8-5f93-4bf0-8b6d-73e126ecf9cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968816, "uuid": "22d6073f-d0fc-4d4c-87c0-232613382e3e", "value": "sys.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9938150-b0a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StormKitty)", "timestamp": 1704994491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994491, "uuid": "0830d0e2-fbde-45b1-891e-73b4d131d4e2", "comment": "Malware payload (StormKitty)", "value": "0227690c43c0ff805235212dff403c1a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994491, "uuid": "19ed4f8f-aed4-4d89-998f-0052d5911716", "comment": "Malware payload (StormKitty)", "value": "5982ee2f9702075b4dbc970ed9d8e142830ea74e35554c9e46ebacf2d42702c9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994491, "uuid": "96e6d72a-0156-4cd7-ab74-21c3dad8dba2", "comment": "Malware payload (StormKitty)", "value": "163b30d6c9aa13f0c60333a37e2603cf95eec233", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994491, "uuid": "476b75bc-4a4f-4201-8f1a-70c0649e9bb2", "comment": "Malware payload (StormKitty)", "value": "e8e4bab8aeaf72cba02265e944b64c2c7598472941b8c04e6b115108aa9a93e2c5a9d99a2f4bf46c775fa479b08fc250", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994491, "uuid": "dc435e90-c4fc-4886-8b57-9bef126ac345", "value": "T10246AE15EBD401E4E96AC630CA2AC732D7F2BC560A35D78B0638D24B1E73B954F7B225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994491, "uuid": "903cf411-fbc9-40f4-9511-bcb2c1fed0c0", "value": "0751433fb799ff99dbf59b2d0c85d83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994491, "uuid": "6c5fc0b4-8736-42af-8323-6be023ac01ed", "value": "49152:WcW+05ANXBFbKL8Vz2+j4QVdRfeuF7d9xKQN8uatd6XgvNvuGv0tB1jrL3Q5fMX9:lpJKQN8uatrn41bqfRGTZ0925uFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704994491, "uuid": "8480c401-7ab5-4c1f-bdd3-c7e2716709c0", "value": 5801984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704994491, "uuid": "e2980f87-1fcf-4991-9043-85f6b120b913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994491, "uuid": "d256be23-3fbd-465e-9501-55a49c2e72ca", "value": "0227690c43c0ff805235212dff403c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056f2abc-b06c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1704968848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968848, "uuid": "19079d06-c8e8-471b-b649-7bbfc8b5cc5b", "comment": "Malware payload (VenomRAT)", "value": "e494fc161f1189138d1ab2a706b39303", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968848, "uuid": "dd3723f8-05a9-4b2f-9e96-9e6721e623c2", "comment": "Malware payload (VenomRAT)", "value": "5d6cc4d7e7ce998cf1d7bc8b78f787f9b034ab3dbdf8c91a33ad0233ddef2ac4", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968848, "uuid": "ec2174b0-9c82-44e5-ae48-4688d2146d88", "comment": "Malware payload (VenomRAT)", "value": "94c5053ecdfbcc1ab663df254854a96e6db1eee7", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968848, "uuid": "94de074f-daa4-40da-ad5b-8dd2e5be2575", "comment": "Malware payload (VenomRAT)", "value": "1a832f21bae1630372298672bd38059e54168f5fab6d031460456b63184af768fdcb7c6c1741b5e3a3686d32aa4b15fd", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968848, "uuid": "ccfafac6-08c0-42c9-a562-7505407925a7", "value": "T16AE509436ACB0DA6CED66BB461D31335A778FD61CB2A5F3F6A08C63419536C4AD1AF00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968848, "uuid": "500dd07d-814e-4ca9-bd2b-155cd2126e94", "value": "a66290ff0511a09df9cdce9b6ea86e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968848, "uuid": "b26b65c6-2e44-4802-b89f-758cc9123155", "value": "49152:RJ8c/Kz+6/ZE3AvJIkkChELoBdDGaHDdukvA6vX7T7Nx2Yn68M:RdeJIkkChELoBdDGaHDduGl7T7Nx2Ynw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968848, "uuid": "2e6c04d4-447c-4f9b-a3e7-f833d4db45fe", "value": 3144167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968848, "uuid": "f90966c7-1362-46df-ad5f-511d87283d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968848, "uuid": "ae4b2275-1bec-4a01-9b46-390339f3f9f4", "value": "blues.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f871b00-b080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1704977482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977482, "uuid": "093ad6d8-ed08-4104-9d5e-6b25712b98a8", "comment": "Malware payload (RemcosRAT)", "value": "a97f1c6922b2b559c7f9c5114f1b59c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977482, "uuid": "ca110ee8-74bf-4049-a706-4309d1c8bdbb", "comment": "Malware payload (RemcosRAT)", "value": "5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977482, "uuid": "c7c6ae4f-e94c-4ddf-8240-d174c8591cc7", "comment": "Malware payload (RemcosRAT)", "value": "40fcc0e5f3b23349d5d96a1563948ebe155f9fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977482, "uuid": "a3aa7c49-75d9-42f3-9494-49595169c5e4", "comment": "Malware payload (RemcosRAT)", "value": "f9ed921d32942c6c1d60984f5e228310ee8ee7d27c101a2927f7d2d6bfbc152e53f657a5d3370e79f19f27a161ae819c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977482, "uuid": "215d189a-81d3-48a6-94c2-1bc20bdd810e", "value": "T16C15221033685B96DF3907F61C31398A0772AA7FB923E7497C5A61D762A8F244382F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977482, "uuid": "c3631d2c-d627-4038-b3e7-e30c0be27c59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977482, "uuid": "e9fbd117-3162-4fe8-b524-1800c5d2d7b9", "value": "24576:R+f55qeCiUlgtCg0mEk4Q2oPYYaeu5gUJZ8y:Yf55CJK4mEk4Q2oQYDSpJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977482, "uuid": "8a5a24ea-6bac-4d9b-9dcc-04d5a27b35e0", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977482, "uuid": "aceef7d9-681c-47da-9fc8-bfdcfc0b70ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977482, "uuid": "b6f1713c-a903-4aac-b099-b18b0dcf529c", "value": "5d8702a242d06cfeb840c8a6fbf8d2bdd3f7e2c58f8c1cc0d74135cc9c1baeb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf62b108-b0a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704991521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991521, "uuid": "244ec647-773e-4088-909e-d00c7743e949", "comment": "Malware payload (Socks5Systemz)", "value": "aa2bb0496c17d88c42b677a7402021b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991521, "uuid": "0b88c6bc-9b54-44c1-87f1-8153a39fbec1", "comment": "Malware payload (Socks5Systemz)", "value": "5e75dd408b7957d0ba77a24386535a86ce21d9642f6792b94b24b4e1539e545a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991521, "uuid": "c8b844b8-fa77-4513-b820-8e45c5be894e", "comment": "Malware payload (Socks5Systemz)", "value": "1d107f233f296c678302911c5aff47f00eda1fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991521, "uuid": "c454c6bb-9f22-4cba-8615-ae6a0fb27dae", "comment": "Malware payload (Socks5Systemz)", "value": "3e1991a9c8c705a6de86f065dc90759ceeda04079ca5f466f38b565e58068b51903b8ea7bbd82a52196b6c7ddbb78ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991521, "uuid": "d1762153-7b84-451b-822c-025004cf87c7", "value": "T15416332382B34930F971AAF85D56DF379A3378151EBD5098318D668F7A362CE5908F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991521, "uuid": "c74c002d-eb52-4281-81f1-ba1be6e69d57", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991521, "uuid": "59197d31-fe1b-406d-b985-49624766a311", "value": "98304:qi8gNVdMHYfspIFaYDujnJw0wjbcEN3UF01fH+kw:/8IjDu1bw/PEF09+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704991521, "uuid": "7b555b2d-8761-4d36-a3f4-37fcd17ca780", "value": 4106500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704991521, "uuid": "9a47cb6c-d738-4cef-925a-302f14c2f325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991521, "uuid": "632118aa-6ef0-4a3c-8990-d4c455c79964", "value": "aa2bb0496c17d88c42b677a7402021b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698829ee-b039-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704947112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704947112, "uuid": "4b906ecb-f745-40b8-ac47-e298b4b3e19f", "comment": "Malware payload (Socks5Systemz)", "value": "bc9025618f9805eb801e2e3671f888cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704947112, "uuid": "1df6ad2e-bff8-430d-94fb-da2c44888ec9", "comment": "Malware payload (Socks5Systemz)", "value": "5f9e934fc4a7d1f4e6e7cfccf3f072b9bb56fe83b5c70cf907502b31e9ae5e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704947112, "uuid": "a40b6614-761f-49c8-bbe8-629f0bc925bb", "comment": "Malware payload (Socks5Systemz)", "value": "a397d8170c353593843d832a76f8d9be1df05a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704947112, "uuid": "a44f50ea-7a26-46c2-974d-eb0b48336d74", "comment": "Malware payload (Socks5Systemz)", "value": "2caee1b71e07bedcd53b5744b6c10645f90775156ea3c711fcd00e945428949c25ec31dd1f2648cb1c81feff6b269a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704947112, "uuid": "4b75720a-6aa6-4713-808e-5dc38f87b4f3", "value": "T14F3623194B7DFC56C2C445F86EA1BAACE178ED611EBF02429EE7B86ED979B4C3D05000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704947112, "uuid": "b58bc995-5822-4431-be8b-cbe3c85a1ac8", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704947112, "uuid": "2ed0e089-eefc-4fe7-b9ff-3e71901aac6f", "value": "98304:Ri/pvA3Q7kPhC2AtLsRXBRTstYPg97qaRo6K3DTH7c3Nm4L7rTLh+N+6Xke:w/pv0ek5C4botbEaEzfc3h3Xh+XXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704947112, "uuid": "7aad88df-e0ef-4915-875d-9e8a466b0c29", "value": 4879491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704947112, "uuid": "636f2bfd-c988-4563-8881-c50106224121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704947112, "uuid": "32e97f1e-b96b-44fe-ad1d-383259e07dde", "value": "bc9025618f9805eb801e2e3671f888cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc10ce6-b02f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704942930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942930, "uuid": "36e39e16-773c-47a3-aa77-66183a3830d0", "comment": "Malware payload (Mirai)", "value": "5c4b1193d9d18c96c74de961b8bba60e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942930, "uuid": "57dbcbab-cedf-4201-bf75-aa77a328cf36", "comment": "Malware payload (Mirai)", "value": "5fc3b45e99c70510d9131738ad3bac6f94d624784a84e0307c5b143b4aaf651c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942930, "uuid": "e84561b1-8a06-4e2a-8045-09e3640786b5", "comment": "Malware payload (Mirai)", "value": "80c0f55d8e61ed0827881e5994d044ecf62c0ca5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942930, "uuid": "ff4c50c3-4f36-4794-bd28-450c8d36d2fe", "comment": "Malware payload (Mirai)", "value": "ea13a21785ab9e9015cc20321cfd150e6ab751477e324bdad8d8925007c4cb082b87091329e1fe725922c5349997a87f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942930, "uuid": "c2b6f849-7a49-4ad6-a85f-a77fde032b44", "value": "T15D334BC5AA93DCF4EC1506713177EB328B77F03AA12ADAC7D3999523AC42B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942930, "uuid": "8ddd6fa5-da11-4de9-a744-87287900405a", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNMXyaMQxpwBNbr/f:xZebkP/Ad39UMJRlhN6yzQbIbDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704942930, "uuid": "140e6bbc-64a6-4490-a0d4-4cac7cf64e7b", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704942930, "uuid": "b0d2dac2-9b30-4ecf-95fe-9aac05b3146d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942930, "uuid": "05e668d5-9b11-4362-9e5f-77d19e62495e", "value": "5c4b1193d9d18c96c74de961b8bba60e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa0c0a8-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1704978690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978690, "uuid": "c6aee629-f677-46e5-8e3c-b3c750d04510", "comment": "Malware payload (DarkCloud)", "value": "676350b32b30b9ca41d971fd9342ce8e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978690, "uuid": "7d5d9801-7873-488a-92f7-0055cacbea49", "comment": "Malware payload (DarkCloud)", "value": "60e44bcabd3bf72c06745779b94215ae112584bef323ccce564e2153c7b046be", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978690, "uuid": "b2daee6d-461b-4e7f-9059-d730f8a9b710", "comment": "Malware payload (DarkCloud)", "value": "443ce97d73009bd18dd4647b32e08dc339dc675a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978690, "uuid": "53ab599e-b2fa-4296-bbca-0128bb701882", "comment": "Malware payload (DarkCloud)", "value": "046c43129e8035fdfaab8ffefee52b81f7aab00ead9e00bd7f801f55e203ceace8a5d38ca4b2020fcd250759673f7157", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978690, "uuid": "cda58f4d-b8fa-4cc7-b39e-72667f462ea7", "value": "T124943A16E651202FF053C8B1EAD5A26BA8296D3A2588EC17F7819F0875315D7E8F133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978690, "uuid": "9e0f91de-15cb-471f-af14-d0cca93175b9", "value": "966d9996c62d870333d6853769a84f18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978690, "uuid": "352ca02a-e8e4-4d41-916c-fcb5b2af5091", "value": "12288:ldVkMuJ5ACU8299NlK7Fzpy/p2/TI8UjYKkJj6GmZU:/uJS+Fzpkp2/08qYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978690, "uuid": "640c4e3a-4cb1-41e1-84b2-ef4f5f08e58a", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978690, "uuid": "15c42f38-2a86-430b-b0b6-bdbbee1eb5c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978690, "uuid": "75d6da40-9082-46ea-8a42-93a16efc99a6", "value": "60e44bcabd3bf72c06745779b94215ae112584bef323ccce564e2153c7b046be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a47307-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704940333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940333, "uuid": "72c5ac2b-9c92-4fd7-b88b-a2e003315a17", "comment": "Malware payload (RedLineStealer)", "value": "342700576592187b880a9dab6c81ccee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940333, "uuid": "9994e9a7-fec5-46c6-b40d-6955eda79b25", "comment": "Malware payload (RedLineStealer)", "value": "613dd73bd9647baa7beb0eda82ecb395e2a0cc9b7deb8654ed62de0e6971b19f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940333, "uuid": "adedb706-fe78-48c1-8487-f56a4a563e1f", "comment": "Malware payload (RedLineStealer)", "value": "466874bc7ba9fb7d7e31264621d58cac15341b93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940333, "uuid": "5981570b-019c-4202-9639-e402e0db10e4", "comment": "Malware payload (RedLineStealer)", "value": "10f0b8f9d7268520385620e1eee53e1136d1a7f0b00a0e948f4f82a9f044f0c2722c31a0559f2f40e71f553faa1b3170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940333, "uuid": "a39de3ef-54b4-48c5-ad48-496750a122c1", "value": "T1BC252315E3E39992C578427658819006DBE8C32CAA37EFD57EC4244FCA95FC0B62379D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940333, "uuid": "08184f34-571b-48d9-9a45-d41ef74a3dc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940333, "uuid": "902c9f3a-e2c3-4a71-9c73-035f0930025b", "value": "24576:NTe82l4VtUHFRAUaMgrEdNbTtowceCC8XdaXDLW2Sxoq7:Ng6VkAUdgrVkoXGDkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940333, "uuid": "193e7651-07b9-41a0-bf81-85a914e8c1a3", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940333, "uuid": "d0ee943c-11d0-4044-aa64-bad825bcc375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940333, "uuid": "ff647e1b-ee9d-4732-a8bc-c8b52ca943da", "value": "342700576592187b880a9dab6c81ccee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a6e123-b0c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705008624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008624, "uuid": "9d5e8ba2-b1a0-4997-9a79-9097788d762b", "comment": "Malware payload (NanoCore)", "value": "70228020efaf6aad87454d706109984f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008624, "uuid": "66e28bbb-4179-4d41-8a6b-04a0a8a8012d", "comment": "Malware payload (NanoCore)", "value": "61e7d79adc7462d205a363d9a925f3cb994ffc42c1aad00edc034501b2be5a6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008624, "uuid": "697f38a6-c3c3-4158-9768-97c7d11e1086", "comment": "Malware payload (NanoCore)", "value": "a5da35544f66b83f13058a291c8c635e6acbd1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008624, "uuid": "57dcf15d-a4df-4d7d-a278-f20172611303", "comment": "Malware payload (NanoCore)", "value": "39b5868e6c5ac991a92ff0e682338e218dc1a03409d28f38a0dd9a6d1665019c560b6bc417670839bd483b27eb18f798", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008624, "uuid": "24a709a1-bcd3-42d6-a42b-dc0a7ce67f64", "value": "T1DED42366376D2BA2E0ED4BF7C8C644915B397E263572EB9C2CC940CB1A12F157351A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008624, "uuid": "265d2a22-f6aa-4215-934c-51cb77604388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008624, "uuid": "3d3a3588-6c53-4fa3-ba14-7d16d49e2bbd", "value": "12288:JZGoR7Xx3CGXZEnZ7fQ1NNIVKuYCCrNumCto06x4CAdcu75:JwoJx3CGX45fQ9OKCs2t1j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705008624, "uuid": "36ecfcd1-3176-4771-af0a-4d2ddfda9f03", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705008624, "uuid": "6099ad0c-684a-4fb6-9d27-791c48ac8dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008624, "uuid": "9189fffe-76c3-43be-8235-43eb0247e177", "value": "70228020EFAF6AAD87454D706109984F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc825030-b04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704955519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955519, "uuid": "d383b62d-a7b6-44e2-a4b6-ac5de4cade13", "comment": "Malware payload (Socks5Systemz)", "value": "1decbe120e5beaff817bc6dd186e2013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955519, "uuid": "1fbc3cae-7eb1-4f7d-8756-8ce50e9ce9ef", "comment": "Malware payload (Socks5Systemz)", "value": "6269c0afcf708d6b8bb3d7fa200009f6a177d60b6c5f9b174278dab56f716af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955519, "uuid": "dfad86ca-1a9e-48df-b544-6e90791d3dc8", "comment": "Malware payload (Socks5Systemz)", "value": "4cbcb2ad2f50862b0910a036dd2fd12aa4a23f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704955519, "uuid": "ddd31b5b-2995-49f4-8bf4-8761bbfcc6e7", "comment": "Malware payload (Socks5Systemz)", "value": "de8fc3105d66d169d94ea88e4f49f8ebf049f5a2286c0911d643c369633e2fb22fa490eba947d3a89a7810ddafa5edd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955519, "uuid": "6778701b-91ec-493d-9d4b-d35564252f29", "value": "T1743623154FBAF996D2D448F4AEA1B6ECE0749EA12EAF03066DE3BD5ED479B4C3D01100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955519, "uuid": "760ea2ad-0bb6-4e0d-a8cd-206d805703a4", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955519, "uuid": "4a32c2b0-3474-4d02-b50c-ea2e1ecd3d13", "value": "98304:Ni/pvA3Q7kcOH1+TnUcumzJip7MDUzVm+3VvNppfc0ufQF3EMUc3Qq518SKH68S8:U/pv0ek5+7UVHoDUN3V5fc0wm0ZcgqwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704955519, "uuid": "5bc4336f-1ab9-4694-850c-775bec96ba2c", "value": 4874818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704955519, "uuid": "b8329e0c-558c-4f6f-8cd3-1f7586db8852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704955519, "uuid": "cd80350e-f921-43c5-a4f6-8d96f63bdff3", "value": "1decbe120e5beaff817bc6dd186e2013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb1d86e-b071-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704971120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971120, "uuid": "5afcc002-fd97-4191-b3da-cc8f34094dff", "comment": "Malware payload (Socks5Systemz)", "value": "4c6074187a69d8276241d4b4e97ba070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971120, "uuid": "4cae0bb2-4c54-4c3e-8b52-d926b0b06435", "comment": "Malware payload (Socks5Systemz)", "value": "640b5f4dde898bd6b61db011e24e27a7e8593eb6711cbdf95a536066dfecf704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971120, "uuid": "0321f814-2b7e-4cb0-9e5b-8ecac0ab002e", "comment": "Malware payload (Socks5Systemz)", "value": "0c73c028b0165818ca52a4e341bc3213f2b69377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971120, "uuid": "90f194db-8c51-486a-b83e-97f2fe1aad9f", "comment": "Malware payload (Socks5Systemz)", "value": "81e547dbe0a4c53714d938f7052af13ed57c8777209d8760625c7e6557cb8c22d26c5288a5b6c884ab53bc9400324be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971120, "uuid": "c751a11d-ada1-4b7f-9741-d4fb0921459b", "value": "T11D260141E19CFCD5C80B10F7AD79E954241FFF5946798A2A3967B90A88F36833827D0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971120, "uuid": "194abd6a-095b-4992-a1e0-8c06c290fc3e", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971120, "uuid": "03d9f8f8-b5cc-45ac-9fdd-a86811c885a4", "value": "98304:6i67fjz/cEMKj6wxImbz2NLEJC3xGBsoOC/S+F/1CB5OkXIfRkz:v67fsO3KLEo3xGTzTCvQJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971120, "uuid": "c321dbd2-b551-4e6e-9c25-b2d1533d53e5", "value": 4815303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971120, "uuid": "ffc45827-78e7-465d-9bfa-47ae6e86f373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971120, "uuid": "8c57f376-9e35-4c30-96dd-db6a7cb5f9a5", "value": "4c6074187a69d8276241d4b4e97ba070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30af5705-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704980088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980088, "uuid": "fa7ab36b-3a07-4e1f-80b7-b43605efcc08", "comment": "Malware payload (Mirai)", "value": "288cecba70aa50eb36637ff0035f7009", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980088, "uuid": "acdce9ed-2728-4a1a-afe9-f5b749ef79cd", "comment": "Malware payload (Mirai)", "value": "65d6c45c5597e86540162e9f0cdc3359e80f930c830eeea510b52d96173d88ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980088, "uuid": "671c0b3e-9a37-48d8-980d-c1080a155f0d", "comment": "Malware payload (Mirai)", "value": "465572c96afd039c0bf68f5c7041e1676009a708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980088, "uuid": "0e6a3c95-038a-4345-83b2-48bf34d03c85", "comment": "Malware payload (Mirai)", "value": "2e61d3b178328353b966cbb343e796f331ca48ee0377072cc5b91971d26ea6aba631a9681cee4488a62f3f9bdbf13a0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980088, "uuid": "cff9710c-98ac-4a76-ad3e-30c9acd55458", "value": "T1E6D36C72DC296F58C251D174B0318F7D2B63B69142475FBA2AB6C2B94087CCEFA057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980088, "uuid": "211a062e-b8be-4c04-bb2b-93658a90987f", "value": "1536:Qaz7vLJyZANNZ2MWjRg/QBngnUPCqKDcSMdYci7jYJWjGHtvsfOO1Il1dh3esq:Qg1ySvcaUPkDbciYJWSHtCOgIDe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980088, "uuid": "ea407568-0eeb-4bd4-8b73-55a8e98aef41", "value": 137824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980088, "uuid": "fc856573-300d-40a8-b736-087533ad5c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980088, "uuid": "8b07ad03-bf18-44f4-837b-a3b3585be631", "value": "288cecba70aa50eb36637ff0035f7009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80eba2c4-b07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704976787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976787, "uuid": "e27e6433-8ab3-40fc-96d7-46830dd94b80", "comment": "Malware payload", "value": "8ca2a2f8bf3712a6b5aae42f8d1f68a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976787, "uuid": "86f90ce8-4089-4dc0-8006-0958e237f9c1", "comment": "Malware payload", "value": "68aabd5eb17a4e1025b7e62cbcbc7714ab8f6d371842c7f1561fd62a86e82676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976787, "uuid": "f3569b7b-c24a-4aa2-a94b-14dc76853b77", "comment": "Malware payload", "value": "24f1b6863ce5c2c1f3a4c8b903225396c13c2e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976787, "uuid": "0b6f0aaf-5577-44cb-89f9-6a8f76660788", "comment": "Malware payload", "value": "8fbe18d3fcf0a712ee26dcd92b4e3ffe6f6f683f8977c903ed0cb8fe14309f7532cc8dc76eaaec809e24ebfc789f99b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976787, "uuid": "63967a60-7e77-4aca-b095-0c1959943f01", "value": "T19025F093E5C445B0F4620FB5563AAD2019BB7CA83F38959B2398B4289B7F3C15631F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976787, "uuid": "fa65737c-f28b-4a05-9454-2f9ffeaf8224", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976787, "uuid": "1fa89241-2d97-4ab8-ad10-81d41a2dd343", "value": "24576:yHLmCiIhDFr4UhoNFhhX7D9pJcB40+rIU57eUUg90WbHXo:/m14UhoNFhhHp0+rFReFJKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976787, "uuid": "373d15dc-246b-4210-8eab-fcf4a5f978d9", "value": 1001199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976787, "uuid": "3423c108-f87e-4f3c-b195-6acc7afbded5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976787, "uuid": "77b23ad2-7d80-4ed6-a2c4-89a89b080899", "value": "68aabd5eb17a4e1025b7e62cbcbc7714ab8f6d371842c7f1561fd62a86e82676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba0a9cb-b08a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1704982093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982093, "uuid": "6144e1e5-10bc-439d-8b47-81ccfc2ae9f8", "comment": "Malware payload (GuLoader)", "value": "5c18ec65c8c26f3757e9d19cc7f37fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982093, "uuid": "94f87131-1145-4e3c-997b-7d47dfb6503f", "comment": "Malware payload (GuLoader)", "value": "6a861eb0176a0f7e0c4d69f2a65856d739bd4829448e72add40fabb9bf439634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982093, "uuid": "39fedb1a-472b-48cb-a786-41e720028362", "comment": "Malware payload (GuLoader)", "value": "ace21507a35a9db273a704cfa741c606bb4f166d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982093, "uuid": "0bbec8d1-da51-4034-ad8f-c16a5be77f58", "comment": "Malware payload (GuLoader)", "value": "23125dd9fa04a8feff3fde1fd10353c1398097f6f1460223de26e00534bf743bf2caf8755bc88f1d4c47f4b464846026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982093, "uuid": "6ec8e516-e3d1-4156-a3dc-55cae69b8610", "value": "T14DD4F088ED97C456CDA853314B375D261699ED08B9BCB21F227CBA19FB331C340DB25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982093, "uuid": "ada24965-36ed-4bc9-9e71-3f050b86b0b9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982093, "uuid": "b6ad1a74-f3d7-4a3d-bfb0-afd4cd9df1b2", "value": "12288:NYsmTCSUa1J3kR77kWX2h0hChIep9sO73QV4hdts2tCSgu:NY8SX1J3kVkv0hCvb3dtsIbgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704982093, "uuid": "a6dc59b4-7e49-4cba-a2a5-e6647ada48fc", "value": 638568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704982093, "uuid": "d4e8101e-3818-4a81-a37c-e5513fb2ecc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982093, "uuid": "ed6cfd5a-010d-478e-9ec2-1b75070db1a4", "value": "PO-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e13ca18-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943281, "uuid": "cefe558e-8fe6-4789-b311-ccc4b7a03e4c", "comment": "Malware payload (Mirai)", "value": "37a106002070b9afb99c61b89d3ce0a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943281, "uuid": "b7a213ad-76d3-4be5-b263-a748418d7869", "comment": "Malware payload (Mirai)", "value": "6e776fa224a6e6c1445770772c7828c6e16417431d6e1cb9ee86219204a444d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943281, "uuid": "eab7d874-9d99-4a64-9220-b263a98024a5", "comment": "Malware payload (Mirai)", "value": "bd7ab4644699e03cdc46dd9befa97071e63eeb4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943281, "uuid": "6428bea8-bd92-402d-838e-1ac0c4ed7014", "comment": "Malware payload (Mirai)", "value": "f7dcce5a1ebc53b6a20ae9b9dacabd10890feef9a8b061ca0885617678ab2b3ba72a6544421238b01be277cc44acad34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943281, "uuid": "8b609a6d-9769-4b83-b477-88645625459e", "value": "T14C431A96B801AD7CF94FE6BE94234D0DF621335051930B2BA7A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943281, "uuid": "a11739e3-3eda-4ba5-a992-de2b2c9bcdc3", "value": "1536:oFMAMFlwZA9UwjuW8HJjSyIE8WhibBqKpnzx:zTFlwZSUwjkEfqjKpzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943281, "uuid": "07893254-78e4-4cd2-9408-4963000d31d1", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943281, "uuid": "2e90f0bf-d996-49ff-900f-3e20da305c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943281, "uuid": "1378cade-e76e-4297-89e9-9116044c1bff", "value": "37a106002070b9afb99c61b89d3ce0a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72fdcde-b073-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Bayrob)", "timestamp": 1704972180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972180, "uuid": "46702116-7072-4c25-be61-fab1d6e9a6e6", "comment": "Malware payload (Bayrob)", "value": "de87fa1fe69de27f29233c1f7ffc8e02", "object_relation": "md5", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972180, "uuid": "f217d3fb-b828-4b00-8ef1-c0e3365af1f7", "comment": "Malware payload (Bayrob)", "value": "7014b6b3754d3c7c16c27520eabd722119df9575c4f11b2c48d0df1d8eb0b191", "object_relation": "sha256", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972180, "uuid": "3bb7b091-a53c-4062-8e16-e882468dab2a", "comment": "Malware payload (Bayrob)", "value": "5f96c0d7ebe83c1fba2aad496df76bfefd9c6c3d", "object_relation": "sha1", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972180, "uuid": "6252659a-edc7-4d60-8312-1bd2f547b67a", "comment": "Malware payload (Bayrob)", "value": "c15f49e54f5c779679f5725380ccac3276c0bd7299abf3f28762c81af95a6c047a0cbb03e83b4ef78a211a653c293d8a", "object_relation": "sha3-384", "Tag": [ { "name": "Bayrob", "colour": "#35A062", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972180, "uuid": "8cdd98f1-f93b-48ca-88c6-b63c5ddc2eb6", "value": "T17FD49D11B543A1F3D82321F74168F3361A29BD760F698AE3EBC70E6559F26C09A33653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972180, "uuid": "8c2998fc-d4a8-4b5f-b41f-99c05349fd6f", "value": "ac7390b3c0904db94ac3a5b51e836a86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972180, "uuid": "c4f6f722-7f20-4287-82d9-0768eaadec45", "value": "12288:UDSlgZQ1PmdxO/Lg3hxerjXyAJ7hnqRjTUPwotL+WyH:UD88emCL2hweAJVIUootL+WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704972180, "uuid": "32d0d425-abec-42ba-8d85-92e9eb0722de", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704972180, "uuid": "d413150f-d21a-4fcf-b308-8a69726a785f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972180, "uuid": "8224ed01-1b35-4bf2-90f7-eb807abe331c", "value": "7014b6b3754d3c7c16c27520eabd722119df9575c4f11b2c48d0df1d8eb0b191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d64b8e-b072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704971419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971419, "uuid": "c5ed7b76-1723-479a-8f2a-c11284062c43", "comment": "Malware payload (Socks5Systemz)", "value": "14a6bc4472e3d0955b3ce48ff88538c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971419, "uuid": "208b5e94-c80c-4f80-b60f-dd27ea095fe1", "comment": "Malware payload (Socks5Systemz)", "value": "7021bb246b002d3f811a913d148f5266de599dfe81acfa60279c5ffab6d80558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971419, "uuid": "91096420-a53f-406b-8ab1-e40bbf4d37cb", "comment": "Malware payload (Socks5Systemz)", "value": "98a35ee9ecfd4e21d87f07a82f4099d6a1a407bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971419, "uuid": "1d572b42-56f6-4eab-9e73-b46922e4b216", "comment": "Malware payload (Socks5Systemz)", "value": "bc0468174589efe9940fb5224e9910a7535717522fa25291bf8f8e8bec39b552300d22721020cd4eea70e7da084e7055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971419, "uuid": "b1b74e05-b059-4580-8772-0eb738b76109", "value": "T1C1260241F598FCC4C84B10F7AC79EA58641FFB9C4679892A3967B60A58F36433827D0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971419, "uuid": "3059032d-eea9-4ff4-a2b4-13577ebaf177", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971419, "uuid": "1f096832-4b9c-4984-83e9-6ae7e0cd9f7a", "value": "98304:OivqBe5dy2qOnMOHxjNORR/aiNYbPjts8OVMeXbqW5dimpkG:7MeTRqox8HqhOVMe+W3nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971419, "uuid": "eed1d5ae-93b6-4e09-ab0a-6c677d8f3797", "value": 4813819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971419, "uuid": "faff3e69-9e73-4959-a021-f9bb35f77fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971419, "uuid": "88d437ee-1451-4a52-afb7-426178d785e7", "value": "14a6bc4472e3d0955b3ce48ff88538c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09e8ef4-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1704943420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943420, "uuid": "a18f8993-3376-4a46-b341-09bc8d7b4b48", "comment": "Malware payload (SnakeKeylogger)", "value": "0acb733f157259a6053c3ede327430ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943420, "uuid": "ae6c1b9c-2947-4492-82d3-b90c13ba8720", "comment": "Malware payload (SnakeKeylogger)", "value": "703921fd2af99761c29876c1593c7f225607a27eabd5bc1e6b66f2d1283de3d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943420, "uuid": "0c209fd1-f632-4363-bf17-e7354f7d5b76", "comment": "Malware payload (SnakeKeylogger)", "value": "a04fbfcabe513669e03447754622477d2bcfffc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943420, "uuid": "cf4a56ee-8eeb-4f1e-964c-9e92d7a81d32", "comment": "Malware payload (SnakeKeylogger)", "value": "d504753561caa068fa98a04d08e8aa474fecfcb7c410065abb1f3b98e7be5e80187de3dbfab0f932d7756cc82ba9eb4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943420, "uuid": "d5375608-d777-4e37-9d71-82f37648de6f", "value": "T14DC412317BECD668F46C277DAFAD803983F1F1E66602E35A1E0721AE5DA37110E11DA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943420, "uuid": "6082d2d7-5eaf-4d44-819f-5ba79d101aa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943420, "uuid": "a06d0d5d-7811-42bc-a48c-48a62b032c9a", "value": "12288:RDIQycQC7pgkfb34imI+3GIn5Zyx5ZPm0+:RdycQEpg0743BGIn5Zy7ZPmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943420, "uuid": "45f65d28-9ca7-4b32-84cf-b70c36350304", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943420, "uuid": "65c07c00-c343-4cb0-b631-73de524c010b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943420, "uuid": "45e12717-de31-4c55-953b-9964c5b1c966", "value": "TEKL\u0130F TALEB\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08c3f3e-b0a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704991523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991523, "uuid": "a72c0561-b507-4cbb-9267-7bfc4798d563", "comment": "Malware payload (Socks5Systemz)", "value": "438192b7d6f139eb0ae3c878eee39710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991523, "uuid": "81a065dc-8082-49ca-ae81-9aa3d16c45d2", "comment": "Malware payload (Socks5Systemz)", "value": "739390cb2a8719293c06192017f6164ed68e569f5d259de14f17e9b6dee8ea44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991523, "uuid": "21125bb6-53dd-48d9-8686-eb85f1a23ce5", "comment": "Malware payload (Socks5Systemz)", "value": "b9398b4674d6b9701d4e0626b6f1a8101296ffe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991523, "uuid": "bfa35666-f880-432a-bcbd-f18311f72f34", "comment": "Malware payload (Socks5Systemz)", "value": "883439d6ccbf65509f0755d940a9d0ea3715563d96e5c798c3fb1d8d29bd3c9311b859d2c9470f55374a18b0fed22ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991523, "uuid": "e1b04db8-daa3-4929-ab5c-f4db08dc62cb", "value": "T166163352CFDEACB4E04ACB7C3D2AD462C033B9B06C5541B93F991B1D91AF7A449C924D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991523, "uuid": "036591cf-fa61-4071-be13-5fc771250fbf", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991523, "uuid": "15540c1a-7e3c-49df-9ce5-6df7c9e9d6aa", "value": "98304:Cix7YwqRyRbFPDBvxyaLM7klgIJK8kuzKicLMbI7lpN8Zmfekk:nFP3ZPDBv5oCJK1Ld407lpN3eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704991523, "uuid": "76512e35-0f24-4b9e-985e-841b377ae7d5", "value": 4109157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704991523, "uuid": "9c0f5f79-f47b-4fb2-b9d4-79273647cebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991523, "uuid": "2667909b-a6f9-4815-85c9-6a969802bfdb", "value": "438192b7d6f139eb0ae3c878eee39710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b26f92a-b072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704971623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971623, "uuid": "2f8b1c86-aa46-46ec-87b5-c9a728945b59", "comment": "Malware payload (AgentTesla)", "value": "3cabf65ae7aeb7325f332e28eaccc678", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971623, "uuid": "b683536f-5907-4847-8920-827e9f2fbba5", "comment": "Malware payload (AgentTesla)", "value": "751657b09e8419dcfc90b0e44932dee1a4117ce9cd73cf652aa52c348a391f82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971623, "uuid": "90308585-fcec-433d-a00e-335b9f06777e", "comment": "Malware payload (AgentTesla)", "value": "ff9db11ec47488d0c0521fc2a8d3022e11d31e56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971623, "uuid": "ca116ae7-8d46-4c1a-9cf4-6d251452a982", "comment": "Malware payload (AgentTesla)", "value": "492f56034fe80477712d95dfda8ee693a1cc8cd36ca16ba513df1fecbd41e3154e68ad5829a0499df782ff3a9400aaed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971623, "uuid": "39571cba-6346-4d6f-ae7c-6193d70d0657", "value": "T12805B03C5BBF1227CD67C6ABCBD8DC27B25094AB3D11EA6459C3439D5376A4224C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971623, "uuid": "7b546036-1998-4bd0-89ab-9d470dbbece9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971623, "uuid": "e4115a46-f94b-4048-93fc-997188510ea7", "value": "12288:KXUVUS/glHViJlLDMBbDMLA2Mu41UDJAr6WuEA9zAkvXjr:7bXvAtEs6WRA1dXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971623, "uuid": "f6ef35c1-0855-467a-8cf2-95e2a11856ff", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971623, "uuid": "86bd7975-c5dd-4f16-997a-2754f0a1f000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971623, "uuid": "b921c38d-c89e-41b7-8547-89eae281b400", "value": "751657b09e8419dcfc90b0e44932dee1a4117ce9cd73cf652aa52c348a391f82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ced8edf-b08c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704982820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982820, "uuid": "fa939ec4-d330-4b53-80da-b767c27d2cf0", "comment": "Malware payload (Socks5Systemz)", "value": "c4f2dec8f764b9a5b92d40e09b049727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982820, "uuid": "c4ed2954-4f88-424d-ac9a-73c7e17d7d7e", "comment": "Malware payload (Socks5Systemz)", "value": "768f163ce8833ca05034b25efccba215b2b69f3bfb9f43bd2b43569dfc03fd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982820, "uuid": "e77f02ce-55e6-4b03-9ef2-e0a6db17fd12", "comment": "Malware payload (Socks5Systemz)", "value": "56ce9d1cd53432eb0d53d12beabdf5dfb3fd2a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704982820, "uuid": "89471f97-abc6-42ad-801e-dc41adfa9cdc", "comment": "Malware payload (Socks5Systemz)", "value": "2c0d53bb0d3e7871e15cb716e85b97076f92926f6553267bd06b3022763d539913e805754c0b2134320bb62d484d34df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982820, "uuid": "1bde7ef9-30b4-47e2-9f29-8cfe8371f484", "value": "T1C7260141F598FCC5C80B20F7AD79E954201FFB594279892A3967B60A99F36833827D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982820, "uuid": "bc1cdcbc-5345-42ca-a47e-aed5bfb53cb7", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982820, "uuid": "a393b635-f575-4f7a-952d-e6ca9118c297", "value": "98304:KiQhkvkIzGWDvvfVM/mWODoCh5ei6moYQ4khKYBkK:fiPIdvfCuv0ChwCRkhK6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704982820, "uuid": "343fbc18-3d8b-474e-b122-07b82c37a31e", "value": 4813685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704982820, "uuid": "555b78e7-fff6-4146-8011-c66bf0c30595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704982820, "uuid": "99b45a90-97e0-47bc-8f26-3ebacb26de02", "value": "c4f2dec8f764b9a5b92d40e09b049727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1cf0af-b07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Worm.m0yv)", "timestamp": 1704977205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977205, "uuid": "bfc6f2b5-9886-4436-b902-e77ac0eea5fd", "comment": "Malware payload (Worm.m0yv)", "value": "13343d20d39ec792bbff9cd51a7d12d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977205, "uuid": "5ee5d4f1-c122-4e2f-8de0-7bd7e8636d72", "comment": "Malware payload (Worm.m0yv)", "value": "76efda6c81b51a09ca94c5aa645cf08d2bf876cc0ead4855ba57582bb32bcb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977205, "uuid": "8ab121e9-89fd-4deb-afa1-011f9a5d613c", "comment": "Malware payload (Worm.m0yv)", "value": "0d32c9e1855436943c60a96c5847223d03d79a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977205, "uuid": "7417df6c-8a0b-43d2-b417-7e6834f968e6", "comment": "Malware payload (Worm.m0yv)", "value": "dbf5595dff8f1f9925519175b289666b6d91743ae9ac39876a115899482812ca5d6b064a12c9db400eb8a52f2764997a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.m0yv", "colour": "#F3591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977205, "uuid": "dd59d5a0-8b78-4fe7-a819-de4d51b76c2c", "value": "T1F1D4230073C68076E4F345F4AABB9164A4AAEFB11B6454C7838DBE5E65F12E2FC31243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977205, "uuid": "94cb5615-6055-4c71-a160-f4213f2b67e7", "value": "fbecc3bacdedc1f5048fb3fc99ff4ac6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977205, "uuid": "b50139c8-7c2c-4a32-8bb2-445e02bce085", "value": "12288:sgMTNjYGgpK/vnRsmH5Ckt73qfKrrzD89f24pWYbCXGah2JoHq1MGJlyw9hditWT:sgMTNjx+mZCkt76f/24pN+XNqNG6hdi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977205, "uuid": "2da9c700-da12-4083-9742-46e9298af6b3", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977205, "uuid": "25a3adc6-6d67-4cff-899d-a7d3db7df034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977205, "uuid": "fa68b6d5-c1c2-430a-9aa3-acc219e7709a", "value": "76efda6c81b51a09ca94c5aa645cf08d2bf876cc0ead4855ba57582bb32bcb2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e5fbde-b076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1704973205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973205, "uuid": "ed87438b-43e2-4dbb-a1fc-42799b41aa30", "comment": "Malware payload (QuasarRAT)", "value": "2c4102facf34d60785c2e882121f46fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973205, "uuid": "a8337a69-83db-4212-88fb-9ed1034be69e", "comment": "Malware payload (QuasarRAT)", "value": "76fb1494f160bb15a94de3401187fa0f4e64c1cff9a4dad27f0b24a8c8786950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973205, "uuid": "f0c91600-05c7-4bc8-bf0a-cda1f2bb5848", "comment": "Malware payload (QuasarRAT)", "value": "176206c562e04e715d3a2823cdef62c7f3773a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973205, "uuid": "44e607a6-3141-41b8-8ed3-b5db611bfaf9", "comment": "Malware payload (QuasarRAT)", "value": "a75a6458eedcee496170997f5d71aeff9795a12c73f6284ba48a25283f26b3e9322baf3b12b06a523bcfaa72a438919f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973205, "uuid": "71af42b0-8976-4a8b-a320-3e9d0e926336", "value": "T10B24BF4767E800A6F4B5937599F207831532BDA0AB34C3DF138AA96E1E336B1B635353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973205, "uuid": "64dba887-1289-4943-8269-a34594948b80", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973205, "uuid": "32ec7637-f7e5-4c76-a6ef-6f9c7a8781f6", "value": "3072:FHlM7TYmySIQIvuxU5GWp1icKAArDZz4N9GhbkrNEk6/Lx94cDQqBS44/zmHnw:Fz7Tp0yN90QE5x1BObmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704973205, "uuid": "d40990dc-4fc3-40d4-ab9e-e077eb18990d", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704973205, "uuid": "1077e81e-c5be-4129-8eab-483a81a171ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973205, "uuid": "885d4262-2b4c-439d-9492-994af9a04919", "value": "\u0415\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0438\u0439 \u0437\u0430\u043f\u0438\u0442.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bf9d44-b04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1704956615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956615, "uuid": "ba3325ff-024c-49a9-8e86-451cb7340b54", "comment": "Malware payload (Sliver)", "value": "62158df551183a09018d6b35c039352b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956615, "uuid": "b17dd409-cfcc-4394-a049-0851796efb0f", "comment": "Malware payload (Sliver)", "value": "76fcc7de4d18b697a31318fd75ccffcda3afc056756aea7019e44d32b95c68c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956615, "uuid": "7e4d356f-63ad-4045-9043-aa4df2025aa7", "comment": "Malware payload (Sliver)", "value": "8d085faff8d965c1c21a1c0a075c8af746f0e66e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956615, "uuid": "e727c74f-6aad-41af-ba30-a6fd448027d6", "comment": "Malware payload (Sliver)", "value": "f1e4c47889fca6a2747104f3b1bb65aaace2f902994af595876c4e35a3473c1e78c1705d3b8cca5054aea858a82e83e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956615, "uuid": "d71ac4de-ee04-4aec-b212-af8f8fe69ae8", "value": "T191F60903FCD611D9C8E9D1B489214271BA70785C1B7933DB2B61B7B42B327E48EBA791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956615, "uuid": "e504d2bc-4324-4268-b247-b4105ae8e91d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956615, "uuid": "8878ecda-c264-4e0c-b182-b427c1be1afe", "value": "196608:3DwcyRhTH5dsVet9p2NUYmNaExRlgya46ad:30TLrsVeHp2vV46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704956615, "uuid": "094ca8cf-35cf-46c8-a152-82f9f3f40596", "value": 15656448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704956615, "uuid": "cfa32af5-e345-49ac-8cc3-1343cc14d5b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956615, "uuid": "9a307bed-2336-48f2-95e9-28c640fba459", "value": "win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d869814e-b085-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704979940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979940, "uuid": "a3c7d72e-ef2f-4236-8574-bb2a8ba99120", "comment": "Malware payload (Formbook)", "value": "d046757904a7e3651281327d46623985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979940, "uuid": "e7607344-bd64-4832-ae22-377365e04756", "comment": "Malware payload (Formbook)", "value": "781fecd030f2f437a89dcf726a45e3eed218043316b35e80770a20a6f4bb62e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979940, "uuid": "78958bfc-bd9b-4e86-92e3-792ae644ef1b", "comment": "Malware payload (Formbook)", "value": "4d8fd329b177a0fb32c6df73a12f40096bc500eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979940, "uuid": "c97a8735-4812-4de5-a246-ecc569eb1d81", "comment": "Malware payload (Formbook)", "value": "4472c2157d1fa8a2fb0cf710d62c4064ca80d254cebf03012b5e4ef0544c78cc455cd350ef5a35f2957cefba4c058b8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979940, "uuid": "3b085271-ddc7-4e55-96eb-e7b2f639bca6", "value": "T1DC25D43C587D1237D5B5C3958BDC8427F25CA86F3151ED6588CBA3E603E6A4278E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979940, "uuid": "45c4df51-b4fd-4592-96ba-4bf0d9836cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979940, "uuid": "c18cc695-8be7-496c-8881-cd8d12f04b82", "value": "12288:gGXDY6tYGmGj5CCGi6V7Eu1x43LcQ1Qud1mRnWjABUvsczqmNNPf:TzbPGHWu1x43sT5WkBvcWmLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704979940, "uuid": "9d9ce743-1320-4ee0-84c9-3f31f3960bc5", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704979940, "uuid": "2fdc290b-8d18-42d6-a5a3-74a02b4af2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979940, "uuid": "ed676493-808a-46de-a4b7-67d18feb1cfa", "value": "781fecd030f2f437a89dcf726a45e3eed218043316b35e80770a20a6f4bb62e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcb4c04-b074-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704972433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972433, "uuid": "096502a6-fd2b-406f-b069-cc6c70468162", "comment": "Malware payload (AsyncRAT)", "value": "150d0d25b7a369b2b55c7cfbf25a204f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972433, "uuid": "6ae808d5-7e47-4ebe-9471-5324ddc20fb2", "comment": "Malware payload (AsyncRAT)", "value": "79ad3b97b133a46650bd4e9243585e619cb2225a05d8dede6d1aa78a6a54bf19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972433, "uuid": "b12e4360-2cb0-4da1-b07b-03bbfb67966f", "comment": "Malware payload (AsyncRAT)", "value": "225b5a35019cd044dc603d9d997c41065283bfc7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972433, "uuid": "7138cca6-2621-4abd-891c-66ad9b5d0efb", "comment": "Malware payload (AsyncRAT)", "value": "2cea7dc48cf7515167f72f3bef819621223f4543e5808d163909c86da8695e0bbf5798fcc7d6acadfcf83bb4f5802d0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972433, "uuid": "9c20fd1c-7484-4f27-a74b-1bd4af6be1e9", "value": "T16014E80BEF5CC585E08579BE6BA9621682BCE3B2E9F6C9459C338FD91DF518029011FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972433, "uuid": "86fbbbb1-d32f-4311-9863-dc13916d9b02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972433, "uuid": "98c2e27d-c34c-4a43-b500-929a6eb2f528", "value": "3072:4uiJTUKP2zG0K3buTbSHynFYrNm6+xmfswft:4uiR+Ct3beneR+KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704972433, "uuid": "21b96cbc-7789-4897-878a-968316a18674", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704972433, "uuid": "b19e7816-4100-45b6-9914-cfd53efa5e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972433, "uuid": "99f12a29-f7a4-4ab7-9ecb-da92188ab910", "value": "79ad3b97b133a46650bd4e9243585e619cb2225a05d8dede6d1aa78a6a54bf19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d36f9b-b02f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704942943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942943, "uuid": "179a2bb9-ab56-4c24-bd45-aa71fe3c16d7", "comment": "Malware payload (Mirai)", "value": "b183c1334704da76b8f505ddf47f7522", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942943, "uuid": "a5fe76a4-99cb-46af-bfd3-edbb672c6bb7", "comment": "Malware payload (Mirai)", "value": "7f5ab956e704bd0787b9ad2ea47c60cf43c02c5c2c18b72edb467ed35281679f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942943, "uuid": "07595396-5a86-4ab1-bd24-3cdf2b25b074", "comment": "Malware payload (Mirai)", "value": "19bb789636b30bb899a15190c5137c188b046fc6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942943, "uuid": "3f215a0e-e13f-4d92-bb84-6827896a2bc3", "comment": "Malware payload (Mirai)", "value": "6ecf98c52f759a386b1fdd62439c6c227c99329a2146401b7cd2ee15e707e2ce56d5c962a76c2d1dd2882c09f4fd9ef0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942943, "uuid": "2a20a4c1-5b31-4e89-b2b5-a8380fe3a3af", "value": "T171B36C03B49080FDC0A9D1784BBFB136D461F46D1239B69B27C4EF163E4DE206B9EA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942943, "uuid": "0649956c-92f5-461f-aa3d-798e483dc38c", "value": "3072:uJ9WidoPT0r8kued5eM7nS/qiMki+LbQ1rauqw:u9XdoPToCyuqipizauqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704942943, "uuid": "394ac911-3afe-43bf-a68f-51dca6b8b8f4", "value": 114408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704942943, "uuid": "3f717cd7-cabb-43e6-a78c-3ebaf4e41761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942943, "uuid": "55d6604d-eaec-4a74-af99-d2616cd4283b", "value": "b183c1334704da76b8f505ddf47f7522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ad0226-b071-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704971127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971127, "uuid": "0c54a78c-98fd-4adb-bc49-acd2db11f451", "comment": "Malware payload (Formbook)", "value": "3db3bf46cdb740ff8ca988ade9eeba2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971127, "uuid": "2eb2d906-e0fb-4e40-927e-c4913cebd320", "comment": "Malware payload (Formbook)", "value": "80f1abd5006e75632ccce2516b48be9abf23a9bf80a4dceeee1b73a6b7251b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971127, "uuid": "753d9ab6-294c-4691-b281-c55ea6c80c20", "comment": "Malware payload (Formbook)", "value": "003aa2977a0ac850916f37dad9554fa6ebb64bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971127, "uuid": "7f821313-4833-48bb-94bb-ef9595c3e938", "comment": "Malware payload (Formbook)", "value": "2898d238504ff50d5d7e43e25ffcac0d07f54031d7bbac708ab28ab495b2159327e267924cc8c81d78207568b617ea09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971127, "uuid": "8fb1a05b-a261-454a-8e9b-b2df10ed752f", "value": "T1C4F4022432ED2F4BE8FA47F90A6092009BF57D6A5475C31C2CC172CB2A76FD19661B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971127, "uuid": "511b8815-c1d4-4886-bbb4-255b010be684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971127, "uuid": "9ce3de79-cac2-460b-9d79-7d78ec1793fb", "value": "12288:y2HKE6jD/62iNG5nF8GNZUfy36cauJHrrtHnG6lp6anNSQ6JkwU:ymKtD/61I9/nNtJHfVnH4P3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971127, "uuid": "ca7009cd-c223-4b9d-95c1-b494ecfb446e", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971127, "uuid": "5e2617b7-f98f-4eb2-b155-94d8602b630d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971127, "uuid": "e6e3005d-49b6-4182-a7ac-b7810e812292", "value": "80f1abd5006e75632ccce2516b48be9abf23a9bf80a4dceeee1b73a6b7251b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3477d9-b0a0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704991519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991519, "uuid": "2415389c-317a-49cd-8817-913b622c8aa5", "comment": "Malware payload (Socks5Systemz)", "value": "eb7073f79738bc3871d8fdcdda2f6d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991519, "uuid": "449d44ef-a7ad-49c3-83e6-6534c992c354", "comment": "Malware payload (Socks5Systemz)", "value": "836702e8e9b5cc72d071836f7aece14f2f55103db492110feb3d1df399cb5a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991519, "uuid": "efac97e4-83ba-4c20-9069-6d164e379aa5", "comment": "Malware payload (Socks5Systemz)", "value": "660b50ca01cb57643dabc899305bb56272874070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991519, "uuid": "2b47c84c-ac5e-462f-8315-299ac6789350", "comment": "Malware payload (Socks5Systemz)", "value": "c1ce25fadf3575b4eabef6772852a6b4d34d8be9db3039c526513a3b5a67f18bfcaf8f61eb997706ecedcc73254b5d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991519, "uuid": "80c2f8fd-b0ee-4e9d-b616-b692c8d8962f", "value": "T14B16330BF8C444B8FD366A70BC7550079526F7E7563A36E53CAC8DBD76A0CBCA104A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991519, "uuid": "9814cf89-7aa3-4644-a664-f2bad7f9698a", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991519, "uuid": "037d013a-395c-4376-a30d-5210c2486cd9", "value": "98304:Ci5y4bUjbSiDmlFQh0GSRxSe5hbFSXQrUCngi+5PpkE:n5boj5D+yh0GSrSUbIALngrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704991519, "uuid": "0ef4829e-0c27-4add-a514-006bc8773c03", "value": 4106875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704991519, "uuid": "572ee61a-7706-40cc-92d7-ac24bd66b5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991519, "uuid": "6fd6347b-5fd9-41e1-9f94-120c79de1438", "value": "eb7073f79738bc3871d8fdcdda2f6d07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3ea6a3-b08c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704983006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983006, "uuid": "8d9e0a43-b036-47d4-acb3-c9e0e829d719", "comment": "Malware payload", "value": "042d782adc5a0fe122ce52c64b9f895b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983006, "uuid": "d1d0d41f-8085-49fe-a8bc-0d8e6423088f", "comment": "Malware payload", "value": "84f668529edea0be84b952dd2b2daa4b4463416b0c7a721eda7a4f9f1c2f7b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983006, "uuid": "701cbb84-c014-46ad-b8eb-8245fea9b3e0", "comment": "Malware payload", "value": "31f4f5382efe6522f49e3b4381beac9810971b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983006, "uuid": "8834b996-1ded-4119-b588-af6e5905343e", "comment": "Malware payload", "value": "4e22c44dc3131adbecb19a447868aca07f0129473880a6fc93a4e6b6b6a6e44b4fe9bda23609b185b086a46a51715ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983006, "uuid": "b01bf099-d2fe-4040-a3fd-a757135a91c2", "value": "T1DBF46D02BAE384F3C65C24306C7DB77DA571AD468B064B8F53ECFD793A3A0519D2612A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983006, "uuid": "1dc695ce-1887-4a24-acac-8d7cbe424c4b", "value": "df9ab8219cb31207e2d5f63c8438459a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983006, "uuid": "109d4a23-1df2-4032-ac93-f042e77fabd4", "value": "12288:qLq/gtaqp/TlHAqMV56FnjnP62Hw/Y5ZFL:qL6g37lgqM36FnjP6Aw/Y3FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704983006, "uuid": "12250004-c957-470c-b7be-f0b981a239b0", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704983006, "uuid": "349e95b1-8c39-4b21-8de9-6f214c8916e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983006, "uuid": "507c1ccf-accc-4ad8-8a5c-68cfbc583f04", "value": "SecuriteInfo.com.Win32.Evo-gen.582.17120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37de1054-b043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704951324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951324, "uuid": "cf802359-90af-40ed-bafa-375a31febdb7", "comment": "Malware payload (Stealc)", "value": "96187024176f154975288536ddda6906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951324, "uuid": "3e1bd0b2-1fdc-4c7d-9d6e-c2ea0b213e3a", "comment": "Malware payload (Stealc)", "value": "860ea5b26b4297ef791f2bf7be670c89f5771a2384974c8fd1de9c862ecc338e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951324, "uuid": "5180c267-8440-40c1-878f-c15d113c3ff8", "comment": "Malware payload (Stealc)", "value": "edbe95f1f81050bb107e40958941f56ee410e2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951324, "uuid": "777c05dc-b131-438c-9ab9-a57c3f1e7677", "comment": "Malware payload (Stealc)", "value": "4a9191dec6b291266ed7177cf57cadb0ed692adbc1e54cdcc7de985a8ddc064523d9959f985bacd61779498bab8f371f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951324, "uuid": "ed3a4937-188b-42e5-9771-e6eabd91484b", "value": "T1C4248C1035FA8032F7F35A765574C3B04E7B78A77A359A8E1A8506B94F267E2CE1031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951324, "uuid": "39591a38-56d3-4217-8692-a6ed6b354d9b", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951324, "uuid": "d16f5424-097b-47b8-9e63-0e8c1fd3dd9c", "value": "3072:guhd7K44uyJi1cqRy0KrSPZ+sSeRrAvBL2A:L7Z4ukrScWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704951324, "uuid": "9f03aaf3-b8ee-48e4-8c5b-d69905e5fd26", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704951324, "uuid": "dae3adc9-5129-45c7-ad2a-edd60e087378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951324, "uuid": "cf127bef-c0e8-4e51-a308-6890f3361b15", "value": "syncUpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b94ded4-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943250, "uuid": "b879e1c9-1ed0-4148-9e70-6c2719170939", "comment": "Malware payload (Mirai)", "value": "1edd239792bee870ebdf33307551db93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943250, "uuid": "0a81e64f-2f59-4d55-b1a8-de96b94a7cdf", "comment": "Malware payload (Mirai)", "value": "8649f64e8a9ffe0dc1e203412f4a409078e856f39a896353057925eed7457e89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943250, "uuid": "1dacfde1-1368-4e00-a3b9-b12d225e87e0", "comment": "Malware payload (Mirai)", "value": "81387c76d749fa7a6c14da77a77b809d1a62435f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943250, "uuid": "fb2e73a9-25ee-4867-9138-8d230fba7a41", "comment": "Malware payload (Mirai)", "value": "d5309c8dd3784670aaca8f373798094f8ad237b612e7604cd89fceeaba0b41a3cda80c052cd3af40b7bb32c1e07b749b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943250, "uuid": "8fb729ce-22bb-442c-aefe-2e34678cb823", "value": "T1C9435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943250, "uuid": "018b4d6a-1f3c-489f-8171-7c271f66418c", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczElBV8muWpH6TnSgGABC:ybUg1Jgzz4Cqu1HxEW6nSgG8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943250, "uuid": "c1fb381b-ffe4-49c4-a324-f7af325bf53c", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943250, "uuid": "6227aa02-39a0-48e4-8474-af3aafd398c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943250, "uuid": "b1b97a47-c656-4350-9052-6d89d13a897d", "value": "1edd239792bee870ebdf33307551db93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb06bbd-b037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Predator)", "timestamp": 1704946418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946418, "uuid": "87f1b337-0764-4b8e-ae8a-74eebbc125d6", "comment": "Malware payload (Predator)", "value": "19a473d54f8b4f91ed944773bb4c02ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946418, "uuid": "75cbf905-5280-43ac-bec4-6a5a685b9f50", "comment": "Malware payload (Predator)", "value": "873546478ec547e4e82af18fa5004c67794141d9cb98e79a4ff84c86a6c6aeb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946418, "uuid": "2ebf737a-0f09-4161-9df2-8692452c2fc4", "comment": "Malware payload (Predator)", "value": "9d5fab1d5b65096390a01f5d1fa7873a97967e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946418, "uuid": "325ac566-0bf8-4979-96c9-2173576129d7", "comment": "Malware payload (Predator)", "value": "5abf04ed362611a9ace067a948d72525aadff6705bff9d2bd841ff8cb8d21f5a0b33d1bf7aa82be0e5daca89ff1b7f2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Predator", "colour": "#00BA08", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946418, "uuid": "77109d37-2406-4a7c-af2a-0110eb3980a6", "value": "T1D3C4590223FC4BA6E5FE2B31A531424543F6FD42567AD70D5DC0A6EA4C777829E203AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946418, "uuid": "e371ea55-61dd-4fce-8cbe-982518dd47ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946418, "uuid": "0d5dfc1d-5d22-4c41-b05c-c1bfdfeea3c9", "value": "6144:4+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWLNq4MqTJv9U:LPw2PjCLe3a6Q70zbp/sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704946418, "uuid": "a9fcc8f9-1f52-456b-a353-641cfe5035a5", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704946418, "uuid": "26bb0c78-a8cf-409b-8f8b-7c2247b2d576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946418, "uuid": "f17e01b1-402a-4ab3-a634-5326777c9f67", "value": "19a473d54f8b4f91ed944773bb4c02ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93444fe6-b046-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1704952765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952765, "uuid": "8e807e36-b8eb-4882-b819-2460ff3f66ff", "comment": "Malware payload (GCleaner)", "value": "c1afcdd7c967e24b177b45eef8d9c598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952765, "uuid": "3c1bfa4a-faa0-4935-b9a8-80573c07bed3", "comment": "Malware payload (GCleaner)", "value": "8a6587bf245cd55599ac872ba8299b6631dca6171c0b637ff85ac47a3649d064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952765, "uuid": "ca86f5e3-220a-4c3d-956f-ed482319decb", "comment": "Malware payload (GCleaner)", "value": "7ec83aed50a6399384be26c50f36935dad83690b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952765, "uuid": "b367d06a-7217-40ec-a042-ed86230c7bc4", "comment": "Malware payload (GCleaner)", "value": "c362c4f53997c4c607dd511d1c1277ea7af08ea22f4628106a39fc8093238f78f12da1f13a8abee1659b417e17ed171f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952765, "uuid": "9e5ac824-ea4b-403e-a86a-55a7749dff27", "value": "T14244AE1131F58432F3B36A7A5971C3A04E7B78773971998E6AC606B94F257E2CE6030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952765, "uuid": "2cfa3727-7530-42f1-92b6-5b4bb8cdca33", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952765, "uuid": "35048a39-6b23-46ce-af0b-1c17101443cc", "value": "3072:WXDHdnDLjbJi9jK30tyAseufZKlr2rTGvzffGpQSwcroeEySC40RezvBL2A:MdnDLjXxbxKUevzXZSzr7VroY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704952765, "uuid": "a51110bb-dbf5-4e0a-81fc-9f64c8801e29", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704952765, "uuid": "e80ced8d-7c71-49ba-b182-8591ada223fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952765, "uuid": "8b9a3cf3-c12e-4e25-ba9b-b34fef8d1758", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d19ca36-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704940327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940327, "uuid": "2f0d4a62-6e7e-4599-81d1-10cac10c87f7", "comment": "Malware payload (RedLineStealer)", "value": "b62d67f96c1a058130ea48ae305c9fc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940327, "uuid": "9e9d29b2-ba60-4cfd-9e03-2fbcb3d90c76", "comment": "Malware payload (RedLineStealer)", "value": "8afd60f7ef24ac692068525fb3c91e74c60c066dff1f778db851ecc7b691f0bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940327, "uuid": "8868f8aa-aaee-4c15-a374-c3dbbe983a31", "comment": "Malware payload (RedLineStealer)", "value": "dd397eb2001b52849019004ad84d7e4596f7efe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940327, "uuid": "9e39374b-13a0-45fd-ab6d-de95692bec42", "comment": "Malware payload (RedLineStealer)", "value": "899a4cb6266c580383288305c67a7bd1638165b64589fb1e6bc1342578d86fa929fa024950c2b4a0f13971e7b5f04d1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940327, "uuid": "05566487-334b-4b44-95f3-23e78533b6b0", "value": "T13D252342235F1B31C2184176A483444716FDD36E6E73DB8A3B1C80AA5D41BABEE87FD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940327, "uuid": "43bfdab6-093f-4a1d-8ab4-f361a8a42209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940327, "uuid": "6c117858-4c34-4733-aeb8-0235478e9ad1", "value": "24576:FZRZUNgFTBxIg/eB6RSouoxAeDCCmlg6dmAYvfgCVMvRj:cGFNWXySq1GDlgKDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940327, "uuid": "4608dd94-4058-4800-877a-74857c4ac957", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940327, "uuid": "be9beea1-6a9a-42de-8464-4c45f71b5da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940327, "uuid": "89877ff7-3655-4795-87b7-ac18efb47c22", "value": "b62d67f96c1a058130ea48ae305c9fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe63368a-b024-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1704938342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938342, "uuid": "df5fd9c5-b19f-45e1-9deb-5c4975c1c055", "comment": "Malware payload (Rhadamanthys)", "value": "56d18659fe72c83a34ba5af8b27a9439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938342, "uuid": "d65c18ee-d1e4-418f-9234-8ba604086bc3", "comment": "Malware payload (Rhadamanthys)", "value": "8b6cc57f1b2da7e7b703b181f91ab63dce0891eae4ccfeb6e42452bdb02aa97a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938342, "uuid": "79810a1c-5b04-4990-8e1a-4e8944c9c8b4", "comment": "Malware payload (Rhadamanthys)", "value": "974486ad0915dc1ce3a765d2ce3ef94ab7cd9c55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938342, "uuid": "77213a60-32a2-487b-b6f3-24d4c5f0f97f", "comment": "Malware payload (Rhadamanthys)", "value": "c7515b4bef8b9113ed1a554a947ef63de19aca75b804fb36f4c4b4495371672164b52f4cad68f316b139d0e552259055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938342, "uuid": "e0146060-2b57-4565-8394-a1fa9603c9d5", "value": "T18A666BC7FDA151E5C0AAE33185A69193BA717C484B2023D72B50FF782E76BE0AE75344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938342, "uuid": "6bd15876-c684-45af-b3d2-3bb1359a2a53", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938342, "uuid": "647aa6ed-5a81-4dd2-b202-dbac8da31229", "value": "98304:5UPETMXvT52J9N2WEoU7iQE/3Gf4psjidH4MzuTDldELdj:52vT52JiTo9QE8XYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938342, "uuid": "446509c0-7422-425c-8134-608111cb8dee", "value": 6963712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938342, "uuid": "ecd6a8c5-eb3d-4695-943c-f99e38d6c9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938342, "uuid": "c4f3f9b7-92c7-46c1-be08-9e4e103a2a8e", "value": "56d18659fe72c83a34ba5af8b27a9439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9ad692-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978496, "uuid": "4f38f51a-4cb0-423c-ad4c-44204132f655", "comment": "Malware payload (Mirai)", "value": "0ed6b0055ab2a02495ec15d3ffbcbb04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978496, "uuid": "1d675194-b7ad-48c3-b227-0a8e95b74fa1", "comment": "Malware payload (Mirai)", "value": "8fc71a29a61edcb72913fc03a5477b43d414b1d854f8d9d784cf79a508c82ed6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978496, "uuid": "c02e53ba-d308-4f07-ad51-db2dcde17dae", "comment": "Malware payload (Mirai)", "value": "5701ab0c608480e856b4049e9b383515d28a583b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978496, "uuid": "6ab33c24-1f36-451d-b1c8-b92475f86ac5", "comment": "Malware payload (Mirai)", "value": "073375837fb6e9e51d623bd805f59dce8028afc16fd3d2328d8e0f67464dea48ef8790e133295e6fe7cbd41c11df8ba4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978496, "uuid": "7afbfbd0-c788-41af-a3a7-03b0f8f89144", "value": "T12114D81AAB610FF7DCAFDD3706E90B0529CCA54722A43B363674D528F54A50B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978496, "uuid": "f577666e-af89-47d6-a18c-1aceb2c8df44", "value": "3072:+W9mpCj6ij8DeiRPO+4yLbN8QUUjCPtgISaOB:+RpC78VO+9LbFw1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978496, "uuid": "666f393d-84d3-4ad0-9714-0c09a5b21270", "value": 201432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978496, "uuid": "c27231ed-5a00-402d-99ab-3f1662b521cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978496, "uuid": "a31d715f-af2a-497b-951c-5538ceca47e1", "value": "skyljne.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1104bb-b025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704938369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938369, "uuid": "2fbb864e-2acb-4808-8c17-a65ea5461a6e", "comment": "Malware payload (Smoke Loader)", "value": "8f951988acb3a0d53fe2d66cfd60b7a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938369, "uuid": "6dd8061b-e594-470a-86c2-3330ca88376d", "comment": "Malware payload (Smoke Loader)", "value": "9024a473b6244e9aef3f65da784300194ff67434a204b445e5099ea80c19f949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938369, "uuid": "b3cb773b-1700-49bb-a157-d75edbb0a0d7", "comment": "Malware payload (Smoke Loader)", "value": "9c39e8de9925b1102c39cbaabd01839c7e0c2e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938369, "uuid": "60a5f336-d8be-4b2f-8cf8-e4336e2e187c", "comment": "Malware payload (Smoke Loader)", "value": "aa506a55881b25f1b2c83dbdfdc32a6cea723bc56d8d876ad01994c390595661b79368c831ce2a87b633a56eba72053e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938369, "uuid": "414a80a1-8ef9-4f46-9624-82a323d100e9", "value": "T1B7247C2035F58432F7F356765670D3B44E7B7CA77931AA8E2AC506B94F266E2CA20307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938369, "uuid": "ac1417b5-d6cc-4bcd-8a37-0a7f5d40ff3d", "value": "7e32959e1e010773874596cbc1a01e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938369, "uuid": "423f48ad-a22b-4117-99d8-00f2335fd2e5", "value": "3072:EdrEskahJisaAN0yunrtMxxFF3m7SfdBm2HQWRlMuqBL2A:kEskaFVunrqvldBcz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938369, "uuid": "f2350edf-3d2a-4808-8bff-31b0d5bd3a78", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938369, "uuid": "12c79d55-8f66-4e97-8789-cfef9a48267d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938369, "uuid": "c6034e06-4381-4fef-b380-7372c3a7b636", "value": "8f951988acb3a0d53fe2d66cfd60b7a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177ca449-b0b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705000661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000661, "uuid": "33a11c0d-aace-4508-9b9e-4d1f407c4029", "comment": "Malware payload", "value": "a8ef00b6bc7147349bebc950a5fed0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000661, "uuid": "63e97ab5-0bec-4ae3-ad22-f557d25225be", "comment": "Malware payload", "value": "90dd210c9c67ffa0ecd9a20c1b76d0ecd2ee8669804d736b44a530ab818baec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000661, "uuid": "02237af5-1cd6-4518-869f-baff1a10dbfd", "comment": "Malware payload", "value": "3d3f2418ab0327d7271c7566001aa49c4b9ba0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705000661, "uuid": "c9e7c91f-3e1c-4b6a-9ce8-222655abe28c", "comment": "Malware payload", "value": "9840ac96b5d9cc6ba0a73a75c135be2f052035ca866afa4f9ce947254a917300ea0bbda39bea9cc5e133697977d8ac65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000661, "uuid": "0c90b521-0184-4917-9cf6-e4249edb1087", "value": "T1B3A59D42BE96CB71E34891B851B3637A16367AF043E585D367B82846AD313F0B739387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000661, "uuid": "9029cccc-985b-4633-b1f0-2706f29bee9f", "value": "a9b8f84ed7e3b395834ca51370b2661f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000661, "uuid": "3ff7c5d4-d68a-4e40-991e-7e86977f0c28", "value": "24576:y/DYhIWSd6DHp4kzkCIw23i5pQduTLahpR2/ul/yoGVNY58bIEzW+/m/rF7k:k76DOkAtw2QpsuHSp4ul/yow7zWYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705000661, "uuid": "7c9d7078-7c07-4c10-bb12-4e3f6169aaf3", "value": 2197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705000661, "uuid": "43bd0f12-c5f9-4695-89da-e148de915a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705000661, "uuid": "ff8f7331-5e43-474b-bb31-dc9433e41d28", "value": "SecuriteInfo.com.Trojan.GenericFCA.Agent.96092.1603.15044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35654d7a-b03c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704948313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948313, "uuid": "a1af2072-bdeb-43ff-a6b2-95a9538d7e50", "comment": "Malware payload (Socks5Systemz)", "value": "5f4371e9fcc21652c9fb3867f64d4941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948313, "uuid": "c4cb1ec1-2dd9-43ca-b478-6c5a079d1c2f", "comment": "Malware payload (Socks5Systemz)", "value": "9397e1a3bd7e94ae5213d8dc4edef5e73fe8c6f0306196a1ffae832a3976e9ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948313, "uuid": "3d9fa2b5-c70e-4631-b63d-372944494f20", "comment": "Malware payload (Socks5Systemz)", "value": "a19d69302a3993f2aca91d73bdc128e47b6ce174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948313, "uuid": "95c9132f-73d4-4720-a4c6-00a950ecbd55", "comment": "Malware payload (Socks5Systemz)", "value": "c835e35fcb928fb7b60e119d0044c17c07d329f9ed2bc349054c9ab6a5be3afa36c54b3dddef16b399546188471ebbce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948313, "uuid": "31d7add4-7000-4bd0-822a-10d3422cb6ae", "value": "T1592633590A9C047BCC21F6F63A3BD520EF66727608FDDD8E220E5EAC97951B528033B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948313, "uuid": "abb1c7c3-d75f-4715-8ecf-6b939d14502b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948313, "uuid": "90cfa5e7-80ef-4347-aebb-d38296024de8", "value": "98304:QDC5jNxoKkMBuu/KJmiuK3gqLkWSTGHVs49M4dm8:YCj6KPBuh8XUgqLXHLM4dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704948313, "uuid": "1415a980-8a4f-4c89-88b3-b2fd09b51e7a", "value": 4698582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704948313, "uuid": "73658d91-4efd-4418-9ce7-d070794b479b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948313, "uuid": "a2a3da8c-a1ea-4ed1-b76b-9040f05e7e2d", "value": "5f4371e9fcc21652c9fb3867f64d4941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a224a0b-b097-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PoshC2)", "timestamp": 1704987378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987378, "uuid": "b3f36753-5e33-4318-94cc-c0a06ac05bc2", "comment": "Malware payload (PoshC2)", "value": "3d6132791250aad2bee09ff8307435fe", "object_relation": "md5", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987378, "uuid": "02927cc7-2007-42a1-9a99-75a1b8f11081", "comment": "Malware payload (PoshC2)", "value": "96d90f67f3cc860e8624440a1f9279c349eba1e97ea434d757a51a110f36f3cd", "object_relation": "sha256", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987378, "uuid": "7e8f4c17-6497-4376-b6b7-f13767407f17", "comment": "Malware payload (PoshC2)", "value": "8fc3b5df29d325401f0245fd816b0f860f318e07", "object_relation": "sha1", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987378, "uuid": "22cd60c5-1893-46d2-84eb-39a430f36dee", "comment": "Malware payload (PoshC2)", "value": "ab31c0a80927422fe92133a16ab6c56fcd85b0ab9b3d7f0c4ce9be0e5b478acf666387fcb2ccf03e73af149d05efa625", "object_relation": "sha3-384", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987378, "uuid": "ac0112c9-064b-4af3-9b7a-9d9c4d048812", "value": "T18611DDB66B2E5013C9B6CB521D4B965ECF7041E298C40A10B9FE4E20DE39127A35FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987378, "uuid": "0a6f81b6-fa90-4d68-9fb7-4b99e998d29e", "value": "24:DOVtyCi6WhsFTxnswvpdPNuR71q2z8JAh/:DOVtyCiBsFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704987378, "uuid": "30c2b0bf-cd20-46be-b064-45a4ad37e25f", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704987378, "uuid": "d939ed0c-22a2-402d-8a06-0b938ba2605a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987378, "uuid": "5d8ffaa3-2b66-499f-9c89-2c3bbdcb0b2c", "value": "VmUvqsqA.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcf6b03-b03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704948760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948760, "uuid": "c099b661-1a85-44e9-8d4e-c29d5ea14214", "comment": "Malware payload (AgentTesla)", "value": "6c4ee5be723fe2d3c147956d500a209f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948760, "uuid": "1a9ee2a4-1483-48cf-a61c-0858dbd7380e", "comment": "Malware payload (AgentTesla)", "value": "974b705980668b3d9fd809501c581d7961db4a43304826edf136764c789a28b1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948760, "uuid": "c8f8e966-2696-4ef1-882d-c57c8cf46fb9", "comment": "Malware payload (AgentTesla)", "value": "87aea7cec3d4f65b2b4e8738724e8a28090b17a1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948760, "uuid": "85d8754c-a862-45a9-b6b6-450dd9cc1ab4", "comment": "Malware payload (AgentTesla)", "value": "edf730b36a43052c07c7c52218fd3a56e0ea5eeea21aa99a801c81ffdd7f0ad4a7d30a257c2dd9d0175a70bf3349f1de", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948760, "uuid": "1c3a253f-7c52-4044-aa15-60557d1dc78d", "value": "T1BE74D621FF764E13D2195B39DAF60108C7FBC0421262F74A76A692B50DD33EE19C9EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948760, "uuid": "5c66af3b-c0c6-4e7b-9753-356ef7e399cf", "value": "6144:lAtbzGFDVkJTOClC8Pn+cufQX6MVUMyYvmeGJ0IFbm9xKao:+1JTpn+cufQjLVC0ibmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704948760, "uuid": "5490d64e-bcc5-4453-b431-4308aed4d388", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704948760, "uuid": "d5ec8152-bbcb-4c5b-a964-9299c2ac4ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948760, "uuid": "2e9f03ac-d8b3-47ec-80e9-ceb7b670fcdb", "value": "6c4ee5be723fe2d3c147956d500a209f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017683a8-b025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1704938347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938347, "uuid": "8d9b4a17-6f56-445f-b95b-d4d1b03a0c2c", "comment": "Malware payload (Rhadamanthys)", "value": "0432cad278795630a71f066279b82c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938347, "uuid": "a3a7ad18-e859-4a35-87d1-c288bdb831b3", "comment": "Malware payload (Rhadamanthys)", "value": "97ee222794b0e20266259caf3ff1e198f56c4cf87af316452a9bd2f8f9982a6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938347, "uuid": "f5427a53-7f4e-4c56-92d6-db3eb49ccd4e", "comment": "Malware payload (Rhadamanthys)", "value": "99b75ba66262296f9b96559766fa6fe713108075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938347, "uuid": "921ad369-f491-4990-b426-8187e28ab435", "comment": "Malware payload (Rhadamanthys)", "value": "8bbfba6919c1a72902176300aeb3df303df85a6911fc72ea662e4dc2f7f722045ca78b617ff8c06c6a18b5520d7d1583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938347, "uuid": "76892652-cbbf-4fc3-aedb-7d23b0443de2", "value": "T126074A87ECA445E4C0AED7348AB291677F713C884F2117D76A50BE642F76BE0AEB4704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938347, "uuid": "dabc6484-5500-4635-b9ad-00b6f666048f", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938347, "uuid": "c78a5c78-309a-48ab-997a-128c4147e9f5", "value": "98304:XuMTgzeyo9xCFwHOqN1PORdrxsxIV7OoUZ3wEVRqSaSege6I2gxtvuri5NPYkgVG:/ryo9xCFwj2rgIV/ULVneA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938347, "uuid": "37562997-4267-46a9-aa45-73a81c8d6d12", "value": 18041344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938347, "uuid": "679fc1d2-3deb-442b-81f7-d04fe19b62ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938347, "uuid": "eff88049-d4be-4540-8b63-7231d69e97d0", "value": "0432cad278795630a71f066279b82c5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671debab-b038-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704946678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946678, "uuid": "56e3c591-9b25-4632-a06a-228c8b37709d", "comment": "Malware payload (LummaStealer)", "value": "360bab4dd905795e1f6d8e6dff02444b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946678, "uuid": "72a0c5de-bf58-4633-a02b-1707bff99c58", "comment": "Malware payload (LummaStealer)", "value": "996bd2fdc641a08e3b893338d3e6d697ce57902ce50f6e51779fdaa53ce2de8d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946678, "uuid": "b56c7bf5-e6a7-4de0-9392-c51bf097cadc", "comment": "Malware payload (LummaStealer)", "value": "1ad0e4ef5e181c889389e036eebd04ab32241139", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946678, "uuid": "e1ab290a-c229-42d9-ae2d-89275a397d54", "comment": "Malware payload (LummaStealer)", "value": "107b4729fae1a5899ef5eb61efdda16b5a4651eaba8805a5d3c5c4f3ce5f5f586013653a3e0b0e901c374b8be1a807cf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946678, "uuid": "12fa8a4e-09b0-403a-aba0-8dc4e4645ba9", "value": "T17BF56C8BBD9514F5C0A9933189629192BB71BC480F3023D72A90FFB92F76BD06E79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946678, "uuid": "8e906e67-6ad7-4398-9b07-c4c04fc2637d", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946678, "uuid": "65cfe4df-39d2-4b08-aaae-ae8f20b5a63f", "value": "49152:cAhKqO2Jnk+QBucB8wQNj+0u/a2ydQEqznVPebu4oNPX+v5zzwa:c0/+BzBZ0uGj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704946678, "uuid": "5e4b11e0-ddaf-4809-a500-b4d439ca7dcf", "value": 3548160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704946678, "uuid": "a3e70bf9-74be-4aec-9c77-b8380b5218e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946678, "uuid": "9e8ec679-70d9-4cc6-81a2-ec657668e62a", "value": "360bab4dd905795e1f6d8e6dff02444b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75193a1-b07d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1704976421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976421, "uuid": "5f216040-a816-45cf-b4c5-d9a004a39f42", "comment": "Malware payload (Stop)", "value": "9de69c7a3e551dcbc9208221099680a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976421, "uuid": "f4aac6a3-a522-43e1-b31a-e4f54860d26a", "comment": "Malware payload (Stop)", "value": "9a880d7572486dd985ed6ffbf55eee8875077d9614befc12d5fbdaafd45e86d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976421, "uuid": "2ae2d5ea-289c-4bb8-aef6-059b10f626f8", "comment": "Malware payload (Stop)", "value": "e5ae2554407774c2cbbdde1c1dca1b15d51b6d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976421, "uuid": "3a83a9b7-7b32-4146-8413-078d9cb89c0b", "comment": "Malware payload (Stop)", "value": "8ff4b5751abb0d35cc30d349a906b551b6caf3bb544760d64934d2f207d3459d2e0480d99a844de1d1c57cc189021b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976421, "uuid": "602e78d1-87eb-4bef-a602-ecba8ac7dbc8", "value": "T14205F11072ECD032E2F315354634C7F44ABBB872A969597FAA9426691E70FD1DA3033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976421, "uuid": "ee1f3a32-b985-4b7e-b81d-f92c50f012fb", "value": "a2a0817e6392d97a0384682bfc79e3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976421, "uuid": "976a4c66-d9a1-41e8-9f18-4dd5298909eb", "value": "24576:Danoo9lgJSVadwqRPFOwbl3JeknVz4SZSVXYcXywbp:DablggMWHknVz57c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976421, "uuid": "c4ab2c01-c349-4f27-ba2e-89b52275455d", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976421, "uuid": "589e9e26-9608-4f4e-8f5f-5f57e2be453b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976421, "uuid": "69380e14-51b3-4048-bfc3-e90399c7d801", "value": "9a880d7572486dd985ed6ffbf55eee8875077d9614befc12d5fbdaafd45e86d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5411c238-b072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704971557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971557, "uuid": "557f0aee-965f-44cf-a58a-675c0b98e2aa", "comment": "Malware payload (AgentTesla)", "value": "fdd1432decaad6f0f54e111d56d30909", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971557, "uuid": "b696c00a-ff09-4d51-a7d5-e9431fcc8249", "comment": "Malware payload (AgentTesla)", "value": "9acdb4684a7653fe85b32281195f2d1af944142f6001c38f6793f099dd0f997c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971557, "uuid": "9afc4839-e562-45c1-a39c-9521677ad705", "comment": "Malware payload (AgentTesla)", "value": "201c09315af102b7e9940a3432fa2ec60720dbb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971557, "uuid": "e6fd86d3-4cef-4403-8d33-61f756bbbfb9", "comment": "Malware payload (AgentTesla)", "value": "cb7685fb7d348e6f6f959eca0480f7abcb138996363a55d9ae74b41da6692db0fc4222bae9e5e4212eef41a3306c3eb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971557, "uuid": "745f79d1-6e15-46f3-a5f7-131ddd5e8fc0", "value": "T14E15BD103FDA5AC6DCFA87B90D908E305B697CDB45E1C22D2C89B2DE1520F50597DA3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971557, "uuid": "ab02095f-ea18-4cfa-8307-1f382539986c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971557, "uuid": "22e51af9-ef11-40a0-b5f1-e3677f600c9e", "value": "24576:sjKtD/61I86kej/jqiPVBPoY3D0+O3ZpM0f6u5:96KB/eQDQK7OJbfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971557, "uuid": "668909c2-58d2-4a78-800c-1b93ffa3422c", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971557, "uuid": "5f50df3b-b64e-4637-a906-a8e7d4b083a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971557, "uuid": "4e4e7d75-d255-426a-a69f-301275e5a8df", "value": "9acdb4684a7653fe85b32281195f2d1af944142f6001c38f6793f099dd0f997c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8768d9-b0a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704994519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994519, "uuid": "ae8e07e5-b154-49b3-a59f-65b9f8909049", "comment": "Malware payload (Socks5Systemz)", "value": "96c4dfbddec9361d035ce2ea9c1e1947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994519, "uuid": "0ee5860b-685f-4349-bc19-431ea737a72a", "comment": "Malware payload (Socks5Systemz)", "value": "9ae1049e0579fd8ef08a03d050571ff770d1c8957ddbf210e3257dd88e08c23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994519, "uuid": "604cfd05-59e3-40c1-897f-e04851740b1e", "comment": "Malware payload (Socks5Systemz)", "value": "aa5f64136a082e47cf369094b8a564d70b92bc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994519, "uuid": "376c6639-460b-411b-ab0a-f003b859fea0", "comment": "Malware payload (Socks5Systemz)", "value": "b61fc17555f70c95e5d59a681e8c6c90ccd56af3a264ec1bcfcf487220acd16d1cae4335b1d77e8b6840bc4159ce4fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994519, "uuid": "d8c35d82-3229-423a-9802-004d8f9b8433", "value": "T1E016336316805C32F29EA7F77E2DC4A4C5025E28563C04CE777C896A8A5A371295FBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994519, "uuid": "3d4e07c1-08bf-4f1c-82be-bfc06b331696", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994519, "uuid": "5937e7b1-ab4d-4327-9138-13655c0093f6", "value": "98304:KixbRFQ7Mpnke2rF5mopblfL947/3ZUxyBkU:fxbQQpQdbNc32yBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704994519, "uuid": "b6aee920-d63e-4b8f-98c7-baf543308a87", "value": 4104300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704994519, "uuid": "ece3828a-cbe6-45d6-94c4-2fcfbe2a8f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994519, "uuid": "7656d0c2-bc18-483e-857c-e3d24bb9e2ad", "value": "96c4dfbddec9361d035ce2ea9c1e1947.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb390ad-b0cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1705010122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705010122, "uuid": "270e365e-3124-49b3-94f4-2e49e6c4465e", "comment": "Malware payload (NanoCore)", "value": "7e0a40b7d8fa08b9491926acf7517218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705010122, "uuid": "59c4af90-7956-4176-8046-2b151536c01d", "comment": "Malware payload (NanoCore)", "value": "9b7e70464f16dfdd9a7a84ff0f800de46c8f9a791da677e3abc1c4fbab2d7b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705010122, "uuid": "a260300f-79a3-41a5-b175-b917e9afcc9e", "comment": "Malware payload (NanoCore)", "value": "8f0ffa1ca39c989053da10dad583d0587c82bf8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705010122, "uuid": "5d21a6e5-7ad4-4277-a392-d8861ccdf756", "comment": "Malware payload (NanoCore)", "value": "209fe2bb26a257e1c248877123d716d7374d97236da3cfb58e688f531ecd21f19d2131e209ce15c4b0fa935a5f5a8382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705010122, "uuid": "d0ac24e8-f700-463a-854c-cf20e39368d4", "value": "T1D014CF267BE84A2FE2DF8679611252139379C2E398C3F3DA68D455B38F227E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705010122, "uuid": "f7ac2ba9-7358-487a-b7c1-1d5b1dec824b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705010122, "uuid": "3b8c5ec8-08d5-4424-80b3-d40c168690f1", "value": "6144:wLV6Bta6dtJmakIM5hBKoKA9Hb6Pc2tmNrJ4L3DD:wLV6Btpmk3o776UHpJuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705010122, "uuid": "646fab56-68a0-4937-8b13-5af43046a10a", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705010122, "uuid": "adcd6f63-7d3b-48aa-ba0b-1d7f88d26f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705010122, "uuid": "5226c27f-62a1-4fac-a90d-12b26fa4731b", "value": "7E0A40B7D8FA08B9491926ACF7517218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336ab15d-b091-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704984817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984817, "uuid": "2b501435-9dfa-4fdc-87a5-54875f81ad09", "comment": "Malware payload (AgentTesla)", "value": "55b64154dd86300f8a75000c651d5fe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984817, "uuid": "baa66f33-256b-4999-8a3c-c49b2fc433d1", "comment": "Malware payload (AgentTesla)", "value": "9b916aa3c1b65d602687cee9bdf576ec4c9d163f4481a96ca7d5be486433e09b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984817, "uuid": "259b5914-1003-47cb-ac59-5819d00ec3b4", "comment": "Malware payload (AgentTesla)", "value": "19e5abdec1cbb51f1cab6e4b8aed929bd93afa7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704984817, "uuid": "4d44c47e-8092-4d93-b0da-c7e5e93aef37", "comment": "Malware payload (AgentTesla)", "value": "c4212a57cc8358c0c3a720aef15a8b0f467716b8e91bc53d7190edee22d38119f72a07470365e596c8f2d11539de4845", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984817, "uuid": "1e33cf6c-c3a9-4615-bdd4-3afd9217bd27", "value": "T1B5A57C91A7608476CC159B394AA3DFF515272C3A49D3753637E07A8F3B76FA1083382A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984817, "uuid": "f38767f4-b520-42e5-a2e5-b96b68acfee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984817, "uuid": "924c2440-70ee-4bfd-9fd6-679544b5414d", "value": "12288:Bl+2gbDvJpoRt5Nz7L9xCeb0cMVneECWSqMfGHk16PcI+L+ETdaXQyIpWmlln:PgTJpG5NzD0cMoEhj1UccsEZkepWmll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704984817, "uuid": "cbf46c72-f453-4312-933c-fb1a1c58ff76", "value": 2199552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704984817, "uuid": "4c77496c-f816-4dde-94fc-fe1d96af80cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704984817, "uuid": "c436ff26-9f79-4261-b69d-8c0f78b7fc9d", "value": "rOr__amentosolicitado-TacquoSRL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acdceeb-b084-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704979219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979219, "uuid": "55e0e119-b1fb-4103-82a4-1729b6a25ac5", "comment": "Malware payload (Socks5Systemz)", "value": "a5e5798247e70b6e4ce2b86fc6fd5b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979219, "uuid": "531b4963-be67-4b0e-b389-2f9aa955635f", "comment": "Malware payload (Socks5Systemz)", "value": "9c6d3d24482d750aa59531f45f94824231335167787b248ac5a4cad5e3bb387e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979219, "uuid": "b6735bf4-ac5c-4995-b133-bf411b9674cc", "comment": "Malware payload (Socks5Systemz)", "value": "48a5f5fe9f44072f97651bca65f863526e493621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979219, "uuid": "1cdc7368-78a6-405e-b60f-431c0b1b5f05", "comment": "Malware payload (Socks5Systemz)", "value": "7f976917c5cb5e641c0aee0fad50dcd2f19d69613dbde972baf52a9d7568ee68804d52734b986e4b3be3a85e64ea0020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979219, "uuid": "05d56aac-42c4-4705-996b-8ef3dfa78f8d", "value": "T1EC260141E598FCD4C80B10F7AD79E994240FFB59467D8A2A3967B60A98F72433827D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979219, "uuid": "a1d6f6dd-f0d5-470c-a027-ce3f2445070b", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979219, "uuid": "6eeadc93-63a3-43a8-b260-f403469184cd", "value": "98304:+iqY8/7FL3Rhi7gF5vKhvwE2wjcoEw72L5jdhWqvk3:L38pRhiOAv12AcoE9jFvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704979219, "uuid": "4c695dac-5d1a-4188-83f6-22457983f0d6", "value": 4812675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704979219, "uuid": "bb63f4fe-49b5-4239-bb0b-a9f0b62afbe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979219, "uuid": "9be6ad2f-4857-4013-a56e-35d4e6ac918e", "value": "a5e5798247e70b6e4ce2b86fc6fd5b09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d780512-b043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1704951306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951306, "uuid": "c11b8d72-50c4-48ff-8427-436e2bb0a225", "comment": "Malware payload (Amadey)", "value": "49f4e428134b3d6e27c5435f15b8bf1a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951306, "uuid": "5aa586e4-712c-4fe6-b236-209667896409", "comment": "Malware payload (Amadey)", "value": "9cd9f4e29036513f892a86b7bf96dfd7fc9815c12ca23eb81ca0b4c6926fa235", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951306, "uuid": "d9e4d65d-864f-44fb-89ba-8fa043bd0b82", "comment": "Malware payload (Amadey)", "value": "08583b12ccd93d29a9a450e1ba3e2593151cb1bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951306, "uuid": "8ea94edb-ccf0-4207-ad10-928d13bad1ae", "comment": "Malware payload (Amadey)", "value": "8934c2c0f743bc57def05b773c0b98279f312b82fa4d345c087772be19732c3ef0a0c29011b50416bcc89acc38570fff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951306, "uuid": "a103b1f9-a99d-4639-855e-8b96b1977d7b", "value": "T12C667D06FFA5CE13C1186B37C5E6541843B5E9826763EB0B37D6236919033BF4D8A68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951306, "uuid": "2cde34ed-8b46-4d92-ab23-53e58706ace3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951306, "uuid": "780f5045-0a74-49e0-a805-b5032fd7e512", "value": "98304:XMCRl9Z0Y8phXgzat8yE8ckgtFUlULehDn0mG:XNxZO7gz48ypWF3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704951306, "uuid": "e09a6e2d-7c55-42ca-8a5f-d24fa392dcec", "value": 6496520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704951306, "uuid": "a1fc1b57-7d4f-4d99-86e4-10ccc45f9abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951306, "uuid": "434e4c6a-b141-475f-bd18-980b57fbebc3", "value": "ama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061722b0-b07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (TeamBot)", "timestamp": 1704977010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977010, "uuid": "8f46cc57-0c8b-4931-8e43-f71a8f36154b", "comment": "Malware payload (TeamBot)", "value": "cd2a2421b83821c6c98e6d0bd346d7bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977010, "uuid": "754de83f-448c-4836-9a26-e9b6f5eed2b4", "comment": "Malware payload (TeamBot)", "value": "9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977010, "uuid": "a3c65f1b-86b6-4701-9d7c-2957d92dde35", "comment": "Malware payload (TeamBot)", "value": "0723c84c1e70a010e60b623526d146a469a69420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977010, "uuid": "63da7afd-25ec-473d-9fc8-f0aa94f8122a", "comment": "Malware payload (TeamBot)", "value": "146cf3a53a14a3c74c9a58c20ca0d4c0496eb673e01ceb227f102f914a65a74364682f2a4469329112c0df0566369927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977010, "uuid": "32cb5957-7b45-43a3-ac79-d58c1d9d95f0", "value": "T152E4122171E089FBC65785F1449188A4A63FB4E367B54EC7239553FE1E207C2AE3A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977010, "uuid": "8851f670-bced-47de-b78f-5f3faf635041", "value": "485e4d25637625cac5bb7e098eb97542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977010, "uuid": "0ceb2505-c03a-4f40-b3df-c3625bad6a31", "value": "12288:DFaV1oBGxcJ7Mj8G25d970Ecg3zgb5pzisLx+uGwE9EzX7:8VWBxC8rJ3zgbesLxrPyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977010, "uuid": "4ae0c35b-43b5-4177-9ce7-9de6e5d5433b", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977010, "uuid": "3618b7bf-b09a-4e7e-a094-dbdc17d8306d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977010, "uuid": "734aac85-ed12-48e5-82a9-c63179369181", "value": "9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e19f67b-b062-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704964649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704964649, "uuid": "8eecc4c0-797f-4001-84d8-aac9f8b16f8b", "comment": "Malware payload (AgentTesla)", "value": "601ee4935f7cbc21279f7438ca9fc399", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704964649, "uuid": "7d50b615-9ee2-4a3e-b432-91b2003d6286", "comment": "Malware payload (AgentTesla)", "value": "a22a4df8d6f89b8a880e15dc6ee0c197252d8bd70b6b98ddfafcc73f9bc274ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704964649, "uuid": "35807dc9-2a9e-43b3-bded-f3c754afbc51", "comment": "Malware payload (AgentTesla)", "value": "245e17bc65659a7f98c6a7878c7b20c020a4a892", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704964649, "uuid": "d5b9d178-ff3f-4264-abcf-e9e48fbb8710", "comment": "Malware payload (AgentTesla)", "value": "2f1f598d55917eba589e638a61627b7dd8ec651912f8aae18e9a10888b616f7fd0adf2b32c0225086905bdd145211c05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704964649, "uuid": "9d8a6829-4127-47c8-8a6a-a69e34aad63a", "value": "T160D4122872DCAB39DE7E9BF4917130224375BE623166D7AC1ED120FE1562B004B4AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704964649, "uuid": "914a36ec-efb3-4cd3-82c1-d3852148e0d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704964649, "uuid": "3c44e191-625d-48c7-ac57-38a597131669", "value": "12288:zb0ab9DhTu+DEz9kEQu+bznFJt6hlrLF/axEx2O33uHLfh:v0K9UoEzas+bz16hlrZ/GpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704964649, "uuid": "fb8f3e17-a22b-4318-9bac-712ac77eeff9", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704964649, "uuid": "8c43ee0b-76dc-4735-817a-262826e72e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704964649, "uuid": "92ebba62-6f2d-4cd0-b6ec-450d7c4e1490", "value": "SecuriteInfo.com.Trojan.PackedNET.2574.20212.15394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f1545-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704940322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940322, "uuid": "466e921c-76a2-4be6-b679-a48c20262a84", "comment": "Malware payload (Mirai)", "value": "a07ac9245fde08037056cfb67f81f639", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940322, "uuid": "adfbc819-a12c-49fe-af1e-2b628804d3a2", "comment": "Malware payload (Mirai)", "value": "a39e5649a4cd0d4c5221d7e4de521cc2da74ee9a685d05ea55a22b5e86b9793d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940322, "uuid": "63792c15-bd10-4a5a-8a9b-ea726eb78b59", "comment": "Malware payload (Mirai)", "value": "a2d463c4ced90e91c0a92cad988c2151d9eca905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940322, "uuid": "5029ce04-32e9-4781-9d87-03ba94e18fa3", "comment": "Malware payload (Mirai)", "value": "357f4e33a67a6faaf607968213aa068c69a89f2c6c832c79c5cbeaf69b2b7273e16a2bbe6bfae696d4a20d09694faf92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940322, "uuid": "c3cac85f-fc36-4aaf-a146-6b377029e467", "value": "T1C8637209BF614FF7ECAFDC374AE92745208C681A22987B397934D818F24B25B15E3875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940322, "uuid": "fc245167-8bc0-477b-8966-3cd215cc6968", "value": "1536:fUAYr/8Xm8e4JHFGh+yyetEiDN+ZeRpN:fRYr/8Xm8NFqN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940322, "uuid": "e553beba-5b05-4b14-81aa-0ffc92640cd8", "value": 71664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940322, "uuid": "653b69ec-ff05-4b06-ba7b-784eede393bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940322, "uuid": "bf6428f5-2ea4-42fc-bbb2-d5bcb9ef71d9", "value": "a07ac9245fde08037056cfb67f81f639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9ce90b-b0d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705013526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705013526, "uuid": "6836e0b6-b949-416e-8ccc-389b61a426af", "comment": "Malware payload", "value": "f42d1dbf1529fba1092b22220817da40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705013526, "uuid": "7c1a787b-9ae9-496a-86b1-ed3c3ccebb11", "comment": "Malware payload", "value": "a4126b3c8ddadad5cc7470f1e967cfe6e2370aec7a20a815ae3ef48b774a22b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705013526, "uuid": "5c3c1041-3825-4692-b801-eed5d5ba3b06", "comment": "Malware payload", "value": "c0d4dbf4f763b2fd7ef450bd37d4e76f14d1b95e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705013526, "uuid": "5f24d5e9-b694-4096-8533-c8ec1e7bcea7", "comment": "Malware payload", "value": "c0dfafc5f5db2d2cada06295fa34972a8a5a76993935b4d0bf07dcc5138d1c5ab5d6473f2a522d6a3e218b3e869220b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705013526, "uuid": "f1ea7514-6b66-40ca-92c5-a9521eaf75df", "value": "T1EFC533E367A9F80BC78357BC8DB95F0B692688D33F7D621E790E93065D20A345921782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705013526, "uuid": "85237c35-7972-4f0c-a8b9-033b638bbb20", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705013526, "uuid": "5adde0e8-1e2d-41c9-93cc-d6c57f0c3da9", "value": "49152:/vzAULNVK3dNUMSsef8kT6gn5D3BN4Px5mNrm1NwbOfK2ASLMWJZKHlA0lCv:Hz7NVcSRRxNGmNrcOCfK5S4cKHlA0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705013526, "uuid": "892dbf5c-0c8f-4255-804f-07e7624256a9", "value": 2693632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705013526, "uuid": "1edce32e-b175-42f6-94e6-aca5db175e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705013526, "uuid": "88df8435-1b2c-4776-98b5-ffd0b435de6d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6aa3ff-b093-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1704985884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985884, "uuid": "cf7601ba-5f8d-4078-b403-1642dd4f6509", "comment": "Malware payload (Amadey)", "value": "274d41d32b4b20420fbaf7366a618efc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985884, "uuid": "d4bf4cbf-3104-4e5d-b51a-91d0194d144e", "comment": "Malware payload (Amadey)", "value": "a46266ddb15dccb8b2a5bb023ae3fe3ca5afc5972559252721eba30d30d7d996", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985884, "uuid": "94b3fd2b-bf82-4aac-a49d-f4d77978ce07", "comment": "Malware payload (Amadey)", "value": "e2d3c0ffd9ad4c6787804cf0c415a3cc28d07c9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704985884, "uuid": "41b80286-8799-467d-8088-06c6af4ef1f7", "comment": "Malware payload (Amadey)", "value": "79efd72bd7742744bf1ed15e15539e778e27dd06abd6e50c62d98c6308e06bdc1597e845489e23e27c69d817d54cfe21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985884, "uuid": "176fafcb-1ab0-4f9b-90d2-dc6b2e3af0af", "value": "T1463633713BCD62B4DDBE35F00EF597831F2E3C9A2006B73F5BA855970869768802971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985884, "uuid": "a199c390-ff11-41f2-be8c-a7f6a54782d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985884, "uuid": "1e2bcca8-ae56-47e5-83a8-3609c4058434", "value": "98304:bmSKkkWZ15wUqdDboTuFW5q0tfWFzAeESKm0u6hetnr7SfvWiIjBum:g6f5fTiWM0tfWFzAeELm0u6mnr7goAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704985884, "uuid": "061622d7-2ba6-45f3-88e5-0c5819c12b90", "value": 5210112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704985884, "uuid": "f6543134-fa91-4059-9106-d880da11c2c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704985884, "uuid": "3f9702b9-bc22-4fe9-aaa3-62636af11b85", "value": "274d41d32b4b20420fbaf7366a618efc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e357ea-b048-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Nitol)", "timestamp": 1704953689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953689, "uuid": "5a241f05-d2d6-46f6-b8c7-839cc404e00b", "comment": "Malware payload (Nitol)", "value": "8b004afa75742b10b3642990804f42f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953689, "uuid": "91db5f44-89f3-447e-8ec7-6a06de5efae7", "comment": "Malware payload (Nitol)", "value": "a4b0ee25d1fcedd5c3acb39e5a04a1b3a2e6df417d6522d96e74c1411e80df73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953689, "uuid": "ef6e09ac-57aa-4cc5-afb8-eae9fa884fbc", "comment": "Malware payload (Nitol)", "value": "e61166dce67d30c7ebbbe1cf1a5dd5f06981251d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953689, "uuid": "bcd17fc7-aef6-4f89-8381-7b5fd36d1c8c", "comment": "Malware payload (Nitol)", "value": "84a56fc3d769fe84014765ce6efcbf345db324bc1e0729214f7bb5f996a51b52cebceb494e65835b4e71886abb4c57a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953689, "uuid": "5b39e0f5-1a54-4b6a-9947-5149b2e6f56a", "value": "T1E7C312A7233C7273C4A35E764E3984D6A828D2F0AB62584B1C6EC1C5ADF3EE1369541D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953689, "uuid": "2abd672f-f0e9-4e48-86d0-5c108802dc4c", "value": "e58ab46f2a279ded0846d81bf0fa21f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953689, "uuid": "cb8a6771-5889-4471-b2e9-c43da382a9cd", "value": "3072:SyIpG2/iDbY4cAA6pLPPwxTFNDbiHBPOGm/Bp7/m:jIposwPPAidOGUPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704953689, "uuid": "dd941117-7053-4e1f-9d3f-2e48372da971", "value": 122904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704953689, "uuid": "4ebf21d1-8840-4f45-a391-7cfd8009883e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953689, "uuid": "b4707862-39eb-4319-8e01-256ba72201de", "value": "lve.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cff6150-b07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704976753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976753, "uuid": "c6a53f3d-9b59-4cd6-85d1-c2d5a7fc7795", "comment": "Malware payload (AgentTesla)", "value": "e68f3ecd7af94914065ac026d08e7469", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976753, "uuid": "c90eb1af-f3fd-410d-ae96-b776f2e70e77", "comment": "Malware payload (AgentTesla)", "value": "a50118bac3fb65a828d03e2edb5492112070084f6707527a2fc964cb1ea22623", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976753, "uuid": "352bda1d-6902-4659-8a5b-06a28fb50bd4", "comment": "Malware payload (AgentTesla)", "value": "2d94838190a7af2024b1d604450a47d4cefb9f8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976753, "uuid": "b3016213-771e-4017-820a-fa1bae8e192e", "comment": "Malware payload (AgentTesla)", "value": "6275bc6e8a9e295966364d70cb76c6cec285d209b0271f3087bcdfa512054d772b7b976755a11f3fa81fe8726256c7ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976753, "uuid": "197fe2c4-6490-4e70-a168-1c2ca8639f02", "value": "T14815C0396BBF1627CC67C6BBCBD4DC27B15088AB3C01EA6555C7539D1372A8224C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976753, "uuid": "a914d5da-7f5f-41ff-b184-d318919191be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976753, "uuid": "52c51813-6ee6-40f3-a50d-33c02e6289e7", "value": "12288:noNG9cEX/XUVUfJGVJx064BYjMvcVg7vD8nja1Bq/ta+dMouIE:ow9/Xyi64BYjM0y+aBq/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976753, "uuid": "53643b28-10c9-4e55-a07b-9cc4a5b33ac4", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976753, "uuid": "f8afcfea-39d0-46b9-9719-d01b2012ec20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976753, "uuid": "8f3866d2-1c7c-4b18-8953-946711791a9f", "value": "a50118bac3fb65a828d03e2edb5492112070084f6707527a2fc964cb1ea22623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e6327d-b06b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704968821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968821, "uuid": "97345b43-d0ca-468d-962a-1beacc78901d", "comment": "Malware payload", "value": "dc6e6cf766f26f33923baaecac486939", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968821, "uuid": "1160f586-a3f5-4b02-b1d4-854e64fc1e24", "comment": "Malware payload", "value": "a5216581d8409ec302552e340b7e7abb118e7af9b42cac295240aa5a364da628", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968821, "uuid": "3cf23c3c-527e-4654-a703-dce0ef3d5907", "comment": "Malware payload", "value": "a72fafce37472c6480d4ec39280fe807df9adf6f", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968821, "uuid": "dd02cb28-91dc-46de-ab80-983fa02a7405", "comment": "Malware payload", "value": "97128b1cf436a624dd15e235ce11d6a3aa45660bfdc133a3ec62970412d1cd338d56941ef5984168ca2dd10c03ecbcf3", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false }, { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968821, "uuid": "904cdc11-96e8-437c-98c4-f51636f51545", "value": "T13DE27C06DC051A4BC173A23DFE388DE929A58C0B5814699E95D5398F0FA8EC72F0D3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968821, "uuid": "866994bc-5832-4db1-9166-f47169334fdf", "value": "768:nCESJSLVr9NA8bkXIxCb/m7TWnfznYooAqzi1azWCYgBadIMS0bS02S0dS04S032:nPL3lU/wIUypEV1J5ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968821, "uuid": "97da9b09-cf35-4824-a3f3-51be308d9573", "value": 34180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968821, "uuid": "3453f3eb-8d61-4811-be7a-e259acc2a975", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968821, "uuid": "ce455c60-b409-45e2-96b6-2885a33d2eb9", "value": "ssdf.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7714009f-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978488, "uuid": "f3c4d890-530f-4f2e-a360-278823bca43c", "comment": "Malware payload (Mirai)", "value": "2f0e5b94080e482fbf08e28524c71bc1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978488, "uuid": "8cc6769c-d47d-4500-981e-f84d4e31030c", "comment": "Malware payload (Mirai)", "value": "a5aaa929d94c5742bcaf131ece5655978a46646d9ffbd071a64ba8326448f8bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978488, "uuid": "041bcef0-3078-4225-9149-a4cf74748ffb", "comment": "Malware payload (Mirai)", "value": "f64bebaea763e85725339b81e9de80767a8470eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978488, "uuid": "fb7e43ad-e0a7-4b00-87a7-10e665091f74", "comment": "Malware payload (Mirai)", "value": "8d95273129bf57c4782eeebf26110b66aa21c43483826ba538bf18e36b5f9d70d0bc342bc71354ccfa8959b78e783459", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978488, "uuid": "916a0d53-1a4b-4459-8cd5-5cbddf734001", "value": "T1E1B37DC0F643D4F2D85301B5617BFF369B32E47A2126EA82D3B85E31AC91452DA177AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978488, "uuid": "24aeb6f9-9e54-4dd0-8dab-c1dcafc2b4f3", "value": "1536:fsQmF9Qstp3td4v12432q4IvZWvNoHtnfEHVuSjhZMOmo3BW5DWZfY:EQmF9QstpeY432B/v4tfE13j8AYDWZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978488, "uuid": "64cc5c41-8f38-4765-8cb4-24f7fdf06c50", "value": 111144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978488, "uuid": "0e6bef24-4b11-4f15-b304-ef80c7d3b6d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978488, "uuid": "2aa15a8e-a417-4ca8-afb8-9f59445e79ba", "value": "skyljne.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af732a75-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704939069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939069, "uuid": "8dedffa0-09c2-4051-92af-2973e7e800c8", "comment": "Malware payload (AgentTesla)", "value": "18b1d67cad6f52ea57ef9a0e1186e5b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939069, "uuid": "efadb5cc-0517-4101-9700-5c0cd6d46258", "comment": "Malware payload (AgentTesla)", "value": "a8631c78d87a3b7ff90f4f752a74dee4d4f7c550feaf247fb21b74363db4e0e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939069, "uuid": "dc91fcf7-92d2-429b-99f8-ebe9df07b88d", "comment": "Malware payload (AgentTesla)", "value": "b7b7059ccf03ca0504ac78ff3e61a721a62d4469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939069, "uuid": "bd70bf84-542c-4b5a-b41c-ce924fdfaf72", "comment": "Malware payload (AgentTesla)", "value": "debb6d5190acfc5bd46b48b374a952d1face4aa52000d9a2274d2c2e18b6e4187d55f52414f0e2cb4640633858755ec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939069, "uuid": "7216ac83-0ad6-4025-b006-77f01fb7988c", "value": "T194E423C4BE5205EB6A3CA26771E4B0BC224A5E99387C160F619DD26C37DF409EFB7610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939069, "uuid": "ab685012-936c-4b12-a6cd-7d30e9134afa", "value": "12288:NGTNjG9/vbfeqkD1r5N6Ag47YJK6u2kbWF/PhcNrIY2T2pbR:wTNAXq7D1r5NrSJJu2JeN0Y2yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939069, "uuid": "13dd676f-34c3-437a-aeef-c7d51786ecf9", "value": 698144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939069, "uuid": "ac2173dc-fdbc-42e4-8b5c-cb0d68b1cf77", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939069, "uuid": "6ebff5c3-bc85-4054-8af7-a53f4c31549e", "value": "cotizaci\u00f3n.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73987d6b-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943263, "uuid": "74a3e7a7-81ca-47c9-a9f5-6b6383322aa0", "comment": "Malware payload (Mirai)", "value": "8472df395dfe4d8636b7cb4679b7c611", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943263, "uuid": "457a9937-a294-400e-bb00-8920e54f185f", "comment": "Malware payload (Mirai)", "value": "a95c553ae1f438d8d07e40ec062ece319cce83feb4d94aba24aeb73483563363", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943263, "uuid": "a0372ea5-325f-4f03-8cfa-21b8d9aecab7", "comment": "Malware payload (Mirai)", "value": "d52f1dfcb591aad1462f139dae25b128f917ed91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943263, "uuid": "a50a9998-9a43-45eb-87d7-625bf627a0f6", "comment": "Malware payload (Mirai)", "value": "bae286ca656b80b5c65e42d3b2b6ef3766b768889a2245d2157d7c99bfb53deebac13624dd5ef4a7e3f18232628e4bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943263, "uuid": "433f2749-ac04-49a5-9a42-4965645a50c8", "value": "T146338E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943263, "uuid": "932b5219-6e7d-4711-afc8-c49e73d8e0c0", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40FdiCJyGIsuJLk3XCmlolN9aXCxP:EcdC753UlwtNFJyGIsD3X3qlGXCxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943263, "uuid": "a4aa9196-56d5-455d-aff5-7aa6bf3ac436", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943263, "uuid": "b0db49f1-4947-4e3f-b461-0ef3e3348273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943263, "uuid": "7e96f712-f348-41f2-b9c4-e59e948e381d", "value": "8472df395dfe4d8636b7cb4679b7c611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20882912-b0a1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704991657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991657, "uuid": "3e991420-e862-425e-aadd-d598e7129c50", "comment": "Malware payload (AgentTesla)", "value": "183f310098af8d481da0b6987becb073", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991657, "uuid": "93fb7baa-8f15-410c-9a4b-263ddf94b3d8", "comment": "Malware payload (AgentTesla)", "value": "a9accaab2a3a2a724d811b2e1cf86a08ad3754dcb2eb325188ab1c2a7543341f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991657, "uuid": "a2a7ada9-c312-4f32-9c6f-ef4165f6939b", "comment": "Malware payload (AgentTesla)", "value": "a5f69275a2cecc06bfee131ca17a1ac50fb4fff1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704991657, "uuid": "53fe1bcf-b6e7-4ace-b411-44507f826df3", "comment": "Malware payload (AgentTesla)", "value": "1a5b8ff8f7b1ef4c994c1772ea15ad3dc25e6a057b5a04279a538d39c6d4f92818e079c26e9b9926af9c9f90b90ed016", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991657, "uuid": "af8e96c8-a396-4f68-903e-2a05140a0098", "value": "T169D42310729D9F27F6FB53FC6065541187F65E120822D78AAECB34E316B1F098AD1B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991657, "uuid": "35d388b2-41d2-4c02-87cf-25d66752bf45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991657, "uuid": "3f9b098b-551e-438c-ae69-9a5ee2167991", "value": "12288:fbb/jUimEqOKJt92Pk6fgkRHgMzMvFZGWiXEU0zr00B8WrWsD://jUipsT8voSHgJvr+EU08W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704991657, "uuid": "515553bb-3f01-48ab-873c-196cad3cceb8", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704991657, "uuid": "84569e91-c802-41f4-84d4-4a45385e5f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704991657, "uuid": "c96dc239-68a4-4f34-88e1-d4cf05063a12", "value": "051223_JOK_JOKSP67123_MSI - Marine Spares International.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019cf22c-b03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704949515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949515, "uuid": "5ebdebdb-2344-4edb-b1b7-8a66a9750003", "comment": "Malware payload (Socks5Systemz)", "value": "dda4cfea733568dda31721343e0034ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949515, "uuid": "d8057546-a402-48e2-bde4-972bc842b73d", "comment": "Malware payload (Socks5Systemz)", "value": "a9e0912c51dbd477ad269595657e9fc5d826e3d453fb83c9858bd76320a5a19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949515, "uuid": "b2281d42-a7a5-4455-bc29-a9fadd3cbe3f", "comment": "Malware payload (Socks5Systemz)", "value": "f483181d817ae131403a99ed5b77b0268316ffb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949515, "uuid": "b2e19642-fbc1-453f-ba6d-ac172d1cda0c", "comment": "Malware payload (Socks5Systemz)", "value": "a9722efd0895c7b357917f2233e1bd4c33eed69498fa69cf393a904169bf4ada813e21cf94fb29190ff3f773fd9fc196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949515, "uuid": "fbc67174-c6fa-4cf5-9f14-ceca9dfa8631", "value": "T1F43623194FAEE855C2C148F06EA1B69CE0749E612EBF02976DE3BD6FE879B4C3D15100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949515, "uuid": "3867fb34-1837-4210-bd9a-99bda52c1eda", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949515, "uuid": "4211d159-1b76-4cb2-8bfe-2e9f00bbe47b", "value": "98304:di/pvA3Q7kWujbAIms/tyuf/YGNDoPLg7jrOBPzoIcWwuke:E/pv0ekr0a/tyKzNDoyvcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704949515, "uuid": "f223aa73-894a-4246-a2b1-edbc8b1a8b9e", "value": 4874699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704949515, "uuid": "aa0bdf50-82d2-496e-986e-02549f9e6cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949515, "uuid": "3c439bf6-8e0a-4c1d-a2eb-d052e17a49b8", "value": "dda4cfea733568dda31721343e0034ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7dafa1-b071-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704971118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971118, "uuid": "39c9be5b-c99f-43e5-8a9e-484eecd7e07c", "comment": "Malware payload (Socks5Systemz)", "value": "ea41a507e73fc30d388500a168611017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971118, "uuid": "1c914644-70e8-49ff-bac7-fa340f8e245c", "comment": "Malware payload (Socks5Systemz)", "value": "ac1ca9910b47c73f279ec42a5bbfc19424805f8dcbd8457d7ef32199219ff70d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971118, "uuid": "d71e32e6-b706-4bf2-86ac-3f18b58d2143", "comment": "Malware payload (Socks5Systemz)", "value": "38095a9c678ed9b015d82037d7874329ac18ed53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971118, "uuid": "9db68717-824f-4428-a7ab-4632ec257fbd", "comment": "Malware payload (Socks5Systemz)", "value": "35896c9150052a9f86fe42c0e72d0482043b7067dfb8c98c23bf3ef6dfb63bf845365122eedab91daae87b91bc0862ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971118, "uuid": "d8a38011-e337-40e9-9c63-372117b75f8a", "value": "T1FD260251F199FCD9C80B10F3AC79DA94241FBB5D467D89263967B60A88F3643382BD0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971118, "uuid": "e610a2d4-0c25-4905-9017-10e6031e0128", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971118, "uuid": "39cea6ac-5573-46b6-b55c-20d6e2228322", "value": "98304:Oi4XK3uF47K05hzVgRgwjQMaqalaXWRCKhVrJZHsDQCmi10ApMkY:74S+xKhWKwjp9alaXWsKvJtsDQXimZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971118, "uuid": "ffc14aa8-b757-4205-bfd3-d09b98fe2282", "value": 4813027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971118, "uuid": "2e083750-5131-440d-875f-f5837af89e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971118, "uuid": "99f68936-7632-4eb2-b672-e62bdaabbac7", "value": "ea41a507e73fc30d388500a168611017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b9e4e8-b055-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1704959123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959123, "uuid": "20238184-7ada-402b-a3df-83ee1a558791", "comment": "Malware payload (QuasarRAT)", "value": "5462e80e464d9b44b4f0226f0b6d5c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959123, "uuid": "a358496d-68af-4ef5-a828-b83863ba0120", "comment": "Malware payload (QuasarRAT)", "value": "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959123, "uuid": "e9bc453a-f2f9-4c2d-a287-6704fa08a905", "comment": "Malware payload (QuasarRAT)", "value": "599e0a1630cc02a29a34e26a4fc810b7899412fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704959123, "uuid": "b1fbd068-a571-4afc-808d-fe73f0b26361", "comment": "Malware payload (QuasarRAT)", "value": "72e756733959bd9654cb928697cfc7f68785044e6d0e96ae2d27feaaa718e6adfeec3273f1685c401f2e9c25f5456511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959123, "uuid": "b7174b31-88d8-48bc-b54f-1936bd2161ae", "value": "T1F3F57C143BF85E27E1BBE27795B0046267F0FC1AB363E70B258167BE1C53B5198026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959123, "uuid": "e6325595-ad10-45da-af1a-b08076e4a49e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959123, "uuid": "f7c67ab9-1ebe-43e6-b038-01679a6288ea", "value": "98304:2vo22SsaNYfdPBldt6+dBcjHjgRJ6znwIC:I97jySnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704959123, "uuid": "962b207d-e7b2-4db6-a068-49f6fa3b4a2d", "value": 3560448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704959123, "uuid": "3c745e3a-0231-4667-a12d-5164d1fc59c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704959123, "uuid": "7c92ac8b-ae38-4b9f-babd-2465cef960e4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79decfcc-b07d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1704976345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976345, "uuid": "22b67083-7a41-4cf6-a087-2278f8443a80", "comment": "Malware payload (Stealc)", "value": "a108573e91eb4a485e600f1c6cc744b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976345, "uuid": "2265d096-2e5c-4ef9-83c2-9b24b48870c8", "comment": "Malware payload (Stealc)", "value": "b012a728ee730420d06896b13cfd47e32648eb8b7830850709ebebb0f154b796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976345, "uuid": "42b010f1-2c5f-48f3-b096-2c94c9dc68dd", "comment": "Malware payload (Stealc)", "value": "4fa45ce8270cb704dff723361521fae517d45b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976345, "uuid": "d2cef997-8617-4c0a-ab34-c106bea82880", "comment": "Malware payload (Stealc)", "value": "8461e7a8088372e8920e3aed38473692dcb40fe627608e6f825f45422c9620354bc1b3ff0720ea8780bc7505b242e931", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976345, "uuid": "c3018545-b866-4161-811c-360cac056874", "value": "T1F2548C1132E8D432E3F319314634C7F40E7B78726925556FABE02A795E24FE1AA3077A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976345, "uuid": "6d395bc4-87c5-4580-85eb-f7b260540882", "value": "7b95afb364b30c2601be314c6a7cfb71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976345, "uuid": "5917d17c-b8c5-44b2-a7dd-99d77d98affc", "value": "6144:EecUWVVdrLt38rfCW/1Vq2biIrfKBCbRXMA:E2WVnrp38rfh/1Vqmi2KBCbph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976345, "uuid": "bac04cc7-815f-4da6-acfc-7dfae19d5dc4", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976345, "uuid": "bfca8461-ea8a-4b44-8ce5-895f6d948223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976345, "uuid": "b9a46498-1166-41af-825d-4604ef4a23e0", "value": "b012a728ee730420d06896b13cfd47e32648eb8b7830850709ebebb0f154b796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5e9a94-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704939091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939091, "uuid": "996a1a5e-5457-4668-8627-9313ce038c21", "comment": "Malware payload", "value": "298be742cb1b0f46f7afc3f43ea55969", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939091, "uuid": "4557d8a5-f4a2-4155-a415-9e057746bbdb", "comment": "Malware payload", "value": "b13ed6b2a024276daf241afdd7a98700e3007815cb7ecc2d09531c34beb1d0e7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939091, "uuid": "6bee97c2-faa1-486b-9c8f-7ddb6e7aca7d", "comment": "Malware payload", "value": "7a97236e1d666de5db54ee0926ced2f19e5f78ba", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939091, "uuid": "da5540b1-8ee7-446f-9824-508188d844c8", "comment": "Malware payload", "value": "246049e68e778c8080451b7a0c2b933fcba51bc8e8f13fee8ab09d418892e2579697f445a368e50193882d7a4e7f15bd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939091, "uuid": "bb7c7ee8-51f0-42b5-be3d-b92225d3b5e4", "value": "T11B115A6503751D7EC4B652B5CC3A6D0C98F68CB20F4ED09EE9237184C9796922F84B0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939091, "uuid": "0f7f4548-52a6-4e56-a316-70e64b42be8a", "value": "24:8rBJldARaARA0IEgadESB40uQITf6Rag8E4O:8VJzARcadl6Tf6Rag8rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939091, "uuid": "b0867269-b1f8-497f-b716-c2ee05ecaf45", "value": 1074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939091, "uuid": "1607d7b4-450a-4a55-ae0f-7726c8882bca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939091, "uuid": "a280afc2-f6b1-4e2a-9018-99c241974916", "value": "749751554253107285737.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862c5774-b066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704966487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966487, "uuid": "b08866fb-0e9d-498e-a4b6-cc034eb8a846", "comment": "Malware payload (RedLineStealer)", "value": "7b1bf93f6ec76067f6a35c7328c991fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966487, "uuid": "8518824e-9f72-4609-81e8-f0170677f59d", "comment": "Malware payload (RedLineStealer)", "value": "b3b22e2ee95e4f84c9d88a6b110c1c884fc5f64266107d2928d75c4cf6748a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966487, "uuid": "b2355683-fa48-45f4-8632-bcb9729a30f1", "comment": "Malware payload (RedLineStealer)", "value": "bca563ca5175baa52c67846fb03fc4f545e91a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704966487, "uuid": "b506fe17-caf4-4ca1-9be4-beaf646f1681", "comment": "Malware payload (RedLineStealer)", "value": "c48c6acabc5ea4af19f105e75540398a9d14ae1d110281251059950083dced446b4f6a2903a7f09cb67969649f4660fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966487, "uuid": "34a68c14-1da2-43ad-88ad-1dc706294b5c", "value": "T1F14633FCD229B97EE2748A7A0B5F8145B7A2D2B447E11A38F65B703F1C18323C56AD14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966487, "uuid": "77e87561-8024-428c-9326-7b12aeaf1789", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966487, "uuid": "53fb07d0-1d94-4e33-ae1c-b5ea043915bc", "value": "98304:iQiamK/6JAKS1j5yTDtFSj0aimfuQVySAxPpJYGdp7tEvk+:1mKz3DyTDtcQaxG6V4J/uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704966487, "uuid": "67bffa55-5d27-4091-b2f7-af94a08ed74e", "value": 5407232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704966487, "uuid": "2a9568f0-42e4-4664-9a16-61f687488d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704966487, "uuid": "cd50943a-4154-4c4e-8f7a-a462511f58e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5607caf8-b0c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705005920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005920, "uuid": "d64ebe21-dfd1-4e78-b137-47324d0001a7", "comment": "Malware payload (njrat)", "value": "4200c03ff788f1d0a9f650f3df83c6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005920, "uuid": "815c094e-e653-4eb5-8e25-fc61bad54f7c", "comment": "Malware payload (njrat)", "value": "b45913c02189ace3a8b69802b6d514811a14120ddd5a3c90cc68888571d4837f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005920, "uuid": "f80018b9-0f08-44e6-8124-9006be19a0b5", "comment": "Malware payload (njrat)", "value": "b16adb0457c9f729dd833dc673cf70e354c7e2c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005920, "uuid": "d05a6c70-4eb5-4292-8e03-e068e5bde510", "comment": "Malware payload (njrat)", "value": "aa1bc5d28679500506bdced2efe8c6e43e227798e6648ba9b7c88951cc5409b5cd11dfb8676b3061075b7de71c14f80d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005920, "uuid": "df601068-8865-4114-8841-45dbaffe2898", "value": "T163535A59D7F04E22E5F6CA3440E49115772BC12E289BF7FF0774EC762A87258DE0226A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005920, "uuid": "f227b775-94ae-4ef9-8c12-7e6dd2ad9268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005920, "uuid": "964e0028-9d2c-484c-bc8a-61528eb015bb", "value": "1536:+LClIfx01peE/jXXgwgnItzeGfWj7fVf:iz01peELXgszd+XNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705005920, "uuid": "3d4ae024-aa04-4ad1-a503-4857028a56fc", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705005920, "uuid": "1b1a161a-7ce8-4e70-83e9-21d1a65d70db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005920, "uuid": "00b40f01-b4d6-4735-8b7f-1a236530f716", "value": "B45913C02189ACE3A8B69802B6D514811A14120DDD5A3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af01a2d-b081-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1704977904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977904, "uuid": "566f9435-01e2-4621-8f01-422c8f506d5a", "comment": "Malware payload (RemcosRAT)", "value": "e2473c2832fb852d2aa8785e90b285a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977904, "uuid": "dce7f640-dd15-4c22-b8a0-f90c96681a6d", "comment": "Malware payload (RemcosRAT)", "value": "b67319d5978b2236bb8a735b1838b18b6432cb835fce1b9b08ff2d68e012bc50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977904, "uuid": "a41794e9-2c78-4acf-9ea1-f5f0b43a3ff9", "comment": "Malware payload (RemcosRAT)", "value": "663f5fd69dfd51e8608ea5e2231319923db26b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977904, "uuid": "11c2e5ec-991a-40d4-b07d-a980df2158a9", "comment": "Malware payload (RemcosRAT)", "value": "0a310edcce48d5845f02f34b2ed73986dd84ccc81051073a196a4fa41438c8612b2f6c09672ad2c071d47b0619385546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977904, "uuid": "5c3a226d-8877-4a5b-a124-79e99ee8b06b", "value": "T16625124537ACAF4AE1A553F50A51D000A7B17D66567AFB0C3CCAB0CE4A79FE04B22793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977904, "uuid": "9155d440-f3a4-4a93-81f1-8b2bfc81040b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977904, "uuid": "9f3e54d3-4840-4be5-a971-a11fd6a0531e", "value": "24576:i9PtD/fmh3G6dGSCjFqHvwy8zfGIvtooo:UBt2GtFqPwGjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977904, "uuid": "aea4200d-dff8-4868-8505-375760edc9e1", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977904, "uuid": "23f9260d-61b5-4875-b57c-e0401883133a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977904, "uuid": "945ea908-884b-4201-9088-58d2ff7a591f", "value": "b67319d5978b2236bb8a735b1838b18b6432cb835fce1b9b08ff2d68e012bc50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e2d7bd-b0c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705008017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008017, "uuid": "cfa9dc43-9b40-48c9-a19c-b301651c036b", "comment": "Malware payload (Socks5Systemz)", "value": "b95b568ccc08cbe051a84ef0871e11b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008017, "uuid": "951f0e81-4acf-4e64-ba2c-b5bb7b85c58b", "comment": "Malware payload (Socks5Systemz)", "value": "b6d3fe2a1b36d208fb9451e694bc9ca45b6cc56600fb0a2aa8d49629345d0ecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008017, "uuid": "52ca2e1a-3b24-4f1f-92c7-c3a9e3d89340", "comment": "Malware payload (Socks5Systemz)", "value": "b5bf029f67193b1c9183565e712851740c7d423f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705008017, "uuid": "8fe4f3a7-ef69-44b8-a451-0b7b2085aff5", "comment": "Malware payload (Socks5Systemz)", "value": "48a4bce268fb3b3c454752ff1cc94a5ed16eaa21cf6a504779b6e37e4171a4238dfe170e2db1287ab56c4159b6258a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008017, "uuid": "54ca719d-ab9e-451c-9b85-0bbe01c24de9", "value": "T10F163307CACA203AE206CD746C15355086B7FA6A5DAEC49C3DEC68BC1F5F71E4E05B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008017, "uuid": "4f05fda3-91e5-4e69-b8cf-67ab32c1337f", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008017, "uuid": "5c187f29-264e-410f-a9f0-2bbe948e51c2", "value": "98304:uioJmHommUV3686oLUouPUf0USmJK2mU+uNpo7XbQko:boJIP/xUoLUo8jmp+ugrQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705008017, "uuid": "2064a218-cf2e-4ecd-a56f-01b818a06a7c", "value": 4103011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705008017, "uuid": "2c2199f5-d30d-47f1-bbe2-a578923da0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705008017, "uuid": "6f162009-7da3-4634-95d9-551b9781f9e6", "value": "b95b568ccc08cbe051a84ef0871e11b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f2321c-b03b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704948012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948012, "uuid": "5407314c-05cb-4851-9eed-dc814ff423dd", "comment": "Malware payload (Socks5Systemz)", "value": "6ff9dd6d1cc447f96c3d71692602f862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948012, "uuid": "dd65ed61-229b-4dde-beb7-d5ef7ed04285", "comment": "Malware payload (Socks5Systemz)", "value": "b74ed680f0ede6f0d9d864481aee4f7e12137f25a4ad071524a2ef7e9a61a7ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948012, "uuid": "de766652-4b89-4daf-b8e3-951023f2f72d", "comment": "Malware payload (Socks5Systemz)", "value": "ffe0b0ff1226f4c92e2f5cf4786884c1aa805ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948012, "uuid": "41211110-89ab-42ce-b8d5-c1d2ababc037", "comment": "Malware payload (Socks5Systemz)", "value": "fc17f72f830740c6cafef54fd3d5db1d1b004b692c7072f09fa14ddfe98d97eeb1ab1d0479418e135c37488539ee47df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948012, "uuid": "b05aa169-dd42-4aad-b07c-1880a68a97d3", "value": "T1113622158F7DE96AD2C009F46E60B6ECE1789E611EBF02426DE7BC6ED579B4C3D1A000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948012, "uuid": "bb52de8d-81bb-46ba-8cc3-b883d5833380", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948012, "uuid": "efcf321d-28e2-4bff-8303-bb92c267a1be", "value": "98304:9i/pvA3Q7kmp3DXaeMkra3wPyNLtgr/NHHnjw+STesQh8Lk0:k/pv0ekmBe8+yyNLA1k+uu8LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704948012, "uuid": "2e49ccaf-8ed2-438e-99b2-0240c9d90282", "value": 4872852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704948012, "uuid": "05b12c8f-b5ad-4a04-9e55-00f3d147da7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948012, "uuid": "63bc7410-a832-4d4e-abe3-a5a087cc65d5", "value": "6ff9dd6d1cc447f96c3d71692602f862.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dfdb69-b098-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1704987910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987910, "uuid": "f7ae33c0-e231-409a-a685-0faf76422a6f", "comment": "Malware payload (Stop)", "value": "1a3bb5acfb7f3ee075b7e6bd97243935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987910, "uuid": "6d1a2807-3904-4e08-b403-111011a9a871", "comment": "Malware payload (Stop)", "value": "b7e8263a9210b8d4b85e957fd5cf0d23626926f7e41c1df3bbe468d12609d6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987910, "uuid": "67255b0a-6b2b-4d33-a780-e52ff9d0b76c", "comment": "Malware payload (Stop)", "value": "f2552378ab103181e6936a074a5dbdb2bdca06f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704987910, "uuid": "c7ce7635-6f28-436f-bce7-f12cc6df4ef0", "comment": "Malware payload (Stop)", "value": "1929cebd43f700554421d3eb5000f5bdee08b8a9c8abd25144aca535c337781964c854c82095777d7a41685cc01464d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987910, "uuid": "ff32ff9a-ce37-4eff-9397-50c97006d0b6", "value": "T120059D5392E13D44EE758B729F2FC2FD770EF2508E4977A511299E2B21B10B6E263B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987910, "uuid": "2817bef4-18bd-4c18-91f0-0e1fbdc6f884", "value": "ae482bd3cfff150c70fe7ca85278d78d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987910, "uuid": "6dbee37b-b38a-45c4-8020-ce6412e90f06", "value": "24576:bwAclUpRnp8qzrOKaLzn5G7AWhbPYLJoUn:bwAeQNGqMLzA7A0wLJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704987910, "uuid": "9e89b471-f3a2-4774-9b17-21fddf6a3d13", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704987910, "uuid": "f8428c58-5c22-494d-9e3e-97b6789e3224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704987910, "uuid": "2243f7f0-c359-43fe-818c-fe8b8f5e39e3", "value": "1a3bb5acfb7f3ee075b7e6bd97243935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf3f2d5-b05f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (MimiKatz)", "timestamp": 1704963383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963383, "uuid": "a0d85b86-22c7-4cb7-a529-889455ecc89f", "comment": "Malware payload (MimiKatz)", "value": "2f1d3f866fde60fc8337a92dce82e15b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963383, "uuid": "f6a26ae8-5787-4b42-87a3-9502014c3451", "comment": "Malware payload (MimiKatz)", "value": "b86925369c2833010ca7b6d0f0b6711ab2c9ab6b54ab9742e56865e6217acf37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963383, "uuid": "33889356-f7ee-49b4-83f2-e892736c9e58", "comment": "Malware payload (MimiKatz)", "value": "c6c7ee3c3d2930739a87c1548b921b71d2643783", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963383, "uuid": "8009893f-3d78-4e5a-84b9-653657c0e8d8", "comment": "Malware payload (MimiKatz)", "value": "3339fc82b8351119973b65553fad50b8167a91916ae955769728b2b966505989dc5957604f990330393bd01f486348e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963383, "uuid": "970da7c4-e413-48d0-8667-51986799051f", "value": "T1528623416BF1C074D7B2A2B40417C77761FA29A1873097DBBBA42E3A2F751D2AF38119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963383, "uuid": "c4a16e2e-6f49-4bb9-adf4-ce13bf52fd8e", "value": "4e7ce0c2d4e287e33f0a421844d1f889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963383, "uuid": "51fb5acb-955a-4c78-90ae-9608f1de1948", "value": "196608:+WC1nvP5zdP5zwxtqabDz+i771WCXnGmFCh1wv5fmz0S:on5d5z4Dz+iX7nFsh1+TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704963383, "uuid": "7aab6803-125e-4997-92ec-7086ea9a5436", "value": 8248916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704963383, "uuid": "c7f98f3b-d381-49ad-82f8-36a872a40bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963383, "uuid": "72e52c37-64df-40b5-a1fb-a20b41af1a65", "value": "2f1d3f866fde60fc8337a92dce82e15b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152db79d-b025-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704938381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938381, "uuid": "40128be6-b749-41bb-ab91-64ddaba866d4", "comment": "Malware payload (Smoke Loader)", "value": "d0936de24510643fa68b2d3879ad79d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938381, "uuid": "979808de-1486-4721-90e3-95b8ee01fdec", "comment": "Malware payload (Smoke Loader)", "value": "b8b2ae812b47196a7be9ec41d6186eeaf28f2924b906299995db446be091d5e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938381, "uuid": "5ebac2e4-0158-49ee-a219-ec98d902086c", "comment": "Malware payload (Smoke Loader)", "value": "b9f5bf48d34dfae63e695bfd90efad0a8137ede9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938381, "uuid": "8f7f61c1-2ba0-4e17-819f-50aedea58fc5", "comment": "Malware payload (Smoke Loader)", "value": "956badc134b7cec1b81d4738aa466956cb8c92307d75fd27507d838ff6d5ef1c6a7d292e73bd155165ea16c137824587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938381, "uuid": "b0d043f3-bcb2-47c5-863d-0f1794839819", "value": "T1FE147C1135F68432F7F75A765670C3B44E7B7CA769719A8E2AC502B90F256E2CE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938381, "uuid": "e27d99f5-7294-46ad-b99a-08857f1d71b4", "value": "7e32959e1e010773874596cbc1a01e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938381, "uuid": "dacc6ed2-977f-4bf4-a89a-c86257079580", "value": "3072:/urEskahJisaBZmTrM1ICSZRKRc5h9QWRT+qBL2A:MEska6mTrEIbRKRc5Q+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938381, "uuid": "089151bf-2a33-4ada-85ed-473b2ff1de7f", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938381, "uuid": "b8e5be70-8f61-4d2f-b88f-cc05f1de77e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938381, "uuid": "dca3e252-ac39-4bea-9952-f3357f013dc9", "value": "d0936de24510643fa68b2d3879ad79d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7422bacb-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978483, "uuid": "bcd293cd-6ddf-4bd5-ae35-74fe07e68085", "comment": "Malware payload (Mirai)", "value": "c00226edfe1b1971006fbff9412b26d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978483, "uuid": "270f58d2-b2a1-4fd7-aff3-dffc5bbe55f7", "comment": "Malware payload (Mirai)", "value": "bc6c9d15af9714ba1398367e91c7d3980c7f18f1359e44f3cb30653839340287", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978483, "uuid": "f7eb611d-c813-4c01-9fd2-792fe9c4191e", "comment": "Malware payload (Mirai)", "value": "c4a9ae6e485ab9989d7b0cc898589e5e3974a5ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978483, "uuid": "b7e8a504-2b94-4f75-9d6d-a9c2a466d3a4", "comment": "Malware payload (Mirai)", "value": "33fce796b64183c5d70147c43a1fc060148269e8d22f900eddf92640ac6991f202c9797bc693dc43fbc14bb5f9310813", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978483, "uuid": "6b4edacb-f0ec-4d0b-9ec5-d34b2bcb3479", "value": "T190E32A45FC514A23C6D312BBFB5E028D372A17A8D3EE72039D256F64378A85B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978483, "uuid": "a9ea9b17-b8c7-4c3c-b7f4-c6378da489c9", "value": "3072:98mFX6XK4pHj1MS4eVcFhxUUKFUSaDgI8:98TpD2S4eeFhxAFnaDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978483, "uuid": "52fe2b7c-bbf8-4dfa-9012-81d6005d08b7", "value": 150368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978483, "uuid": "72e0d7cf-57ab-47d1-ba37-93fccd000e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978483, "uuid": "ff3fd991-f048-4ff1-81d0-8371657b77d5", "value": "skyljne.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549342f5-b07c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704975853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975853, "uuid": "e703b8be-0e5b-482d-9a33-c5dc1f9c4b0f", "comment": "Malware payload", "value": "af474909e0fe9d97bb3f8f10e58e43bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975853, "uuid": "de91f569-42f7-43f3-a50a-af5515057949", "comment": "Malware payload", "value": "bc7c7280855c384e5a970a2895363bd5c8db9088977d129b180d3acb1ec9148a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975853, "uuid": "f71d1c9e-0a74-4e4e-a13e-67b8957eb004", "comment": "Malware payload", "value": "904934e4963afdc3c4898988ec0e68ef5a4c6892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975853, "uuid": "bef12df0-3cfe-4e52-99cf-c9eade6192ae", "comment": "Malware payload", "value": "e5021ed7f2a3a8acb04268c7edb236410753ca5b6cc4ebcaa8b814d870587752bd802db90c15532c0b0a7e4969494dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975853, "uuid": "5705c195-33ce-4575-aeda-729df2925558", "value": "T14BF44B07F79551BCC06AC174834BA332F972BC4D4534BA6F57E0AB312E69B609B1EB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975853, "uuid": "a61e7fc0-6ee2-462a-a95b-11538eef9a7b", "value": "3461984a9e90c7e7b8a49be054e88d8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975853, "uuid": "6559d69b-a08b-44a2-851d-ac82e8238eb5", "value": "12288:Ao01IzLB/XV/tboClV+tFHxMfR+G1x2VK8PTkKE2qtFL/MLsJT5A:ALMb/xoClV+tFRMfRuk528L/M8T5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704975853, "uuid": "6e21faad-c4cc-44a7-8076-92d08a3a63cf", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704975853, "uuid": "12456aef-2292-4940-a732-3467611ad687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975853, "uuid": "895a1d64-72df-42c8-ac2e-2ade8587142c", "value": "bc7c7280855c384e5a970a2895363bd5c8db9088977d129b180d3acb1ec9148a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cee549-b048-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1704953409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953409, "uuid": "32742983-6ff5-493f-84e1-7b9b3d782a04", "comment": "Malware payload (Stop)", "value": "14a5973627a876bdbafb029a26084f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953409, "uuid": "05034485-43fa-4719-9cce-0bf1159055d4", "comment": "Malware payload (Stop)", "value": "bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953409, "uuid": "32954ebe-7739-4f87-aed5-3867d7de2e64", "comment": "Malware payload (Stop)", "value": "5514e9a9d8806406ff9921c9be25bd1e314b0b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953409, "uuid": "0ea23093-7c4e-4e12-b351-5b5f514bb959", "comment": "Malware payload (Stop)", "value": "d356a2ff544d5bc53fe338a2593f5a23b2d0a2db6e456cfb547b28c1e130998e73793213366fbb57c57d6995c91a175f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953409, "uuid": "9d8f1c06-3ce0-4a89-b5e5-bae3b162c03f", "value": "T112058C4382E17E45EA668B729F1FA6EC770DF6508F6EBB65121D9E2F00B2072C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953409, "uuid": "d9a00af3-4ccf-4586-94e7-5943a2347bfc", "value": "aa971583f89270de87ee3aadea158267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953409, "uuid": "504d6027-084e-41b6-87ab-8bae09fef6c9", "value": "12288:zesZm5MEXDLUudx8Qp5+C6+gNfGtQaUkyUExxald2R6I6RR1nPK6AuVW:E5MOeQp5NgNfTkyUExxalYQNjZP0uVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704953409, "uuid": "a0046152-8cd5-439a-8a0f-a898f45e6370", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704953409, "uuid": "f94eb593-3a5d-47ed-b435-62685800fb79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953409, "uuid": "9251e99a-e887-480f-901c-f78a6c57fc55", "value": "14a5973627a876bdbafb029a26084f64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d4b072-b07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704975646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975646, "uuid": "e252c1c4-2e0f-4ea3-9300-08e5b298febc", "comment": "Malware payload", "value": "4e28b8c8cc2666b35c7a3c2ca03946e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975646, "uuid": "d3a29428-0a40-445e-b32d-932728cbc07d", "comment": "Malware payload", "value": "bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975646, "uuid": "bfd2943e-f2bf-4977-9908-1f06549f904e", "comment": "Malware payload", "value": "784e1beca241a4cac7ad270e549c28da2f5f7e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704975646, "uuid": "ae5bc75c-762d-4d82-8e8d-fbc3d4844007", "comment": "Malware payload", "value": "c3d0b23f8165b25fc8b80bb92b9e0a83ac68eed58b57b763a15101c7631739540d70b0ffce87fc74de11619d3b6d453f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975646, "uuid": "6fd13232-8307-40fd-95a6-b2b80286bfe4", "value": "T10D348D2136C0C033C6A3357949DAD7746BBAB8315F21978B7BD00B7D5F216E29A2934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975646, "uuid": "3168bb85-d5c1-4798-bf6c-2b798075e24e", "value": "7760aac19e95181a211edeb7f9a295f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975646, "uuid": "702a144c-944d-4ca3-91ba-0f17947cf647", "value": "6144:1/mi5BPc1M3xwunB4qELod1EREYuPdX6/V:1JxwunB4qEU3fYzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704975646, "uuid": "e2638f7e-c3c7-4307-8234-6f81f2741f24", "value": 243872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704975646, "uuid": "66e4d48d-de9c-4217-bd3b-6862191eadc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704975646, "uuid": "774e7404-f1b1-4ac8-8392-61f0c3b8b5a5", "value": "bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef9ec50-b06b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704968838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968838, "uuid": "880090e0-226e-4834-a479-ccae8a2ab4f7", "comment": "Malware payload", "value": "9adca3e4e32b024c9dc07b3d4fe895e6", "object_relation": "md5", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968838, "uuid": "1431ad56-a427-4fc6-81f9-1a920c618a0d", "comment": "Malware payload", "value": "bf9785883bfcf716ec34d67f9ee4dbee07597b2bd61759b35c3724f469de8609", "object_relation": "sha256", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968838, "uuid": "ece95efe-2eb8-4ee0-a3a3-b8f537a7d578", "comment": "Malware payload", "value": "ac854f25763e58c1e760c9ffac1cfd3a366fab42", "object_relation": "sha1", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704968838, "uuid": "ce1e7fd3-ccb2-4baa-8d84-f943cc746591", "comment": "Malware payload", "value": "d6779455576897d909b65f49eb22e352f857af5886421933aebd58a8d33e2beaa2ad86557ad000a945ed1700b454ef2d", "object_relation": "sha3-384", "Tag": [ { "name": "194-33-191-248--7287", "colour": "#70BCDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968838, "uuid": "6a0a4c02-bc9b-4104-874c-515dab4c21cc", "value": "T1B5B3CFB1FBF3D585C0EAD0B42B4397A3ED313C5C957CBAD6439542173B268A434AE690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968838, "uuid": "003af1ff-20ca-423a-b13d-bb01e9d7169e", "value": "3072:1G8hdSiG9vSBUYCFUHuFmOwGvF4Bgq62aMRKXBwLs/:c8XSZcUYCN4BgqggKXAs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704968838, "uuid": "d90eb27a-e9c9-4f9f-b45c-485b7d8a9581", "value": 114434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704968838, "uuid": "91da792a-b9a3-4cec-b0fa-04e8bb553a88", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704968838, "uuid": "d1e9096d-453f-490c-a451-521332399c45", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9043b5ce-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704940305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940305, "uuid": "4f9c82e5-4561-47c8-90e5-747d0d9d9fc7", "comment": "Malware payload (LummaStealer)", "value": "f1a9f0cd8b3aa83f0843360c8647cca1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940305, "uuid": "322ec5d2-ac30-4da3-99e4-216676cddc2e", "comment": "Malware payload (LummaStealer)", "value": "c2d8860861cb7eb12a683e0b7b70993484df6d76edbc3f586b0e537251666144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940305, "uuid": "fefdff55-9304-4ee0-839d-58bdc3c653ea", "comment": "Malware payload (LummaStealer)", "value": "221718d3f6af8700b6f4cb56e89859f6f24357f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940305, "uuid": "0b9bec6a-e63b-4fa8-a825-49258b5dbc88", "comment": "Malware payload (LummaStealer)", "value": "6fbb73ea13f5cb9499638b89d4dcbb1246ffbe9bc242b1123d3ef9274d235b4c400626ff8d2f6c28e577528d0d225a4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940305, "uuid": "e6d0c5c7-a9a6-4a0a-b497-ce2695d012c9", "value": "T1F2D4230067B70326C77517FE80B7091463E59BD75373EB453E4801AA4E8ABA69EC1FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940305, "uuid": "da806e5b-431f-4261-8692-2454e8449c39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940305, "uuid": "24034060-be42-4cd8-98d9-a4d3b417b74b", "value": "12288:gPKYB/uA+pwFRgfvp1+Lzd0IRRI+xIJQuECp3gLlc:gP7/fhzAvpWWITI+xQECZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940305, "uuid": "d44a8dfd-d8ba-4fb4-a05f-108d6d115faa", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940305, "uuid": "a5a72866-fc5a-4a53-bab8-0aee8987cfa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940305, "uuid": "4e56504e-2293-460f-977b-99c6e810cb79", "value": "f1a9f0cd8b3aa83f0843360c8647cca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b598e00f-b048-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704953682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953682, "uuid": "369a08ef-0d40-4ff7-8149-4e517f100d15", "comment": "Malware payload", "value": "4098110878fc21455673a8282b5a9a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953682, "uuid": "b38bb9f2-7c60-4858-bbdc-1b86638f1cb1", "comment": "Malware payload", "value": "c3c3f9bd4ca07872c4b598425966401ef02cf224fae1e67cc9f7d5867cd9ed16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953682, "uuid": "266a9040-463a-43a1-9ea8-4dc0921fa1bc", "comment": "Malware payload", "value": "80d89e1a92e6e66693949d73c86094b5be1f5cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953682, "uuid": "64392205-737f-4414-a37d-d4979ec7e466", "comment": "Malware payload", "value": "f6f363992e552792039a99f91d46d3c90c8a70f74282bbec291e17b2f898790f4b442fcee199c74a107cb2d1422ce668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953682, "uuid": "7d8fa1c8-d0a6-4079-be5d-0e2a5e83a4aa", "value": "T1DE86338A8CC5614CDC8150781FDBED2DB7F917A800258F8EE95A76CEEF33969E035606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953682, "uuid": "bed74726-8e81-4b31-ae2b-c825c42a21dd", "value": "8210cb3fa8429d77c60f075e97406691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953682, "uuid": "51bcaa69-c35e-4673-a60e-52ddceb03ac4", "value": "196608:oTaG5UbfIEe2xgvTDZ9s+43mY41EQjtwnCw:ouUvHg7GEQjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704953682, "uuid": "471a17e3-ccc1-4471-b834-bcd5f40422db", "value": 8167080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704953682, "uuid": "0b1cb5ec-e035-4263-ad8b-a32bd97b5d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953682, "uuid": "90a76412-a2c8-4698-862f-460eb4bee176", "value": "cp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9b7320-b085-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704979979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979979, "uuid": "11f8639a-6bc2-4a3c-acff-4b4cca39a9be", "comment": "Malware payload (AgentTesla)", "value": "bfe673e58b9c1b384cce7230e99320f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979979, "uuid": "22f7e3a3-b4d3-4db3-a65f-800fdb35b997", "comment": "Malware payload (AgentTesla)", "value": "c569fe7d3ccb9bf36356f829d5ab7de3ba4261d3beaffef1e690d8d197919c71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979979, "uuid": "9ac6104d-e460-4b96-822d-243baa12408c", "comment": "Malware payload (AgentTesla)", "value": "03db1e93f09bb91680429713a7fad24c6a0a6d7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704979979, "uuid": "3bf631ce-5226-4754-98fb-cd73e9b84d80", "comment": "Malware payload (AgentTesla)", "value": "1908e9ae6c286e8fddb144acee0e2482c68aadff0a738b62e200b00b297234a18093b62c82209dc4cf3cd94bdfa8a700", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979979, "uuid": "d8a4a4a8-5883-4580-bdc5-eec803f7c095", "value": "T1AF05D43C98BE2227A4B5E6A2DBD58827F120996F311D6D7598E3C355730AE4334C363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979979, "uuid": "688e8f66-097e-4473-9a92-b4fa1966d13c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979979, "uuid": "5ef1207a-9164-4a64-a34f-79fc36220f05", "value": "12288:AZRc7sGrgLwlPJJVddqZZIBswROiCUrb5/dgfM:uYsGrP1nVx4ut+fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704979979, "uuid": "c07849ab-8854-417a-a1c3-3fb326988448", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704979979, "uuid": "bb4e8f7a-0af2-4095-807c-ecfeeedef973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704979979, "uuid": "76faddbd-58b8-479d-afa0-b4b5750aee59", "value": "c569fe7d3ccb9bf36356f829d5ab7de3ba4261d3beaffef1e690d8d197919c71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96494cc0-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704940315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940315, "uuid": "07133254-e774-45b2-b317-d41156050d27", "comment": "Malware payload (LummaStealer)", "value": "6e6daa196cfdcfd8f2481d230b0e8abe", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940315, "uuid": "5b081550-dbf3-4985-9a9c-2b90ee2ba9a0", "comment": "Malware payload (LummaStealer)", "value": "c62f077bf99d737fe7ade6270c8839ad7088d0b93c06943fa5ee38501ef93208", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940315, "uuid": "90f53554-25eb-4c42-b115-0b1ecea6c9e3", "comment": "Malware payload (LummaStealer)", "value": "484721bdcf9c792783af3b0eab16d5d800eee529", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940315, "uuid": "0410e766-3da0-4530-a751-d2a77d7cf81a", "comment": "Malware payload (LummaStealer)", "value": "6b6e7d111d54600b9ff29b365d588fa04ced1ed49e491065bb75e35d6e0b606adbdc1d21817abccf51e28e90840d934b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940315, "uuid": "15794db2-2f2e-4c47-bd18-e9f04e8a0b3c", "value": "T14FA65BC7BC9445E9C0EED7358A6292A2BA713C484F2123D72A50FF683E76BD06E75314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940315, "uuid": "777c91c6-eeef-4a65-a457-41dbc017868a", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940315, "uuid": "80679a27-a3aa-4291-abdd-0857f39700a5", "value": "98304:vQ74+oGzpZvMr0hOoREk5prUZxoL9HkFFSumkYd:/6pZveoyEpIxoL9EAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940315, "uuid": "6afff41f-396a-4c00-8721-ce1ba432ffd0", "value": 10315264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940315, "uuid": "1c104773-406e-4db7-b91a-4d456e2a2626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940315, "uuid": "c2b0b83f-c533-4c31-9a3f-17094e2374a9", "value": "6e6daa196cfdcfd8f2481d230b0e8abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbb0788-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704939063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939063, "uuid": "32adb5c8-84cf-470d-9572-8952c4c44b16", "comment": "Malware payload (AgentTesla)", "value": "9aac686ecb2daf747300f4396a7f99f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939063, "uuid": "f0eab192-4149-4a1a-b895-2973c0caf7e0", "comment": "Malware payload (AgentTesla)", "value": "c6a30981874e6e77249a6737abb1194158562bd90d76351b859f9acaee09748b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939063, "uuid": "86fdc854-841f-493e-8bd1-937230c76a0e", "comment": "Malware payload (AgentTesla)", "value": "860fd9fb7275ce15aeeac7f123cbb18e39df853c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939063, "uuid": "6ad175b5-e78c-4ff5-95c8-33a52504fba5", "comment": "Malware payload (AgentTesla)", "value": "1c0bfa7d1b617a0688a5539b603672c3b4e8e4d99459a64121dcf2d274883810e88ef4179061ea26811e262a2daab8e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939063, "uuid": "df6d6aae-c1cb-434a-a810-ea4c559d6378", "value": "T143256ED1F194C89AEC6B09F1BD3A953014D3BE9D94A4810C5A9EB71B36F3352209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939063, "uuid": "29c67d2a-c36b-4cc1-8dbe-b5d33105e5ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939063, "uuid": "d53f4b26-5f58-439e-abcd-9f544ab3a70e", "value": "12288:J9UQyBSPmRzTFji3/fhGcmbRsd6M6s3233AH6ANAbiKOmS8v1v8aCE:3py19pi3gcmbRe6js32RiCdUaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939063, "uuid": "261c9656-b026-45be-9a64-72d325065f76", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939063, "uuid": "1f75d543-8b3c-4e61-9ab5-937b262e995b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939063, "uuid": "c040e43d-c1af-4d18-8202-fd8b0c937a35", "value": "\u00d6deme makbuzu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f761b86-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1704939042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939042, "uuid": "502382e7-ee3a-40b9-bae6-bffb9dc79a87", "comment": "Malware payload (XWorm)", "value": "1b9bce7d3cbc47c7ba7650beadb1522c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939042, "uuid": "cad54f49-1e97-4137-ba46-a32fdaac3ad6", "comment": "Malware payload (XWorm)", "value": "c7c1f9e094890a135131fea3083df258c2d7c6375aab3061fdf0b1e5b9c3ba66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939042, "uuid": "94037531-5191-45a2-b929-660ef30f8ad1", "comment": "Malware payload (XWorm)", "value": "f5df4852b3e5bd8edf944fb2f906dfb55f907f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939042, "uuid": "29f12f8c-9201-4c3c-91cd-c7aa75cd9c3e", "comment": "Malware payload (XWorm)", "value": "f07d31e635ebe0d25459c679adfbaab85d7e999b55a01abf8e0304786f960c0dacee78d981008c073a24272ae17cf22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939042, "uuid": "22f97391-1b46-4973-8a93-53f90f950e4c", "value": "T1F1150213BBC158B2C07219322974AB11ED7DBD202B648FDF67C04A1AEAE25C1D735F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939042, "uuid": "09ec40f9-e440-4b88-a662-abb62b888d75", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939042, "uuid": "24869d6b-dd7b-46f7-b8de-2e764676e17b", "value": "24576:yTbBv5rU/xBacdcBGa6mXcqIAXiAQFSDS:UBm80LAXiAVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939042, "uuid": "b8817074-ec2a-4a43-af8c-ba61fd833eea", "value": 906476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939042, "uuid": "5914f999-a2fe-4245-a002-851c43920f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939042, "uuid": "c8b92240-bc87-460f-ae7e-c9439175aa2e", "value": "Purchase Order-3794688347487387.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a32e1d-b058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1704960609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960609, "uuid": "5ac78fa2-653d-4cbf-94be-8d5e7cef5f3a", "comment": "Malware payload (Stop)", "value": "afdd799a769a2fd3f66c2fad9f1d1026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960609, "uuid": "c4956990-c8cd-42d8-af97-daa39cd5d3da", "comment": "Malware payload (Stop)", "value": "c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960609, "uuid": "9aba8484-7473-4b74-abe8-ad96a39f31f6", "comment": "Malware payload (Stop)", "value": "b08ec120f594b4b3c972a52bb4e7be343a62ef25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960609, "uuid": "ada52114-70d1-4f02-929b-2189e2268e21", "comment": "Malware payload (Stop)", "value": "737671942a1bc1f2a61b4a3a1c109fc774a0ad5335c992de9b580d09b6fa92c48d864f08f9787fbe0ad2c71afecd6a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960609, "uuid": "11f291ee-e212-423f-817c-cf8fae54ca81", "value": "T1DA058C5382E13E49F9658B729F1FE6EC7B0DB6608F6D376612199E1F00B20B2D163721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960609, "uuid": "70989c96-6c42-437c-a05a-1c836972597e", "value": "cec96b74373fe00d227864e9b27d8ac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960609, "uuid": "b134afb3-7ccb-4bb3-973e-5a43fd246f02", "value": "12288:L6mUIxb/0PkTi7YKuJJ2o48w/ukC+v8JJ1IyPEg:cIh3i7YJ2D8iDELIyPEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704960609, "uuid": "1500e6e8-e2a8-48c8-b21e-c5164bf806ba", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704960609, "uuid": "7b818404-8936-4b4c-95e4-f0d88ce3cc6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960609, "uuid": "4bb44207-000a-4400-809e-a65b8ade7c6e", "value": "afdd799a769a2fd3f66c2fad9f1d1026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340955db-b037-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704946163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946163, "uuid": "6675c196-1c11-4073-8547-d77c94291751", "comment": "Malware payload", "value": "cdb5da91ed9624691148563d0c234e06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946163, "uuid": "b0af0a50-bb5c-4a15-be07-29b7c6858af7", "comment": "Malware payload", "value": "cb1ae846ff0cf850daca17d92289cbbcd099f5ea3b68c3f3877409b8c4df2b44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946163, "uuid": "88ab2d08-d061-4a55-9b24-f76feadf57bc", "comment": "Malware payload", "value": "fd12f9d82869b65184d4bbe76119f623a9746303", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704946163, "uuid": "6d8ec6ce-89b7-4b22-8984-43aa318e16f4", "comment": "Malware payload", "value": "f93c3f05a0d9ebb294263e202fa798cfebd44e5400ce7ca93e3ee66c27041182a7d1a5c7698494a816952a55fc71febf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946163, "uuid": "98b2cee7-2c2a-40f8-83ee-24087ff210c3", "value": "T17F14AF01B1C18872D5B6193508B4DBB10E2DFD304F509E9FB7D81ABE9E346D0A926E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946163, "uuid": "a87e070a-0a04-4417-9e72-63c3e4ab4a7f", "value": "dd1f90775918f087d351be8ed03d7f9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946163, "uuid": "fb115fde-1408-4bde-82bc-0eae5fb614d2", "value": "3072:9vpNmiRDCk5ZrOtYKU040PK22OWTLgcaSU9GcZgG3f/F/pstBaDqwONnct437Blt:9p15ZrcNP32lgB/F/p/uwONct43j92Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704946163, "uuid": "ab26a499-59c3-44f4-b8af-402b97364fee", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704946163, "uuid": "d71d8709-fac3-449a-898f-f31cd92058f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704946163, "uuid": "d6cec26a-d7d5-4712-ad7c-1b3fc678304a", "value": "cdb5da91ed9624691148563d0c234e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090f294f-b025-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704938360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938360, "uuid": "4b6b3933-5350-4a41-a8ab-f15b85a0472d", "comment": "Malware payload", "value": "eeaf478752c4ef401c354a36f77ce920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938360, "uuid": "1271df5d-d8a2-4a82-9159-761c2b8d9d0d", "comment": "Malware payload", "value": "cc26dca6301b50e3a5f5270ebbe9c1d797bb1f1f3205f7ade8e310a6f19e59c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938360, "uuid": "7dc95752-95b2-4f1e-a26c-48b2d61f531b", "comment": "Malware payload", "value": "51e478d90a99929c8fbace66ca1e205caea72720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704938360, "uuid": "e55ff772-3770-462f-95e8-cd48a593807d", "comment": "Malware payload", "value": "4327224988e54663a5f57e92eb262f95d35aef5f819d317a30f4ceb8ba47f178b8f2d28ec068604b446c85cb8d5e0a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938360, "uuid": "7a85f8f2-356f-41f4-b85d-b2218dd46274", "value": "T14014BE1434C1C472D91721BB4261C7B08E5B7CB56962AE8F2FCA4AF94F2A6E7D72430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938360, "uuid": "53005aa6-f143-46e5-bb16-e223e86faf43", "value": "7e32959e1e010773874596cbc1a01e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938360, "uuid": "66306358-0a48-4384-9d00-9744c99806ec", "value": "3072:EdrEskahJisaAN0yunrtMxxFF3m7SfdBm2HQWRlMh:kEskaFVunrqvldBczh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704938360, "uuid": "2beaa00c-5ee8-4624-bacd-9b9d2c97175f", "value": 194887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704938360, "uuid": "0bb146bd-93cd-41b6-977e-60d9a7a77ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704938360, "uuid": "ef3f658f-1756-4302-b9c8-fad03f488e23", "value": "eeaf478752c4ef401c354a36f77ce920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3c0904-b045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704952269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952269, "uuid": "fd6098e8-c249-4f17-a67b-a9847702da13", "comment": "Malware payload (LummaStealer)", "value": "46c409d80dcf1d50d131fb22f455e777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952269, "uuid": "deda8f90-f8cd-4487-8ec0-f3d8b64b9461", "comment": "Malware payload (LummaStealer)", "value": "cce5686ff01c5d4248e87b002a345f6d7647d3aca7cc218e27dff28f90fec6b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952269, "uuid": "842d02c3-124c-4bcc-baca-ea311b7d03ec", "comment": "Malware payload (LummaStealer)", "value": "2aa69c56ee5553ce722d997231f218e1bbc067d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704952269, "uuid": "202518ed-253b-467f-ad39-5d858814c2ff", "comment": "Malware payload (LummaStealer)", "value": "7fa09cb5b046bd28a45abbe33d07b2670adeff3419269a591d582b1acc3481284001e3f4e3fe38eb83df062fdb3679a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952269, "uuid": "b4df4585-5493-4412-b070-3863821d9c42", "value": "T1EC469D02BAD6ED01E06D7672CBD780148372E9925337D70F3ACA13A6075379A1D4ABE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952269, "uuid": "8a10bbdd-b436-4d5e-8512-afced9f0b08a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952269, "uuid": "534a8b38-26e3-43bc-bcb3-579ad90f2e5e", "value": "98304:oyGyatFQ29CZh9oxQ2k/aJ92noX2qmempG1:ot1tZlCKybRvG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704952269, "uuid": "2f5c675e-05c9-4d71-a648-b54b92b28017", "value": 5733064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704952269, "uuid": "765a5049-90e4-4755-997c-33262a128dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704952269, "uuid": "bdaa1ee2-5e69-4238-9a6d-3aa87237b78b", "value": "boxApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d10298-b07d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1704976317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "53f83599-3774-49b7-8935-e8d1ab2a124a", "comment": "Malware payload (Vidar)", "value": "d1a6f9be6f046fcdd20d871cec0e1a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "130c4d38-a368-497c-94df-f2684febdfb0", "comment": "Malware payload (Vidar)", "value": "cd2e465d6a7fabbdb606645b710f24e2c3fbeb0860dc5e9d5d14f24e06e80c12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "eb4eaec4-69a5-4110-aa72-b1b022752777", "comment": "Malware payload (Vidar)", "value": "9883102854cf73c2147f896963d220975746020b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976317, "uuid": "dd40b32c-07a5-4108-8013-4ecb02fb79e1", "comment": "Malware payload (Vidar)", "value": "cd622967baf28ee8b94ca0260453e59f01c374e590f8b7ee1d69b9d21fa2b97fc7fed12fb7172e8f377da73817d3a72d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "b94c5e2f-6a83-4609-b41c-af4edd5e65f0", "value": "T13D06AE06BF999D11D0596A33C5EB101803B5D9C27733EB0F36C6236A59833EE5D8E78A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "24abd9ab-49df-4268-8735-cc1493c094c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "560a1326-6eed-4b4f-b958-83cef962c5b0", "value": "98304:xUumioAgFSVP3J3p0UP2scJUNO7VTiR8L:eumbhSVPp/OCOxiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976317, "uuid": "2442a299-c31e-457c-970b-450324bba35b", "value": 3902136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976317, "uuid": "67cb7e33-d204-4fc2-94d1-ecb6049c7b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976317, "uuid": "7b3c52d6-c458-4673-a90d-a9eeb1e1dd5b", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.28603.20478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c12e9b5-b03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704948915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948915, "uuid": "87ab1d1f-a0d2-4935-8542-4ad9deea06a3", "comment": "Malware payload (Socks5Systemz)", "value": "aacf4d3b7f3451111acf9517dc0d3ec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948915, "uuid": "1470e2a8-94ca-42ad-ac2d-9b3e080db9ec", "comment": "Malware payload (Socks5Systemz)", "value": "d05f38636d236314d40f22a27cddf777d00fb4fec5ee6d4fc569dba11e6f5861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948915, "uuid": "1812f20b-10a7-4e74-8d2f-81fc9b4d2f26", "comment": "Malware payload (Socks5Systemz)", "value": "f9b28a54f080689e306cc122ec38d8193b323402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704948915, "uuid": "99bf9a2a-509f-4762-9d7f-25fa74584c90", "comment": "Malware payload (Socks5Systemz)", "value": "7d884afdf7cc8779940cf2f1caf0aee4e796f1a89d0cf6b182aa666988c85081ce253f43d7c0d12698ef2879945c8b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948915, "uuid": "2d172e05-560e-4691-8b8d-472ee9f0d91a", "value": "T1BE3623185F6DED56C2D448F96DA0B6ACF1749E622EBF02476CE3B96EC879B4C3E15000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948915, "uuid": "35c03871-ac69-4e4d-b3c3-d063fd60bdb0", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948915, "uuid": "20604f98-5ab0-4b78-8346-633253282fc3", "value": "98304:Zi/pvA3Q7kpEx1jG507zVClggnEhO/4Ycmi4CHCHkWuE32YTKk7:I/pv0ekAr7zqgQQYcmikrzHKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704948915, "uuid": "180efeca-c16a-4441-8103-41674b49a27b", "value": 4872124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704948915, "uuid": "d1a2abb8-053c-4d41-80c9-332983ac0efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704948915, "uuid": "e5a4d398-4c95-45f5-a300-4aea743a6c05", "value": "aacf4d3b7f3451111acf9517dc0d3ec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e54e3e-b028-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704940039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940039, "uuid": "3ac82b40-d7df-41c8-9dfd-58a02962834f", "comment": "Malware payload", "value": "461f7477cdcef030861113acab02c386", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940039, "uuid": "7bac184e-cb1a-4081-b48e-6f06e5a0393e", "comment": "Malware payload", "value": "d095a5f03d41cf3451aeb011b8ea46f1b0af1556d01cfee9b34c3df8b2fb483a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940039, "uuid": "7cbb87e2-306c-441c-8f94-94234bb19c01", "comment": "Malware payload", "value": "709e725c231860fbf3f05498f554ce0e7ef1f9b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940039, "uuid": "a26e5e69-5bae-4720-aadb-ff96f0604f18", "comment": "Malware payload", "value": "fffdebbcb2c940d50bf6d8542dc12abbc7e6009318b6080956ef03331262a079fb97f5c44f4cb70d0d00e2c2e59112fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940039, "uuid": "1461e5f2-960b-4523-8ad7-815b501f825a", "value": "T19623F1FA8241F9E8DF18B5F94DBF632D6C655B1A266B2333215DE78C2C05642203CB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940039, "uuid": "ca8280a9-9695-4971-8287-0067ed424a21", "value": "768:5jEJR/PpxXE9b9shqNep2r3aifknpUxbk8UPHPYDaHLD8BIPAv3ewgz7XRCY:50DE9byIG2baifkpMbVUPvYWHv853QXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940039, "uuid": "4c27dd30-24a2-48d2-8acd-f2ae03ad8b6c", "value": 46584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940039, "uuid": "7e4a669d-f8cf-47a1-bf9d-6aaf8cbad63a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940039, "uuid": "520d9142-bf5b-43ba-b289-454d9eea80f7", "value": "popbang.arm7-20240111-0227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56163aaa-b07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordRAT)", "timestamp": 1704976715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976715, "uuid": "a0600e29-343c-4419-81aa-05b691cb0b50", "comment": "Malware payload (DiscordRAT)", "value": "795ddbc2830d15090c9d7475d41ed808", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976715, "uuid": "043fc7f9-55bc-400c-a522-b9ba6abeaec7", "comment": "Malware payload (DiscordRAT)", "value": "d14a609c0c3757f80eec5475e599dd2804763620290a21076905d290524231a9", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976715, "uuid": "66148c4a-4aab-449d-9d7b-4596eaf9f993", "comment": "Malware payload (DiscordRAT)", "value": "86135264474a64abe6eefbbb86d5e27507e6fbd2", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976715, "uuid": "9235935e-a4ea-4921-aa8d-4f10cca78f4a", "comment": "Malware payload (DiscordRAT)", "value": "8208f521bae7eca0b50171bb6bb07a1ee51725cff9734f1f69b9c6650a8369f46bd9e7870170d59bccf5c1df0f771a9a", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976715, "uuid": "0bab22e8-030c-4bce-873a-c488d1b5cc1c", "value": "T11083D8C877AD8903FBBF5EBD147141424B72BB17E975F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976715, "uuid": "9e7f5189-100a-451b-9915-ba3009e7c1ca", "value": "1536:D2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIU2:DZv5PDwbjNrmAE+EId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976715, "uuid": "906d2361-971e-4161-8098-679021394281", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976715, "uuid": "3ae0e5e0-5f42-400c-98f5-ad80c3c96cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976715, "uuid": "694b5677-53fd-4882-9e9c-657c7d608313", "value": "d14a609c0c3757f80eec5475e599dd2804763620290a21076905d290524231a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7891a6ff-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978491, "uuid": "d80e660a-c931-4b8d-a0ec-583d31f88cb6", "comment": "Malware payload (Mirai)", "value": "afd1103c8ef9e5e3331b733561865e11", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978491, "uuid": "3f767ac7-747c-46f0-b7e7-65337cb48da9", "comment": "Malware payload (Mirai)", "value": "d3fe49ea723f09224615fb2bf15654135d0b0dde01c8572ae59104cb0a0a32e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978491, "uuid": "2ad2248d-b9d8-428b-9357-473323b70459", "comment": "Malware payload (Mirai)", "value": "39e2e725deeda9907b009caf375cb345745b1c51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978491, "uuid": "0fc68e96-f024-41f8-95c9-25699cde02f6", "comment": "Malware payload (Mirai)", "value": "0e5117950901d981786ef232cbb31a19648b837d1927e6da72273ecaca932338c1e73f217d0cfe70e02681af0241c5c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978491, "uuid": "25970e5b-5d17-443c-83a4-bbedbf192c94", "value": "T1C1142A46EA408B13C0D727B9F69F424633239B94D7EB730695286FB43F8679E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978491, "uuid": "eae8ac68-b5a2-49b8-b257-2eccfe209c7a", "value": "6144:RODrQ613AUa8mfKk43f9Qn3IRwM/Ra6aH:RODZ3AUa8mfKk4KYRF/zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978491, "uuid": "b245f23b-7887-4cfc-82b3-90dbbda1f2b7", "value": 202931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978491, "uuid": "3ff563c4-cf01-4b37-a724-89f2d4e62ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978491, "uuid": "2a053ae0-3c1b-42d8-94a2-e8d24d9d2be5", "value": "skyljne.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e0785-b042-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704951224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951224, "uuid": "3a0bc3f2-8f85-4168-912b-ae37ed31374d", "comment": "Malware payload (Smoke Loader)", "value": "ac27d06e4345f34cfa44e08a860d88f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951224, "uuid": "2b40e0b8-48e6-4d0f-b4b4-682a21768710", "comment": "Malware payload (Smoke Loader)", "value": "d47be58f4a767dcfe803a43a184158fdb7f0bbc379c4519e435540f9224c82dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951224, "uuid": "715ddd30-dd4a-4ef5-86cf-ace00fd507d6", "comment": "Malware payload (Smoke Loader)", "value": "c5575397ff27d7f3a22ed9e0537e060d33bb4890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951224, "uuid": "d4609ad6-15b7-4e95-804d-fe73b366a5c9", "comment": "Malware payload (Smoke Loader)", "value": "5fd698ca5fa8fe1e8e51d972ca3c0171b0cf4cefb57f79195a1ca712122d01149261e65cdb9b8b260af09f847e85b315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951224, "uuid": "5a31bc98-d1f8-4dc8-90e1-dde0018b570c", "value": "T19F148D1135F6C436F7B35A765674C3B44E7BB9A72931A98E2AC502B94F217D2CE2030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951224, "uuid": "0a89b8d7-e79e-4886-98f8-4e2fc8419be0", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951224, "uuid": "3d256cde-1419-4810-b2f9-5a5e7f9b9275", "value": "3072:dE/htLJYeiJiiKDuSRpXxLNjwakyBvwyYR2QvBL2A:yTLJYeF9LXh7U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704951224, "uuid": "8721b22f-ebb5-45f6-91f8-a969b1c1d7f5", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704951224, "uuid": "f6a72c1a-ccb9-4ff1-aa42-28f66c7b72cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951224, "uuid": "08d1145d-4e72-4ef1-a9dc-3a98fb9f168f", "value": "toolspub1(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62935b9-b0b2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704999317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704999317, "uuid": "e5795502-bb8b-428b-8af6-bf769cba0aeb", "comment": "Malware payload (Socks5Systemz)", "value": "eacb7a770d99200bb08e335bee965902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704999317, "uuid": "9e68a523-215b-48c1-b408-5b73dc8e845e", "comment": "Malware payload (Socks5Systemz)", "value": "d4eea21584acd9311afc40a1d565e173f60740339993f24118238ed8fb45f1cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704999317, "uuid": "ea5b07d8-c1c9-49f4-a2fc-2c1b18fc2291", "comment": "Malware payload (Socks5Systemz)", "value": "57029fddc016048f1bf161df445feb8bc043c603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704999317, "uuid": "167082d9-bc8f-4f4b-af95-5e5403e91dc6", "comment": "Malware payload (Socks5Systemz)", "value": "9379b7976851b7a12c68bc5d3da82cfc03c09768285ae9da4bbcc6a18e2f12f106187105e75360bcce17e3be450697bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704999317, "uuid": "b301db65-60ba-444a-b0c7-f4e82f6dadc7", "value": "T1DC16331229B814B4C40B85FAFE1DA5A87026F4274C6CE03F255DACCB5FB62CB153699F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704999317, "uuid": "084898b4-22b4-4043-aa03-de56362b9cc2", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704999317, "uuid": "c4a3a400-9dbf-4dd1-8e45-b075328414d5", "value": "98304:+iRKoA7GNLHY1f5ETX4QrTCcSFMi+9CelUOgw4kO:LxA7GVHqf5I4E9Smi+C9hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704999317, "uuid": "d8cfa100-5fdd-45e7-9778-30e58c1d60bd", "value": 4103920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704999317, "uuid": "612e9baa-c578-471b-8c3b-ff7bec871e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704999317, "uuid": "35502643-5c90-4564-90e0-b28d4c107ff7", "value": "eacb7a770d99200bb08e335bee965902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecfd7dc-b078-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704974072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974072, "uuid": "a1c8089b-fd84-47ba-abb7-fb3f25c55061", "comment": "Malware payload", "value": "514843590b65de2b2aa5512f6693f322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974072, "uuid": "f5e36224-7ce8-4ad6-98a9-1bbc451c5a99", "comment": "Malware payload", "value": "d5695c153934c4417ae3584e476f5196ffe69e413a9df40ec0e55589f4803d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974072, "uuid": "c4249c0a-f8bc-470b-bb61-32f620b43c99", "comment": "Malware payload", "value": "ff8bbf561b0450c472c8694f6aca9eb6e3b2301d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704974072, "uuid": "8bf75d1c-5cc7-4e50-bef3-02ca4e4a6725", "comment": "Malware payload", "value": "802004e125dbe6ba5aff947cffc68c52ecad4e2267efde9defa06fc8aa5799b4a3256ef7ac3ab127955408c550cf0ef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974072, "uuid": "766dcebe-efff-4735-b079-8314ea4d7d91", "value": "T13123E517A2E0E93AD265CBFD2E2A03FC05AABD3474D4DD07F5841A066AB6D43E913317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974072, "uuid": "d20444ec-0b41-4b72-8063-f68b10c635d3", "value": "7677763f7529dbafb8cbd5551d80cbc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974072, "uuid": "f52c9bd5-2233-45a7-8323-88b0cd4dd4b8", "value": "384:Yphk1qGvq/a/ryIstUT4FPwk5wAjFwyXILah1/VBjzYwXfA/ae/P:Yc1qGAWrGOkFTxKe/VBjzYUqxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704974072, "uuid": "b0c22fca-b552-4941-9f2f-6f3c3ecfc2cb", "value": 49178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704974072, "uuid": "fe917a0e-0d85-4991-8323-df002e05dda5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704974072, "uuid": "804dca1e-cb19-4b08-a619-a6527d4aa27d", "value": "d5695c153934c4417ae3584e476f5196ffe69e413a9df40ec0e55589f4803d54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e292ed-b0bd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705003820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705003820, "uuid": "bc75c7cf-78d7-4dc6-a2fb-93d6ebcd74b6", "comment": "Malware payload (QuasarRAT)", "value": "30705266725f9bad60ea12821acf740a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705003820, "uuid": "e6f78122-ea9c-40f4-836f-5ebfe2a772f1", "comment": "Malware payload (QuasarRAT)", "value": "d60bb69da27799d822608902c59373611c18920c77887de7489d289ebf2bd53e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705003820, "uuid": "19cd1452-3c75-4c66-be37-b1a5123e9016", "comment": "Malware payload (QuasarRAT)", "value": "5a063409c69d909f031925ee066ac008088e3ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705003820, "uuid": "25bbf702-4bfe-46e4-94c9-b579274a4861", "comment": "Malware payload (QuasarRAT)", "value": "1fbfce35b5ce4fd5616bd4e10d08cea354933e499de6d6e2a058307e107c8b29d92bc8368572ecd51ae7afd6e19bcc11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705003820, "uuid": "2ddda66c-4138-4c1a-881b-a3ed6d52a810", "value": "T1ED767D10BBE8CA27E2AF53B185F116525BF4F805F352E7DB158C25A91C12380DE267AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705003820, "uuid": "46a8bfd4-599d-480f-b449-2fccb07055b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705003820, "uuid": "5dd5432b-c372-4a48-a898-b0f0b58306b3", "value": "98304:IRoW3kST9lgfU9PfCvRfj3Ml27OuKr+gvhf2:IRouk49ifgCpfDvOuK6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705003820, "uuid": "0a2420fa-e152-4735-93f8-537ecb901277", "value": 7444992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705003820, "uuid": "c3c1a0a5-f54b-44e2-858c-cf65af0d5565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705003820, "uuid": "2178b68b-156f-43f3-a5b4-91a3c8d76e2c", "value": "30705266725F9BAD60EA12821ACF740A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8febbff1-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1704939016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939016, "uuid": "bd701a4c-a9a8-4004-9ce4-c6d5832910bb", "comment": "Malware payload (XWorm)", "value": "40c2a879613020ee6cf139ce102354bd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939016, "uuid": "137235ed-6c48-4ab0-94a3-9bc9921842a9", "comment": "Malware payload (XWorm)", "value": "d6c50d8b4d0a37b3ba41811faaedd5cd58d87fad30515bb3bf2d3f60810abb55", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939016, "uuid": "9f5f5317-a14d-4f92-904c-8996ae0988f2", "comment": "Malware payload (XWorm)", "value": "cf9abc6d90eccc3c0bc2936a5ab51e4b68266ebf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939016, "uuid": "d0241bad-c0dc-41a6-92ea-f3c54141ad48", "comment": "Malware payload (XWorm)", "value": "9bb7a0dd6c62f8e648b91f6afc1334fb897e0f9535dc446f83b2246d7d9d878d0ae8cf82f6e22e3e88b287d3b32422a1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939016, "uuid": "a2e40028-2edf-4e81-a18f-b1cc89247fe6", "value": "T1807142146AFF910C7273AE612FF475A9DEA7B3762A05B55F0040034B8576F40CDA2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939016, "uuid": "de559788-77fd-4664-895c-14119e8e1429", "value": "96:GbleuGABqGAKFbledqGAmsJIKGAOf8fWsJIS:GbtGAsGAGbzGAmsWKGAOUesWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939016, "uuid": "1f4e738a-13cb-4a25-9086-d51ef49a5805", "value": 3476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939016, "uuid": "d3b9a88f-a4a4-47f0-8985-c709e719aadd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939016, "uuid": "55626b28-95e1-47b1-9ea0-311a53fbc28f", "value": "Revised Proforma Invoices.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15716419-b0bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705004524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705004524, "uuid": "3eb321a9-d190-4fc3-9474-1688999fa58a", "comment": "Malware payload", "value": "3ac41c503329fd2c65f653c64a577a7a", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Zebrocy Nim", "colour": "#E6534E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705004524, "uuid": "bdc92dd8-0007-49c7-aa30-813f8bb6fd2e", "comment": "Malware payload", "value": "d86645adc1cdc9e4ad55f0bb801525e5f08a4c52efbf8043ad4fffcfaa311cef", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Zebrocy Nim", "colour": "#E6534E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705004524, "uuid": "1c072c4f-5bbd-4190-b5ba-3b6f7ee48ea5", "comment": "Malware payload", "value": "715fa9d11de8683d03a9e35681d4e1b4b761ee54", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Zebrocy Nim", "colour": "#E6534E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705004524, "uuid": "2e8d29bd-15fb-4232-95a8-8c1a1ab1ecd5", "comment": "Malware payload", "value": "4219c03e47100f5a5771027bf6629433e1c95bb4477c8fa1d4449f4babdc7383562933bf9288bb947527a6db37f37534", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Zebrocy Nim", "colour": "#E6534E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705004524, "uuid": "56b75fbf-1465-4511-baf9-1fab669ab585", "value": "T14895F10AB3ED0C25E577623889A78355B7B2B8A01733D7DF2158963D0F63AD4AE34B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705004524, "uuid": "03d92d7f-da56-44bb-a0c2-695a7e1b0460", "value": "49152:uiw2c7J4NL2dH7FFtYXTrUMClDIgW7X4GKaLS8AfBX7:uONS57FFAT4MClg8GKJfBX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705004524, "uuid": "a6e878cd-6447-41ae-819d-610780b26a84", "value": 2041856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705004524, "uuid": "1a344ded-b1cc-4aa1-8cca-9e6d8c6ce927", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705004524, "uuid": "4df6af16-aa27-49ef-958b-c094dd410a0b", "value": "Raiffeisen_zapyt_vid_2024_01_11.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f864e7-b074-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704972495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972495, "uuid": "12d2c481-06d8-421b-888f-0dc6848d54dd", "comment": "Malware payload (RedLineStealer)", "value": "9db3ecbe713b5c5282fc519b66000c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972495, "uuid": "f996ae16-57cc-4004-ae3c-1ef3a0105bf6", "comment": "Malware payload (RedLineStealer)", "value": "da0c31cfb509c2cf25b035047ae02faa18149e12cf47466cda1cd8b3dfc0e7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972495, "uuid": "51ce35b5-47f6-4772-80e0-4dee2b9b0a05", "comment": "Malware payload (RedLineStealer)", "value": "e80a21433436179da9b8c829fbb8f6c38d325677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704972495, "uuid": "030f3615-1445-4261-965e-057f64bed8af", "comment": "Malware payload (RedLineStealer)", "value": "43ca3e806eb7133a41f568fe8d7a791ffef32a3ede313c639f88cadc0f92690a37822ee3759788ecc1c856ac2276bc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972495, "uuid": "f7fa9219-ff78-4195-b3a6-c34a7564c214", "value": "T162741248BB974719E80480BDD4FB9D2423F14FEB2533C685BD8422DE1E66B4CDD86B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972495, "uuid": "2627ed64-aae3-4129-8d2c-ab0b1adeddcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972495, "uuid": "aaf41a64-1c35-425a-b2a8-46d822c6dfd3", "value": "6144:H7Y8sQ1vNUtKcYWWvc7+4/0uvh0A1QiiCUKH5McJ6xfC2oVF7kMYk0mJRIT1:NvNUrK4/0uvhP1QiTHsfncVkkRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704972495, "uuid": "baebd6c3-8bba-42c2-8d4e-58fbe7b0201a", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704972495, "uuid": "ec538fcc-134f-4794-b8a0-8b6b4560435b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704972495, "uuid": "43581abf-389c-4a64-9f73-80231d43c115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71798e0e-b05e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704963017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963017, "uuid": "d133dfb1-e5fa-46e2-b65b-292d1ff7da06", "comment": "Malware payload (Socks5Systemz)", "value": "847dfb1645bff95713fa8309693b3ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963017, "uuid": "410985f0-b92d-49d4-97a6-54bbea360706", "comment": "Malware payload (Socks5Systemz)", "value": "da13f66fcc1656d7c8e1b767574c3e0738e74b2be244ab7d8742cd288277e7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963017, "uuid": "8a424928-4fb8-4368-a111-e7bc117f5fb4", "comment": "Malware payload (Socks5Systemz)", "value": "31ef2fd412953440d2379e625095147407fce473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963017, "uuid": "ae526c3f-38c8-4d58-8329-08688857d98a", "comment": "Malware payload (Socks5Systemz)", "value": "a18e697e9e70f77fe2449a2a5a543dc9d406681660c342446a9c4c6a2e2db19d2d12c6b236c3ef82cc7c47478df5e8bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963017, "uuid": "5fa1f307-9b80-458b-a33b-2f63a3df8a22", "value": "T11F3622284EBDF859C2D449F46EA176ACE530DE612EBF42435CE7B9AED839B8C3D15100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963017, "uuid": "dea7d4d9-fd06-4aa2-8221-e7f6e9491f4a", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963017, "uuid": "945fa936-ce1b-4728-8f9d-1d1c76219fbf", "value": "98304:Bi/pvA3Q7kDIpM8qG6EQgI+C3jE/+KK53YLAdBlDvr1WNzEkq:A/pv0ekB8VG+mjE/+TYM1DazE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704963017, "uuid": "b80e9bb3-e943-4573-a710-29df0dcbb7b7", "value": 4875387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704963017, "uuid": "7856c784-34de-4bd3-9af5-4294a14ece2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963017, "uuid": "d486deae-fab0-4115-8f2a-120783ec3712", "value": "847dfb1645bff95713fa8309693b3ac1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bc4015-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704940291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940291, "uuid": "8abb3f95-36dc-4641-b92a-d6cfac844ebe", "comment": "Malware payload (LummaStealer)", "value": "4576070776469ea8a30b82f61608f722", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940291, "uuid": "60af3b38-8ef2-495d-b780-07752a782dcc", "comment": "Malware payload (LummaStealer)", "value": "da2e82a165342cbabe9bfcc46865d2fc2b707914905ea174bb444588a2780bd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940291, "uuid": "c11db951-0497-45e9-b763-a0778865db7e", "comment": "Malware payload (LummaStealer)", "value": "55c8f9a8b95bbfec0e8509cbda12f8b79eb2721c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940291, "uuid": "8de00a86-e491-4c5d-816b-4a3f97ab55d1", "comment": "Malware payload (LummaStealer)", "value": "8a622a695ffe058f5c6f3de3a89c98d17df0ba423e4db91d31a6206b86e27ed4e557f40431df8a2e272d3466801875b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940291, "uuid": "8c6345e0-d27c-4690-9100-1f8831e8f458", "value": "T17FD42240A7EF9330DD941838D4CB424667F58A931A73EB853E4C16D64F22B8AD7ECB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940291, "uuid": "5700f252-63a2-43d8-83c9-2cf439cc2f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940291, "uuid": "5555ee8a-496c-4555-bad3-c9edc8a95f85", "value": "12288:yI3KHXmKlrTz8QJGA72xm6Xld74lgoHaSjqd:xKHXnlrTzj6x+lgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940291, "uuid": "6298d107-708b-4808-aa66-2da9021adbdd", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940291, "uuid": "559611c8-3ff4-48c5-9943-04490371807e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940291, "uuid": "89a15872-b740-4990-aa12-effab3350d93", "value": "4576070776469ea8a30b82f61608f722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931753e2-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704940310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940310, "uuid": "bb0dea7d-acae-43dd-8f7c-2152010ac181", "comment": "Malware payload (RiseProStealer)", "value": "a34de9d2371ce65daf1b2e881bde88b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940310, "uuid": "0338fc04-51af-4776-aaec-ae0bc7bd3c38", "comment": "Malware payload (RiseProStealer)", "value": "da82319d644e8316e8271b697d5c5df9e20d7edba7f61aafca3c0e2b94440899", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940310, "uuid": "ba4042f9-214b-4c35-acc9-32cfcc1761d5", "comment": "Malware payload (RiseProStealer)", "value": "1cc972a6ede26364255ba1df4f37dd1e9c37fd8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940310, "uuid": "38fa060c-f141-4fb5-8f26-36d3fe63439b", "comment": "Malware payload (RiseProStealer)", "value": "9fe6c0f2490d3381d125beaea6b23a7b52d25d8962471be58ce5d86c2720e3bf287abb73bc8abf9848bca4f6406ec2cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940310, "uuid": "1fcb2f8b-b859-43d8-9c5a-9504120eb896", "value": "T1AE9523F136F48A9ED4E207F45FB59A6022C06EC9CF285EE9C4E72D6377076C16A02647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940310, "uuid": "8edd2c5b-e4eb-444e-b591-3e19d82192f0", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940310, "uuid": "fc8f68d8-a65e-45d6-8991-fe5adf5a485b", "value": "49152:hRyR5cG8TfDd2TF9M1uUJj2wdeWQWBBr:bdfx2Zudj2wALWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940310, "uuid": "d0127059-e5ab-4d8b-b242-213470eaf149", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940310, "uuid": "c78235e6-b782-4212-b8b0-6db7f8e306d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940310, "uuid": "93885b94-fb6e-48c5-b512-e72972a89920", "value": "a34de9d2371ce65daf1b2e881bde88b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c5837b-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704980199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980199, "uuid": "15fcb593-ed44-4cc0-b709-55d950d2f029", "comment": "Malware payload", "value": "94934fee048f42251377c684ec6898b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980199, "uuid": "c7730a69-1604-4f41-909a-26a059e876b4", "comment": "Malware payload", "value": "db166d0df8c59f9292ac47d5ae910cee4f85407a8208d0c2743ef85ae752ff85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980199, "uuid": "8459d192-6e0c-4ee2-921b-fe146fbdd792", "comment": "Malware payload", "value": "95f2bdad35f69f096e575942c156c2973fdbba14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980199, "uuid": "8472387f-91f2-40b7-90b9-fbd6b128132a", "comment": "Malware payload", "value": "6c4f4a9bd54c40c4073d5fe0f13ee1ec40aff50947d1edcb9705d4e13f6d1a5e75e29f00e81e618516800201834239e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980199, "uuid": "d466bd02-6ef3-4060-a5c1-b671ced1d11a", "value": "T123C5B503B7CA8DA1D1991F36E5A7841403B8F982E723D70E36CE6B6D16437BB8861747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980199, "uuid": "8e0c07ff-c6d3-4955-a117-e9149dedcf34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980199, "uuid": "678d1b28-d8d1-4a09-a01b-92c91f96f27a", "value": "49152:H/GTfONvgGpoLnw8kYx07+aSpxQ0WcaxN3Q5:gfONgGKLnw8kYxWQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980199, "uuid": "ec5f0b1f-ad76-437a-88a9-7d5864dfc924", "value": 2596240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980199, "uuid": "1ab42f24-59eb-4518-861d-fddc4b6fe1b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980199, "uuid": "d7d1ccb9-39cc-4967-938e-fb4968db43af", "value": "z1INQUIRY37567JAN2034_NEW_ORDER_MATERIALS_PROD.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78568b90-b048-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704953579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953579, "uuid": "e8dc059d-fdf8-4a4a-92ba-4723c74624a4", "comment": "Malware payload", "value": "b754c3f9def1818fb8677314b8e89292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953579, "uuid": "35596934-d004-4cf1-a566-8c1cb0b244ef", "comment": "Malware payload", "value": "dbcf21a27c826ebb4fc94610736aa18c005732200939e30a3d39f8b96c7ed860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953579, "uuid": "19e40a96-be21-4a0d-a590-1a40170aac8f", "comment": "Malware payload", "value": "8832a8a74b4b31d36a0cfcb8b45a0fa9a3d83b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704953579, "uuid": "ce3a2b7a-0dca-494a-8222-e256be03b074", "comment": "Malware payload", "value": "d683ed6e07d2592ecccf6b7cb3cbe526239f733ec91ceb83126d948635b907a95faaab06c3d8bb982410e1beb13a42ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953579, "uuid": "7110343b-66ac-439c-8851-029fe51341eb", "value": "T14BB52211BAC48936D163117619A10A969A7DBCB14F265EEF53F03C6DEF306C28E31B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953579, "uuid": "8cf48ef3-b588-4707-93f5-6db26b176108", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953579, "uuid": "7894cdcd-9a11-4558-a686-5fa0934e75dc", "value": "49152:1monDVDRsxJoeyBfG46SrcLyuFipSeFuQ4HkQ3wYNXgkh9P1MqnHd:1moMTmSu2FipSeFv4HNwYN3tt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704953579, "uuid": "52bf3098-b3f9-4e88-bde3-8dbec654d1af", "value": 2454066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704953579, "uuid": "bb5d9c99-06b4-409e-a504-68fe0f0dce02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704953579, "uuid": "2b496c7d-c516-48ae-8ad8-81d363fe38e1", "value": "kino.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bef4dae-b05f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1704963330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963330, "uuid": "213e295a-4249-4682-8652-f5453ae4d85a", "comment": "Malware payload (Metasploit)", "value": "031447ef101b64d874ecc9de2f84319a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963330, "uuid": "c4b2ceb6-feae-4ef8-b583-cc04dba8f3fe", "comment": "Malware payload (Metasploit)", "value": "dc8351cb804dc063b27136910868381f2219662a9634a89853f72031de99585a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963330, "uuid": "7207e918-0a36-483b-9853-3d639dc5ab11", "comment": "Malware payload (Metasploit)", "value": "7971cccd816ca84e64c33e85712e6355a55ae507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704963330, "uuid": "6381c971-bf08-45ce-9f1c-691c151ff9b2", "comment": "Malware payload (Metasploit)", "value": "57a29ec458d1d64f2718c0f527e3bfcd53e5bfe6ecfb794baac098b47189099e25678b8c53b386492fb6ae98cda2113d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963330, "uuid": "494592a1-9d82-4bd4-b3a2-172629ee90ed", "value": "T1D6524A87F3854DFED5394331C9B31E96A47AF6640B624B4F4370812E0E66B82293DB69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963330, "uuid": "bd776965-1e0e-4836-9040-f15ace14a54f", "value": "57a9e1a25cbc2e8c5d92ec7e66a47e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963330, "uuid": "b8971488-a4a2-46ba-b845-93915115db27", "value": "192:UF/fNdYd9C4f8V/RUJoSf5DH60pAJR/iuUrBVIKEv:UF/F6C1VwoSf5a00R/x0IKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704963330, "uuid": "1571f900-b7c2-48e5-a64b-5428def93a02", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704963330, "uuid": "56955748-0076-48df-9e16-5386c5687f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704963330, "uuid": "a7c6ad0f-1dec-4191-a46c-2217392aeab9", "value": "sample.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25213e3a-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1704978351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978351, "uuid": "21ad1389-fdae-48b5-8492-088841602c64", "comment": "Malware payload (LummaStealer)", "value": "d7aa46ef8d09144974f4dc10e5ef1b7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978351, "uuid": "61fadefa-605a-491a-a1ac-74a0f1ad555e", "comment": "Malware payload (LummaStealer)", "value": "dcf14d2ca4c03349e53216c94512cf010326fa9ff35978e8cd7684862ce14c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978351, "uuid": "f2a2b17e-51e1-44f6-999a-5328f406edfb", "comment": "Malware payload (LummaStealer)", "value": "2481de3b3feb57b03c5fa019e7e82ba0daa33f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978351, "uuid": "d999a991-d1a7-4322-b518-2b9f18a979ac", "comment": "Malware payload (LummaStealer)", "value": "39458bf48e1b36af4c43c48f29d35717c7a787bcfeaf0ccc095e4046df6da8fc98f9a863411c0a5c07d0d57db1447f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978351, "uuid": "c17b5609-c5ec-466f-80ce-efe9fed440db", "value": "T14AD45C32F8B3E065CE4F34B981F8B76AE71E5DCB4354887641848BA45D30A3A4979D3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978351, "uuid": "b69b58f4-798f-41a6-b267-f906381e4a48", "value": "a238dd5e708b2e5b98247b73320c973d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978351, "uuid": "b3e94f8f-5059-4141-afa4-0cd829b2f88c", "value": "12288:xMLjyr2TZ9l1V7qArW36xjKUyNBWdGKsQDu9Rm5Rg/LIqG2VB6:xYjbNL1oeqkGsu9lpBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978351, "uuid": "4a1d7509-7dde-4e7e-b465-36bf35873dc6", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978351, "uuid": "4ef40c08-ef23-4daa-a430-1da13f633c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978351, "uuid": "147b36ad-ed3e-4414-a62c-34aeded9c7f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737ba85e-b095-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704986642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704986642, "uuid": "a819c8b6-63f3-4324-b501-68206bd86652", "comment": "Malware payload", "value": "3f0c864b2d153e3e1366aee0fe340664", "object_relation": "md5", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704986642, "uuid": "82576de6-699c-4397-a3af-6672c1e2000c", "comment": "Malware payload", "value": "dd76f0291ecde11fede5a3a1856cf703f2cd931d7095efb8f5d635c0c8b68bef", "object_relation": "sha256", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704986642, "uuid": "d621db97-ded5-4ce2-baac-a64f39927df3", "comment": "Malware payload", "value": "68bb56a1458055dc8825192c1e5611f11622d983", "object_relation": "sha1", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704986642, "uuid": "5227977e-6e39-4e9f-a47d-34fef4726724", "comment": "Malware payload", "value": "e6a15a211eb455a3cc4631321ee9ec1c6da54222fe8a3d5f599c348f0e938efd9447440a38393963c0d523000cfa61b3", "object_relation": "sha3-384", "Tag": [ { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704986642, "uuid": "0762a0d1-7260-40e8-886c-d82788bce745", "value": "T1ACF38194B7853C440F9EB138A01FE7D6A46BB22E6C47C9D5944CF2C29CB904B8B53BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704986642, "uuid": "052604e8-e4ce-400b-b435-219407c542a4", "value": "3072:vSpwVJ6lsDmZOW9iUE782WpK8vnOHNxmXFfSxo46jnQLTuSSqpZ7uXDWAGslCO+c:aGVmZOW9iUE782WpK8vnOrmXFfSxo46B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704986642, "uuid": "718b8a0b-f56f-4a13-a2ef-198aa9e97e90", "value": 164169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704986642, "uuid": "4d8dad6f-968e-46e7-bafb-8f03e14f9c1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704986642, "uuid": "d35ff449-5b0e-4e0a-a091-f54bee23b07b", "value": "193338c3f13d2276_0.plain", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4aee17-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978498, "uuid": "cb4f5859-2e78-4ef0-9081-b7108fc8d081", "comment": "Malware payload (Mirai)", "value": "248c516786d0aa6f98d45766c1c58667", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978498, "uuid": "e2d9785c-2708-4669-825a-6ff98419af33", "comment": "Malware payload (Mirai)", "value": "df630714b75ea32ed26efb7693d0d56e3827401dc2482457a40b73719c51c69d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978498, "uuid": "9446311b-ef2a-4211-9b0a-1595705bd9ae", "comment": "Malware payload (Mirai)", "value": "b3f0160926f7b452d177122edc1811bce9f642b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978498, "uuid": "a8d0f356-452a-4efb-a96e-ef0aa53c2a18", "comment": "Malware payload (Mirai)", "value": "1f4edf9cbef3efcbaba56f72038e71e6e227b1d63b4af3122c3ef6b5a4319520ab0c42daafba121b00d2c36147b3d288", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978498, "uuid": "233393a4-7a8a-4b84-b37d-30ed42f93094", "value": "T12AF34B07B4C18CFDC4DAC1B45B9FEA36DD31F4A91234F16B27D4AA232D8DE205A5EA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978498, "uuid": "93b8cd01-ef1c-4184-8404-e7cd3c838686", "value": "3072:vck5zqAdDVsBkO9Q4lrUKyGE+knDtQCjLA0RmQU6MAWyQwH0OQ:vck5zqAdDVs32bYQojyQwH0OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978498, "uuid": "a40eeed0-715e-4026-9c5c-247bcb1dfc51", "value": 161752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978498, "uuid": "99d18c46-02aa-4b8d-928f-6cb694438629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978498, "uuid": "90bd8ed3-86d4-424e-85fc-ffe98b09eb06", "value": "skyljne.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b0c8ec-b073-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704971862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971862, "uuid": "a249a69d-2de8-4e8b-b8a1-6c57dd5a724e", "comment": "Malware payload (AgentTesla)", "value": "36b248e67cb1711b6881f07ee53d7bdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971862, "uuid": "b4324711-ccbf-456b-8007-32263d2ccc1f", "comment": "Malware payload (AgentTesla)", "value": "df95e225feeb2e8547d53ac6760e13c8ce7a9a0858e71df3a4509663285f7cd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971862, "uuid": "77e56238-beb7-48de-9a96-706f3ba8a026", "comment": "Malware payload (AgentTesla)", "value": "0d5e212b5b808ccb81a30f834c61f2378aae8e93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704971862, "uuid": "76a52490-7fb0-4b1e-98ed-fa2bcc6c6903", "comment": "Malware payload (AgentTesla)", "value": "d3b57525d8115fcc599fc43e81f94f061db38d675c512f35bb8250519bd403ce28d38763339533e109fa65a7d32bf627", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971862, "uuid": "baf60fa7-5235-4d4a-95d0-ab555916386a", "value": "T16F15E33D1BBF1227CC77C6ABCBE8DC27B15194AB3D11DA6485C3439D53B2A42258326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971862, "uuid": "a4103792-86d2-4e2d-92ad-efea24bff51b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971862, "uuid": "86037c9c-5148-4127-9f42-919a19a74ad0", "value": "12288:4U6eRXUVUOjuh1xHvWvGttg3IgagVIqkI4YXrjfLEtsVX4aWZrAKV:Kuru+iIKkI5rjRXYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704971862, "uuid": "e540727c-8d4c-419e-a39d-2795121d4d15", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704971862, "uuid": "c202d0aa-976b-4c2f-83ee-6a25acb247cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704971862, "uuid": "e6eefc2f-a25f-47b6-b9fb-fe2cad7dcbad", "value": "df95e225feeb2e8547d53ac6760e13c8ce7a9a0858e71df3a4509663285f7cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fad26b-b07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704977417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977417, "uuid": "2e3ff109-b0f0-4f39-b0ad-1611c017a38a", "comment": "Malware payload", "value": "ba6e6808e26d80f69889b5c6b0c588b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977417, "uuid": "821ae522-96a9-45a4-9f7b-9372bd0f786f", "comment": "Malware payload", "value": "e0b37708bdad729d029e1992be9559e65e957b756185e7ed783369add1a6ea6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977417, "uuid": "c77979dd-2e66-467f-8f35-f3ce0e770808", "comment": "Malware payload", "value": "3563e5fd96ff457cffec36bb77a05ffc4a01a47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704977417, "uuid": "66cd5e70-82fe-4ce9-a845-b2fbf881d8e6", "comment": "Malware payload", "value": "4b476dd8a17ad1e15ba5e908c3e2afd906493d6cfc5342d1434620bdb137026f3434751f19de291850e5a8fb3fc879af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977417, "uuid": "b8cd4404-9b63-45e4-a49a-60d66f9bfb7e", "value": "T149D633800CD1166AF976927EAD738627D591ACFE1371433F25B442679E2BAE80C3B707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977417, "uuid": "62e93d95-6ed7-4aae-b9df-76f7703377d9", "value": "0bbecc8e9f9f17b0ea9cc3899b15e5cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977417, "uuid": "964c4c20-047f-48bf-981a-3d3be09eab53", "value": "393216:KQ2FuxTqgo1FeREWuCEDR1J83a10gjLwsyXsaCmbXpt7V:KQ2FuxTqvjeRiCEDRjEalLw6aCmLpt7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704977417, "uuid": "80fb6bed-9e05-498c-b3c9-33721976574b", "value": 13599586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704977417, "uuid": "a18f4f7c-999d-4858-bcad-4f49c2af1f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704977417, "uuid": "0bc5c291-0182-48e6-8a51-8ed94e35a052", "value": "mhddos_proxy_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186769a0-b09e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704990355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990355, "uuid": "f53d84b9-f2e0-4f89-9a0e-4e62feaea976", "comment": "Malware payload (AgentTesla)", "value": "5b267b3ced989c8eb1f5c12615070ab8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990355, "uuid": "92c26ed9-e4dd-4020-a3a9-5cab23f6f62e", "comment": "Malware payload (AgentTesla)", "value": "e240139a207773b24047ce352998870ba5db138ddeee2f03983e2e0b95ba7cdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990355, "uuid": "29045060-7740-42f4-96ca-5c3ad17071f4", "comment": "Malware payload (AgentTesla)", "value": "19b49ce5e2473fda916815fa1156e6e04a1d7ed0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704990355, "uuid": "407f1295-8b6f-42f2-9e6d-ce1186620a26", "comment": "Malware payload (AgentTesla)", "value": "f7f67d987183221db608a3deed3ef535fc5cf6535be29ead1b66145db5c6fc9dfbfad9bd85304d3831b7e6348d710d17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990355, "uuid": "b0bc609c-4426-4ce0-b66d-be029c7b9fe2", "value": "T148D42309329E4F39F0FD43FCA456150243F9DE255422E3A5EED6B4E329F2F0598A2A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990355, "uuid": "07763a7d-0903-411f-92c3-5f206e6880c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990355, "uuid": "be22c99b-86ce-4ef4-9479-3de1e77525f1", "value": "12288:R+b2BC0W57MCntcrGKqPq4dhj1HlfQhuQcvhOmyvbLKI:U2B+yCCrlqC4PvQ5Fnvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704990355, "uuid": "2de93772-c1a8-40f6-bd3d-a7b1d7034a3b", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704990355, "uuid": "b4f710b5-c1a7-4826-bdf3-32150f94e324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704990355, "uuid": "85e9be52-bf0c-4dce-8582-3dc87b414fc1", "value": "MV CHARLENE DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e16f464-b0a8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1704994821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994821, "uuid": "0d2b6d42-a87b-4f7b-95a3-22fc79fba221", "comment": "Malware payload (DCRat)", "value": "b9998ad96f5218b54e4deb6385064a57", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994821, "uuid": "749d2afd-b0f0-42f1-b4a3-384a077d654c", "comment": "Malware payload (DCRat)", "value": "e4a811441488a49a640f234d4e514d6746ad7ea39c4f1fe750182a358acc4d0d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994821, "uuid": "2ad1e1dc-7c68-42a4-a7cf-a236d2cf9f69", "comment": "Malware payload (DCRat)", "value": "88d349af943ad9f388be4a4ebc59888103075360", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704994821, "uuid": "f929f311-d062-4eab-b7ac-71bdf1e9c098", "comment": "Malware payload (DCRat)", "value": "3bad0f8782163ab42c80d679fc0884d9a50ff681dabd0b2874fbc6993e9efc4eb5357684eff13b6392558df03881bdd0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994821, "uuid": "8eae42e5-0956-468e-97a1-f2c5f242a0dc", "value": "T15C36F10176D1C933C1E43F3189D647BE82B0DF616B22DA4B374A769D7A392E0DB22593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994821, "uuid": "7dd2895e-1119-4695-abea-5f6b09c0d0ac", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994821, "uuid": "137d8d88-e0c0-4480-b990-3c1b99960c50", "value": "98304:2UzS65+x1dnewkG4ech1iuP0/5I3/P9XPV3vdMb/GSnymSFJzhoSaM3:2cS65+x1BewkxU/5I3ZtKzGSnry6SaM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704994821, "uuid": "66429400-f4d8-4041-8c60-97cb4da59b7d", "value": 5278208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704994821, "uuid": "4d419c72-d2d3-424c-b417-ffb6b395a22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704994821, "uuid": "56edaf28-d820-4859-9835-164c9b1f0cc7", "value": "b9998ad96f5218b54e4deb6385064a57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9852dde8-b044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704951915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951915, "uuid": "a82fb3bd-2b08-4ae9-884e-3b96cd780930", "comment": "Malware payload (Socks5Systemz)", "value": "3fa2a04461e54873a2fe9a0c81508d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951915, "uuid": "28715ca0-2aac-43ce-95e9-6e4b26dc310b", "comment": "Malware payload (Socks5Systemz)", "value": "e4bfddcd30b8deab9039af5713b550132fa1603d6104eb5218b3eac0dfe835be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951915, "uuid": "c6a197db-08ec-476e-b330-644d478a60de", "comment": "Malware payload (Socks5Systemz)", "value": "4e4ae53b230a95f49fe123048dcb9cff125eea6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951915, "uuid": "dcc71273-e6f0-4638-8c01-8f64a857b34b", "comment": "Malware payload (Socks5Systemz)", "value": "d87717d84a53bed78d2e57503cd90e646df7b0a89b5c203d967c7fec5e360fed29c418dac7314fe21ee1ddd06ce5cd4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951915, "uuid": "1a9dc84d-6ed4-47f6-a631-3ade9e1e71df", "value": "T1453622185BBEE856D1C109F4AEA1B6ACF174AE516EBF0147ADE7B85FD87AB0C3D11000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951915, "uuid": "6fe7a436-c895-466e-a86b-b8c1c052c7b2", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951915, "uuid": "ff4ab157-3c19-41d9-a3f3-d557d5992f48", "value": "98304:Ni/pvA3Q7k0vtRrIorWpxngwihvlo2oMtnducJEmEqVEkS:U/pv0ekstRr9Axslli2duUEq6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704951915, "uuid": "fa290450-927c-4401-ac20-799d86cd0767", "value": 4871579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704951915, "uuid": "238e1586-b2c1-42d0-9a43-cb6a3c9c319a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951915, "uuid": "a3dead3b-db93-432a-b76a-f4245422d009", "value": "3fa2a04461e54873a2fe9a0c81508d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c796c8-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1704939054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939054, "uuid": "7fe8a006-3598-469a-ae8a-ca3244cf7c3c", "comment": "Malware payload (XWorm)", "value": "54d20784939abf094c4b179e5cbe66a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939054, "uuid": "deffeaf1-74d0-460d-ad9c-86f8bb5f5455", "comment": "Malware payload (XWorm)", "value": "e6032f19912376cf1309dd2586a98236bae532e2e0f50be16d13d515727d0196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939054, "uuid": "20393ece-f20e-4b53-a882-e76a2fc0b26f", "comment": "Malware payload (XWorm)", "value": "9d9309433ca2ab950b8b31f5e3fa6407623445b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939054, "uuid": "79dc0ed3-2363-4481-8b24-6d9f8fd90dbd", "comment": "Malware payload (XWorm)", "value": "3de5eb8564a693a464b2623291f39d7baf9a42db7e9a4ec042bb956dcd73d2a27cc0340b79054c39cb26d0f17d990951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939054, "uuid": "97454c63-0143-4176-b810-5db58f80b5d2", "value": "T1FF150203BAC15872C4661A721A35AB10ED7D7C205BA5CFCF97C04E2AEAE11C1D735FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939054, "uuid": "618a5934-ec8b-4a61-bfee-35695e73cb41", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939054, "uuid": "821e69d1-e6d6-4b38-90cc-e78aaf5e39ed", "value": "24576:yTbBv5rU/xsv+BJq/h5a/BGa6mXcqIAXiAQFSDO:UBmZJq/h5zLAXiAV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939054, "uuid": "c11fb387-4be8-4fee-98c3-588bcda6872f", "value": 926746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939054, "uuid": "666c5b76-59e4-4eaa-b8c7-125e2846d8dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939054, "uuid": "ebad5c0a-19dd-469b-9073-7db5c73fc54e", "value": "Purchase Order-3443567787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519baedd-b087-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704980573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980573, "uuid": "6b6e5a49-5b72-4d26-a0a8-3529f6710b95", "comment": "Malware payload (Formbook)", "value": "fa4fb29d644b32739bc6a3e1537264da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980573, "uuid": "4c14cab0-cc25-40e0-ac2f-ac4e7532dd49", "comment": "Malware payload (Formbook)", "value": "e7236fe777e772afa5fe027e6013318ae8724059ee3d05101771d4528e7fc5b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980573, "uuid": "82dd33e2-1f19-402b-bd95-4218271000ff", "comment": "Malware payload (Formbook)", "value": "f3812509497dabf75be081efc13b183eeef3c1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980573, "uuid": "96b5df22-afab-46b5-a95c-5a30d8c889a8", "comment": "Malware payload (Formbook)", "value": "017bf6132b5a2dcad90a32005fdd05d635712b847523b9c8bd9ba750f48e3d3a2d37173a8d604b3e36fa6dea76effeab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980573, "uuid": "ee1a4116-42e4-44bb-8b03-a8822f1f7d7e", "value": "T1E8557C137385B0A2FE9651320A5BFE114678AD363133A77E13B439B9B9705B0473E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980573, "uuid": "ca5191d6-638f-4a07-ab78-11c0953e6180", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980573, "uuid": "7f8f6fec-c360-40c9-827b-28b82662ccbe", "value": "24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8awUh9H16gR7:hTvC/MTQYxsWR7atr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980573, "uuid": "fa0c1237-42a6-43cd-bd42-ffcaaed7527c", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980573, "uuid": "c26c4cf5-b178-4c0c-8715-a3354a1bedbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980573, "uuid": "085444a2-f3b3-46e2-8eab-708fc9e0a79e", "value": "rRecibodeenv__o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe97896-b081-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704978281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978281, "uuid": "079de040-a810-48c2-a145-4f142f025c41", "comment": "Malware payload", "value": "b70ca3f7e61e7fc69b5c5b2dc7ac7d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978281, "uuid": "35eb93d8-7d6b-421b-b271-2163e19bcc12", "comment": "Malware payload", "value": "e7d05102c4737019c554a7d3238ba9654c0e09d0e76590cf8c6f8fe3038d07b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978281, "uuid": "56e12edd-230c-4e0d-aec1-c34ce553d4d2", "comment": "Malware payload", "value": "edbdd9db2940f5c256ee70267712d369d1e272cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978281, "uuid": "68ca6809-7888-43ac-81bf-bfaa0f4af017", "comment": "Malware payload", "value": "323771e948c168afe5a6d4e4ac377aed282d1365d86a394e1800be1a05dcbe161d09770ba6586b7bf1b2d388be2416d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978281, "uuid": "a735a547-c55e-4d0f-bdf9-ce2d72de7903", "value": "T1AC721B0DBEADC123C5EC367D0452031F83F9E7AAA842E34B5DCC5D563A2A3C855D22E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978281, "uuid": "0277a112-01a6-48a9-a0ca-0cf5aa2cf90d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978281, "uuid": "9f9f06bc-3573-4149-8f3f-3abd50051976", "value": "384:2gWIJvoZ+FhSFf6E/D6qkODaglsgXJI/f:JWPpFfZ6LgXJI/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978281, "uuid": "5dd00085-0631-4c5b-9e45-d206d953a2b8", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978281, "uuid": "1d4244d1-b10e-46ed-923b-eb7c7885e7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978281, "uuid": "d95df8bc-6514-4d9e-8886-38678ecea64d", "value": "e7d05102c4737019c554a7d3238ba9654c0e09d0e76590cf8c6f8fe3038d07b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a76a4a5-b076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1704973259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973259, "uuid": "0ce0fa11-61b1-4720-8779-4b6e199b9960", "comment": "Malware payload (QuasarRAT)", "value": "e638bb20ab708a628add2b0004471821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973259, "uuid": "a277b43b-bdcc-4e72-a1cf-042137e30212", "comment": "Malware payload (QuasarRAT)", "value": "e8af36287e2270581fd5f2d28c6e0b83b337f58d430554d28dbf55d2ca09fcca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973259, "uuid": "07123a79-737b-4e0b-9727-69a2c6287adc", "comment": "Malware payload (QuasarRAT)", "value": "09d275c434d8eeac1e3aa897c0f9c3d32d7d7422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704973259, "uuid": "a920dcbe-e9d3-482e-b8ae-4d28ccded5ce", "comment": "Malware payload (QuasarRAT)", "value": "166bea3b9c9bda205463eece03e38643054c71484105ec8a08deaa9e43976d59fe663a7be825b1a4373825b058777a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar RAT NET RAR PWD PS", "colour": "#585318", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973259, "uuid": "5e8449be-c098-456c-b492-169a65ebcb9c", "value": "T1571733AECB8B7B83E4315BB65601360DF87AFB151565CB210BCF9378B72608CA4E05D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973259, "uuid": "c57973e0-8cfd-4ac1-b3ee-47cc5fa87b2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973259, "uuid": "b2267917-1e97-4de9-89f0-1dc4ae5888e2", "value": "393216:wgH6oMKox8iDN6UCdV36/12QcAhk+NuwONXJX3O3+jLL7nAbSIF15:1MKoZ8U+BAFaNZO8LL7ALD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704973259, "uuid": "d4e6d22e-345c-410e-acaa-5b2540073093", "value": 18899968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704973259, "uuid": "f650cb38-2b64-455e-b8ee-80d7bd33c57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704973259, "uuid": "d888a763-6cb7-4601-a73d-b3e09f10b76b", "value": "gbquas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268ed41c-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704980071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980071, "uuid": "43c6ecbf-d975-4527-bb66-758ed9611828", "comment": "Malware payload (Mirai)", "value": "501e42021664b3a52289665d2655ff85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980071, "uuid": "05b38a96-a6e4-41e0-a20e-7fd1a8558a94", "comment": "Malware payload (Mirai)", "value": "e8e428592478d9ed2e5baa70d7cf6e8d9a89f8d9d6942c1178b806b4cb5888ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980071, "uuid": "b7416774-03b0-4905-a518-a87147d95dda", "comment": "Malware payload (Mirai)", "value": "9b5a899c02ba11cab956010b5753b5e8e03f200e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980071, "uuid": "1c29df09-67ec-4d57-ac26-71e2ed934f6b", "comment": "Malware payload (Mirai)", "value": "be080412cdfcae49a6b373dbecfdd72b9178c4b7911560c8e3963f2e21b6a0eed5fd514ca09ca4308a77cc51ddaf2123", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980071, "uuid": "5e545a7f-8de4-4251-95d6-d422dab33bef", "value": "T1E2F33AD7F800DEBAF80AF33744630A25B130B7D111925B376267797BEC3A0991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980071, "uuid": "5ed4b28c-a2bd-4da1-99d4-f998ea2b5e63", "value": "3072:jcNZvk6ZwNWK6vlw4mwt53kStEDn7YVrjbiwLTTk7+ygYSIW7NTO:gNTw/At50S+n7cLTTvygJ37N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980071, "uuid": "20a7d346-4d7a-4bab-bd2a-9591bc4f6d8a", "value": 172096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980071, "uuid": "7825b3a4-a8a9-4305-a101-d34a426d4cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980071, "uuid": "5672cb31-ccd5-4a15-8793-e10c734e70e8", "value": "501e42021664b3a52289665d2655ff85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe17b8a-b081-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704978073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978073, "uuid": "51c9518d-4948-404c-9080-92a98e04fca9", "comment": "Malware payload (AgentTesla)", "value": "049e5298dee90a234db7ff0336e42361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978073, "uuid": "38b34fe8-39e4-4416-bac3-b2a5839ca772", "comment": "Malware payload (AgentTesla)", "value": "e909f6d833125f008ea789af8fdfb40041c2fecbca437a8f0da7e289efbebe89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978073, "uuid": "c568b2cb-6b02-4373-9e8e-a503789ee7a8", "comment": "Malware payload (AgentTesla)", "value": "af7026ba790d977e066ca6e5f158196583127cee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978073, "uuid": "43d6867f-018f-4a22-b7f1-cb5ec609bc4b", "comment": "Malware payload (AgentTesla)", "value": "8c0d494a4c3cef6a65228561ef65608aaead29c6d4c4e0ef223bb56842f77389fb6d28ebaa15e78764e110ce7570e468", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978073, "uuid": "87626321-4aab-4a52-8bc3-cc66ed752cf9", "value": "T18BE423C2EE86D612D95C80F1C1AE5E85937A08167311FF4C5ECD63C8469870EEDCA6EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978073, "uuid": "60491361-3539-467f-8398-90cf3ec5937e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978073, "uuid": "1cef0c7d-644e-423c-b385-bde3a821ab8e", "value": "12288:V45+po2DRiWedT4GE8diPROQnv0vJj6OiieLA14th+CQkcVNBpk1gP3oCWbD:g+pJUWcTJy5OQv0xmieG4T+cclqCP4Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978073, "uuid": "46ce3733-1c35-4bb5-bee3-0b3049f8f0df", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978073, "uuid": "c941ccff-5002-4c03-9095-23cca519ee5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978073, "uuid": "ed1a0d1d-085f-472b-8b52-2430469d07e2", "value": "e909f6d833125f008ea789af8fdfb40041c2fecbca437a8f0da7e289efbebe89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0527d33-b02e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1704942506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942506, "uuid": "f458121a-bdda-40f6-a3c0-93a659a587f8", "comment": "Malware payload (XWorm)", "value": "f0449b9fcc34ff41ee98527228e6716a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942506, "uuid": "22099039-201b-4a49-8824-3d3bae9767c0", "comment": "Malware payload (XWorm)", "value": "e9784ddc7220f06d1543b7b1fe22c05d70599204e62c39b935bb93f670ab8a88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942506, "uuid": "b9ea54d8-01f0-48fc-99c4-ac48ef8e9030", "comment": "Malware payload (XWorm)", "value": "f91c0f6bdb283e4a58ff095fb06e5b09c74ad1f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704942506, "uuid": "c59cf750-3c32-4d72-8610-ed0de379ed1f", "comment": "Malware payload (XWorm)", "value": "683eb6a0824121ed37596a987b791a2c7f3a39a9748c627125f61a586961d9473d54ac4f2d778e4cb7bf578ea2695eee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942506, "uuid": "234dc215-76ce-4c9c-beda-8cad56687ca0", "value": "T1BB967B04ABE84E66D4AF4B7294F543916BF1E8296B37D71F360CA1767C523804E423BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942506, "uuid": "eeeb8d70-c917-4923-9dd6-ecca29ebbb30", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942506, "uuid": "45776c33-45a6-4c8d-8724-723d985a404b", "value": "98304:nwiFPJppakuZeG6VRKY7cMpBURkNdeKCeRvV0:wi3pOeG6/KJMXURk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704942506, "uuid": "4042944b-f7c6-4b58-a695-f3e41d74a537", "value": 9174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704942506, "uuid": "9305b59e-9203-4404-a514-de14f313ce24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704942506, "uuid": "aa5821d2-31b9-47a3-b581-da104e73d4c6", "value": "out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f2a540-b01e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1704935406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704935406, "uuid": "4569ec62-d508-4294-8c02-97465fe8d07c", "comment": "Malware payload (Stop)", "value": "14aef15f47c83979904e8b4ca634dbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704935406, "uuid": "79f69069-7f60-4d82-b106-d13947e92f85", "comment": "Malware payload (Stop)", "value": "e98d3352f1529d8ac7ba663df506f4db64bed2471ef3cb7831eda8fb61868f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704935406, "uuid": "2b05230f-f8cb-4b3b-bae9-52a2ecb98027", "comment": "Malware payload (Stop)", "value": "d69ccae92c595162c18f14a3da071dab86ea6a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704935406, "uuid": "27474289-859c-4f61-be0d-0393aef4b42a", "comment": "Malware payload (Stop)", "value": "6b60fa7243137b8f13507174b80b03480eb345f592081678f45025450b28057a99f46fa042b5bc54fece8ea11befb48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704935406, "uuid": "376be118-f8e0-4d5e-a43b-70d11c63bb55", "value": "T1C2F4120035F9C131F7F366375974C3A14EB7786B29755A8E2A9602B80F26BD2DE6070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704935406, "uuid": "2b5debc4-eced-4dd2-a906-ed22a48a7b47", "value": "7e32959e1e010773874596cbc1a01e01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704935406, "uuid": "4eb33e83-3528-44be-b578-a80ce8614527", "value": "12288:fXezUCfaf8dy+pmHSGN7uUhbBencIbX5DiS4QesF9T1E90vU45uonAvf0/QHF7:fXezhdycmHSm7uU5BA5X55UsZE9AfH/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704935406, "uuid": "028a9ab9-27d2-4845-9899-076fe4b07789", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704935406, "uuid": "e5e29635-51f6-4c3a-9ee8-4ec8c3cf3a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704935406, "uuid": "b2df691f-e7cc-422e-bca6-ab4127a5d2eb", "value": "14aef15f47c83979904e8b4ca634dbef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd51502-b082-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704978503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978503, "uuid": "cb91d3b5-fcac-47bd-877f-65bd2ad88cc5", "comment": "Malware payload (Mirai)", "value": "8dc045545b479e66367c7412c4b57bcb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978503, "uuid": "754c541b-bfcb-4565-8310-a51655f3af81", "comment": "Malware payload (Mirai)", "value": "e9dde263d548e82af911eed5cc8331ebad4c66e267815939816cda7b6972c9db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978503, "uuid": "a88c8ba9-c27d-4841-8c34-aa2dea8f67cc", "comment": "Malware payload (Mirai)", "value": "eedcd5237356346953d7f2ff1d8df89b08d4fc4b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704978503, "uuid": "e985fc89-3c3f-4611-893b-1bdfeb62cc0a", "comment": "Malware payload (Mirai)", "value": "158d2beb4adf210b4d0dfd8540a24a77fddf8f6fc1e3a312d3e81621ad4a68ca99d14d65024a17b2d45d5c0d7d4aa107", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978503, "uuid": "be9a27bd-76e9-4b3f-b71b-cf7843609e00", "value": "T17AE31945F8504F23C6D312BBFB5E428C372A17A9D3EA72039D255F61378A95B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978503, "uuid": "4490154f-c9dd-47a5-845c-2235c945121e", "value": "3072:E02SmV3WCB6FMK64V7mr8cfwjVnMNgIY:E0WWCYiT4Var8csVnMNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704978503, "uuid": "fa6fb153-b312-41cd-97a7-6e5c51d29d1e", "value": 153376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704978503, "uuid": "b1be246d-6d38-4723-bd7f-e6f1c83110c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704978503, "uuid": "4f31d163-c302-4737-811a-a246bc966f48", "value": "skyljne.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f5e773-b08d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1704983080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983080, "uuid": "94f7feae-757c-4c8d-81d4-ce6d91feae48", "comment": "Malware payload (RiseProStealer)", "value": "21bd9b6f1d41a95fb6d286c698f22bba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983080, "uuid": "9b4186aa-b1a9-45b8-ad38-d4758e724c1f", "comment": "Malware payload (RiseProStealer)", "value": "eab4a2382263fbfedbddaed6cd19627ba3d5d9f5db8060a2a1adc2b1c4ca7125", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983080, "uuid": "116ff117-b6ce-4988-9065-770dcef88d54", "comment": "Malware payload (RiseProStealer)", "value": "f89a68acef600d673e4e84854115b6d50664c564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704983080, "uuid": "dd3c7bef-6070-4ecd-9e7d-d5e27e26f59a", "comment": "Malware payload (RiseProStealer)", "value": "99ed6416e35b4f5342293e174d6030d1bd9a8b76ff6a98b25c44f37cc6ce64fe3ed20d7699590c5a651496daa98e0ceb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983080, "uuid": "7853849b-d774-446a-9a31-ba5d94835647", "value": "T1243633731BCFE0B8DABE383191E156874F697C6E6538AB2F0B5DA52B08D17CC5428706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983080, "uuid": "552a092d-7dcf-4cca-acd6-493f649a4c0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983080, "uuid": "3a98c30b-dc6a-44b7-8e0a-25376bea572e", "value": "98304:EBofJGP5IP8otC6U8nMN+CJjMjoANfATJKNJq1nXJFG0kcFcecP15rIf/csDzQpC:eohGxd6U8iBMsnTJKNJOZFVkcFGP1WsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704983080, "uuid": "234091e6-99a8-4f5c-b6d5-4abdbd89c525", "value": 5210112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704983080, "uuid": "f03e4a1e-71eb-4295-8d83-2df7dc29ca25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704983080, "uuid": "c2bc4e4c-7c28-4a05-8f26-6b4b418d0622", "value": "21bd9b6f1d41a95fb6d286c698f22bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d1fe21-b05c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1704962319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704962319, "uuid": "2a9b2150-f794-424b-aa36-aecba2d18c96", "comment": "Malware payload (CoinMiner)", "value": "5e0790e0174670a9132228af22662e37", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704962319, "uuid": "2ac1fad8-d822-47b7-b841-bf35625f03ce", "comment": "Malware payload (CoinMiner)", "value": "ec934a185eaa6cbb76232ab9643e1f579da5515717fe2f78c4de2e3ab8e27707", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704962319, "uuid": "2ee954cb-57f4-4bb8-b88b-c12f63eb3d86", "comment": "Malware payload (CoinMiner)", "value": "372c251a8c7693cc90544fcf0b8c8703b15b5bfd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704962319, "uuid": "d485fbd7-0489-487b-9eae-c96fb0a12476", "comment": "Malware payload (CoinMiner)", "value": "aa0e48af208a5e2f3fe80872e659771faee41514e73efc9c91fcd80a4d14997cdc938780029804b7d5b723b4abaf3b42", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704962319, "uuid": "83b8bf7a-f25c-4322-a76c-10f022101370", "value": "T1277633D83CA791A6FB93CB39E778B14C02C2B6524F92A457100AE5CC4D9B667F312D6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704962319, "uuid": "d51a1564-58cc-4227-9a17-bf5a2fdc6398", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704962319, "uuid": "98d42dab-26ca-4236-af40-c083c47fdebf", "value": "196608:LMIdVsy3xj6eL0PGnYt1QV3bAXGrBKz75tLB:LjdVj3J6eLKBuLAWrwz75t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704962319, "uuid": "5a2db1ea-3838-4527-a44a-a5d071affcb6", "value": 7283712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704962319, "uuid": "062841fe-089e-4f90-b409-5c82a6f52cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704962319, "uuid": "3e972594-fb04-43d0-bf99-41c2dfd5891d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd311d3-b042-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1704951196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951196, "uuid": "3ecb2fb4-789c-48d0-9ab6-3596c4096616", "comment": "Malware payload (Smoke Loader)", "value": "2a62ea99f6e89fb1bcf249917cc87bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951196, "uuid": "5947cf4f-1095-4ca3-9196-007840d00550", "comment": "Malware payload (Smoke Loader)", "value": "ecbaeab79bb9ff98c691ffddfd29e59282af48d48a87fbe20cb94dc83c1c89f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951196, "uuid": "f469a83e-1f63-4e4b-b6d3-3dac0ec8c2ca", "comment": "Malware payload (Smoke Loader)", "value": "c5640703e1ed6276babbef5102dc247aaf3c17c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704951196, "uuid": "59b73570-d01e-4e5e-b8c0-602cf20cc94c", "comment": "Malware payload (Smoke Loader)", "value": "7bf448299239ba95ee22ab8aaa4d6abac5f82ecf7cc60738ba90ee3039c69df2d641b265e874220bcc86a01036da8070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951196, "uuid": "15f32183-a3bf-4a29-bd98-a20e93a9427b", "value": "T130247A1035F58432F7B35A7656B0C3B40E7B78A77971998E2AC606BD4F256E2CE2031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951196, "uuid": "51fd53a6-cf3f-4aa6-9bab-d0865e13a02c", "value": "38fa8b403d6d5217cfc0f8fc65c9b6e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951196, "uuid": "18ae0d0b-780f-4f7f-8825-79f62f22d77b", "value": "3072:Yp/htLJYeiJiiKnTa0/WxCExkGB4wYxRfHVvBL2A:+TLJYehe0/W8Qjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704951196, "uuid": "223c0d4c-4c76-404b-a909-8806ad55285c", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704951196, "uuid": "399f23b6-80e5-4b32-a5a5-7233a47f854e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704951196, "uuid": "6ed6cc91-9ef7-4f81-99b9-719c7f48ec86", "value": "toolspub2(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecfe39f-b099-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1704988406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988406, "uuid": "5c83b388-37e4-4269-b103-21d570e4b48f", "comment": "Malware payload (njrat)", "value": "5e2976ce88fa57fc644c9a4c8927ee04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988406, "uuid": "461c94ff-e40e-4979-96cf-0e40fa8ebb17", "comment": "Malware payload (njrat)", "value": "ed347277bed3d64edf62b11c0c3b15e559a36807c13f6d0036afeb8554b1f506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988406, "uuid": "da4fdf17-ff63-4799-b86a-6317ff8f956a", "comment": "Malware payload (njrat)", "value": "e08925b21d0b4d4489594987caed43fb49bbd6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704988406, "uuid": "209b5346-ff0f-450c-828b-2191e5abc3a0", "comment": "Malware payload (njrat)", "value": "d3614f8ae32c0885e81986b1d95ff6c4ca831cdd68716db3dd2758c0ef85c5f6d0237e91fcfc656c1b1b7eed6ffb3341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988406, "uuid": "90882da8-fccf-411f-b589-2de765f7bbeb", "value": "T17B46AE523788DD12E0796A3AD8EF011407FCF8453B63EB1A3E9A735C21627E61D066DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988406, "uuid": "5ec9425a-c4f2-4cbd-a2fb-86670fcb2165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988406, "uuid": "0be44271-3dda-4942-b607-bd39a3acb848", "value": "98304:Z+O+9HfVZ26AmlfdGK5JGm+Ujnp76sUOQXG67mxn1Aupsff:Z8/HAmlfd5v+Ujp76FVXJOOupo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704988406, "uuid": "32c9671e-4ca1-42d5-a3a3-03b9625dc2fd", "value": 5646480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704988406, "uuid": "1061cc4e-11b3-4a0d-b718-1c5245d824a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704988406, "uuid": "b90ab05f-b5d5-4b56-8200-40268e075e0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c743168-b0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705005018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005018, "uuid": "90583ee6-8581-41d1-a653-6e84178191a4", "comment": "Malware payload", "value": "244e475d884c455bb1fbad1a4294f21c", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005018, "uuid": "5bd64c29-c31b-4f6f-ad6c-4c51cf98e6fa", "comment": "Malware payload", "value": "ee02e5051243512ec5a1839afc6b304b55fb7f14ad43ae84d53eb315c9674103", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005018, "uuid": "1783c259-e46d-4593-92c3-48075b485a4a", "comment": "Malware payload", "value": "1aa8fb5d499974ab686b80af6b2200e4adffb05f", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705005018, "uuid": "5570ecd9-dd1f-4d40-af34-7f9c0beddb26", "comment": "Malware payload", "value": "8fc608fae9e0a0fcb3cfe8b210dc743d59b00d8cef5265c8a8fc83e72cf5100ea0443114652b39c6a5df8c53cf47c1cb", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005018, "uuid": "229fd271-9e6a-449a-a2f8-f864c519594e", "value": "T17FC4232781BE24E2C743303F7FEA4E9229F46A72CBC193564196E5F061438D758BA0F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005018, "uuid": "60de89bc-5897-4106-9d95-c5344b6e3f14", "value": "12288:01wKDM9krgIGM8jU/h8FagHiF/DPR1VqOEWDz:ewYMi1GHKFrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705005018, "uuid": "23745e86-02f9-4607-a9da-1f3fec4bd47f", "value": 549626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705005018, "uuid": "d17cd156-f289-469c-8cb6-94954a4c73c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705005018, "uuid": "e49b9332-67b6-4980-b736-ff9ea3b68a53", "value": "244e475d884c455bb1fbad1a4294f21c.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321c638b-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1704980090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980090, "uuid": "799ba841-f0f5-4bd6-a66e-5fb91cd29799", "comment": "Malware payload (AgentTesla)", "value": "58595eca1d1190a5dc23e3b53938a47b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980090, "uuid": "2c43b591-dd6d-4815-9e59-b69bd8700b1c", "comment": "Malware payload (AgentTesla)", "value": "f062b66382f86660deaed4d0af191706f0d62432c9bd4f1bb75a2b292eed4f8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980090, "uuid": "22ef4f68-61c2-4d72-8ea4-e53b10f407d7", "comment": "Malware payload (AgentTesla)", "value": "3681dd09633702040f8c570736ab8d21f7883fa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980090, "uuid": "e6c46edc-a9f9-49e7-991e-6df6f4820b31", "comment": "Malware payload (AgentTesla)", "value": "f56c91a5cebbb252aec6c4b5d3123d37e972a417e4d00b31451ade8e7f8265b4e4b4d289f93ebe41674307cc5839c9f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980090, "uuid": "bd4df330-be33-4e32-af7c-d51ff3186774", "value": "T1FC15C02C6BBF5227CC67C6BBCBD4DC27B15084AB3C12EA6555C7439D1372A8225C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980090, "uuid": "c03b5022-3949-4d5b-a49c-f2fecfced999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980090, "uuid": "ae8d8052-f0c0-40f4-8414-a278c5e436b0", "value": "12288:23LXUVU4ColgW5O5rWKMlNH3Rt1NLbKeuqZ0plGONMXXrvkkQCY:2iCjW5SKx7bKG0kOmnDkkdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980090, "uuid": "fbb2918a-577c-492d-b8ca-7357d2eb4dff", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980090, "uuid": "1d168f6f-6e46-4967-ba6a-fa4cde6b4f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980090, "uuid": "6119462e-1e9b-4759-9b86-a3b34d531234", "value": "f062b66382f86660deaed4d0af191706f0d62432c9bd4f1bb75a2b292eed4f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3993a134-b058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704960346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960346, "uuid": "85ed82c0-e9b9-4aa1-b025-802aa0893f32", "comment": "Malware payload (Formbook)", "value": "472222b9bc0a918bcd25569e5bfd51f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960346, "uuid": "95d48055-695c-42e7-9adb-f24ebf611bdf", "comment": "Malware payload (Formbook)", "value": "f08afadff8298941a488a237df4deb8f94f13bf274411548f386d2828f4df636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960346, "uuid": "f85546d5-d75c-43ca-8da4-e577d1d3e02f", "comment": "Malware payload (Formbook)", "value": "ac050ea67abb8f7edcc3da0ca6b53357995b71a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704960346, "uuid": "cb26563f-27c6-409f-8f34-71396c8cda3b", "comment": "Malware payload (Formbook)", "value": "51d97323e320411a1d2cf21a1bc33e699cd5f30caf69486b84e44022a0ad98fb69fe5ff02199dacf76ccd5a2e713097d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960346, "uuid": "55f848be-c60e-474c-87c7-58870484c68b", "value": "T1D1E4CD919E8B7C07C535053CC0E6AA7748779A8059F8478ECA74ADA61C26E8C5FF2CD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960346, "uuid": "b3bd42a6-2a5d-43f1-ac76-02e60d72984a", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960346, "uuid": "abac09c5-cfe1-4d52-b490-d5beced2d727", "value": "12288:WsHzOUNUSB/o5LsI1uwajJ5yvv1l2jMoR5h1VNkdFvzQkprQWqeJfyMi1Sm:5iUmSB/o5d1ubcvur5hTNAFvPjqeJfyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704960346, "uuid": "29c9e01f-3b4f-49eb-8437-1c135f339f5d", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704960346, "uuid": "5cbb20a5-3b72-4488-b450-e0dfb61e4cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704960346, "uuid": "2f76a1c2-ca14-4546-acfe-2dd8d08737a4", "value": "Informe de pago - Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c7049c-b07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704976879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976879, "uuid": "9d6a5c2a-b051-43ab-9025-5fbe4ad549c5", "comment": "Malware payload (AsyncRAT)", "value": "72c92867a167a76dd1652c51540d3921", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976879, "uuid": "337fe330-781e-4899-ae93-c0d1b37ad868", "comment": "Malware payload (AsyncRAT)", "value": "f2b63f92ce68836d5f33b8136c8dae7344944a099884e2aad0726e5abdd3f881", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976879, "uuid": "09ffb46f-3653-48e8-b082-b21362665f48", "comment": "Malware payload (AsyncRAT)", "value": "caeb7ab88b4e89e4c9e0282b26478775a5f74068", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704976879, "uuid": "9842f38b-43aa-4e4d-b473-d68f6b8ec225", "comment": "Malware payload (AsyncRAT)", "value": "dcce86eebb1b35101891c5375def71d53bb6e6b61fa69b6982d2e7b872b1552ebf5ab2b851abf90a7211102e24614d25", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976879, "uuid": "1a976bae-b66c-48ed-b41b-aec29131ab16", "value": "T1C3233C003BE9822AF2BE4FB498F22245857BF5677613D61E1CC441DA1713FC296526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976879, "uuid": "624467b6-136d-4d14-b371-05d04cb85561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976879, "uuid": "88a4066e-1a7a-4cfe-ab8f-edd046fdbf9f", "value": "768:BuwpFTAY3IQWUe9jqmo2qLtUhwjxJXnPIcCfK7PzW0bSbRoHai5PmrSjTBDZd2+:BuwpFTA4/21hwfQcCfKhbURo6MPmrSjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704976879, "uuid": "d3af62d8-f420-40f4-bda5-2aa8d3674144", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704976879, "uuid": "b5693d3f-f70f-417b-9ef4-1fb9fd2d5344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704976879, "uuid": "d167f8e4-1017-43c0-8d28-b567dd18613e", "value": "f2b63f92ce68836d5f33b8136c8dae7344944a099884e2aad0726e5abdd3f881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed0b2bd-b03e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1704949215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949215, "uuid": "4ef0aca4-8dd2-4184-ac33-15994efb5f6b", "comment": "Malware payload (Socks5Systemz)", "value": "03ef0f4a022e284014155d52b2c39a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949215, "uuid": "e244f8c8-f8f2-450d-a075-908b8438ce4a", "comment": "Malware payload (Socks5Systemz)", "value": "f4c455771c51a4cc207b7d4712e405a0d6474029541d2dbab07dc11f2bb39921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949215, "uuid": "fed714a8-26c1-4962-84db-6a38cb2a7f5e", "comment": "Malware payload (Socks5Systemz)", "value": "53b446d974a038acca3a3448a45e020ee1c940d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704949215, "uuid": "c2fee1cd-5ebc-4d2c-8dd1-a19b852bff1a", "comment": "Malware payload (Socks5Systemz)", "value": "499e28b91f33be16dffb032acbd0ead14c33f96be04f600ddd5d33dc511e4997a114d4e168901fd76b9e54c2a168583c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949215, "uuid": "9311ee9d-2292-4f21-9a18-e7d6d18a6943", "value": "T1DD3622284BBDE856C2D048F46EA5B6ACF174DEA52E7F02476DE378ABD579B4C3D06000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949215, "uuid": "d4952ca9-a2ab-485d-a967-f910311f9a86", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949215, "uuid": "afe3558d-69c3-40ca-8615-74ecdf02a4c3", "value": "98304:hi/pvA3Q7kEEa62xG3ersIBB4mSf40VR8yNC6zstaA+bovCOVB15bejBaUe6Xkw:g/pv0ekEEd2xG3EUPf1/1+2bICmr5h6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704949215, "uuid": "88a7ecf4-e58a-4724-9b06-7f4fe8688d7b", "value": 4877596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704949215, "uuid": "3e5b427e-9b03-484f-840d-c400cb649023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704949215, "uuid": "4f75770e-80ed-4224-9320-316265a9600d", "value": "03ef0f4a022e284014155d52b2c39a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8224d66d-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943288, "uuid": "19726ba5-6862-455d-b722-173713820f66", "comment": "Malware payload (Mirai)", "value": "e08245694d6d01f2a5c66ee2ea953307", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943288, "uuid": "4152d60d-b284-48a0-bdca-16be883b67cb", "comment": "Malware payload (Mirai)", "value": "f5560f06287915911aced83dada5851fd48752b3ecb4cd9e1331970a09b45bf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943288, "uuid": "30a1c511-0f9b-46c1-9f45-c3cdb9eccbb0", "comment": "Malware payload (Mirai)", "value": "c10983d36597b1cfa0dbd73349626dde874d5180", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943288, "uuid": "956a56f0-78a2-4022-b42a-6bac26188662", "comment": "Malware payload (Mirai)", "value": "1a42989e82f337c538362f686f3cf0d43bef1ec1e772a1105fdfcc530c967b73f41c585a2595e5287c67c2e66c709254", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943288, "uuid": "66570f41-8d9d-4bf3-8ce6-df891c887f59", "value": "T1BC73DB1A2E25DFBCFB9D863547B78E219648338A3AF1D584D15CEA001E7024E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943288, "uuid": "797f72e3-628b-4904-b84c-025fdc173596", "value": "1536:LBVf7r9a7mOVG8GsEEM/faN6ix9dJmZXTTL7hI+D5a:LBN9axGJMMnaN6ivd4XTTL7hI+Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943288, "uuid": "22c43021-072a-4854-819c-12e790f69ea8", "value": 76008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943288, "uuid": "32d5c82b-b8c8-4ffa-9eeb-31c3ac112ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943288, "uuid": "c67a6543-1b9f-46d8-b50b-b7091cc5a39b", "value": "e08245694d6d01f2a5c66ee2ea953307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a28cf4-b030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1704943237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943237, "uuid": "69b8c084-d256-4905-be3b-8c43709b437c", "comment": "Malware payload (Mirai)", "value": "ad2b3f6e02c2d23a236a2d455ba2b5b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943237, "uuid": "4579e7be-bbd0-45cc-acf8-ddfbab86acf0", "comment": "Malware payload (Mirai)", "value": "f5fe110ad4b3c935e9b025c0597d379595413038f4a145e106f3e879ba002cca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943237, "uuid": "cab919d1-b757-448e-ac28-7dbc64cb2193", "comment": "Malware payload (Mirai)", "value": "afa6181550ef6d986c6f8ea3b388ca1df8b2e32f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943237, "uuid": "40c9fe96-b99c-442e-808f-40c018452080", "comment": "Malware payload (Mirai)", "value": "b685f422476b2588c47f294b4d2feb06545c2da283d1d8105fc8214ad3f9c5e873ff083cf71e8b3158c08949609bb193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943237, "uuid": "e82936a2-00ab-476c-9de1-eb5580b6f12e", "value": "T16543199178D19A16C6E423BBFA6E40CD332563E8D1DF32179D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943237, "uuid": "51826c53-616e-45c2-a378-8c935320719c", "value": "1536:EaDIpuRZhJRAAMA+xV9hWaWhK3+C6MdD:EaIe69hWhhQldD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943237, "uuid": "4d496b04-e871-4489-bbe9-6204c26429fb", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943237, "uuid": "60229208-f6a4-43ef-9845-7f6940ce16fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943237, "uuid": "97c92a1b-2234-48d1-81ef-0a94bd6a6ab3", "value": "ad2b3f6e02c2d23a236a2d455ba2b5b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b807565-b08a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1704981797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704981797, "uuid": "4e0577cb-35a7-4088-a8f8-9feaf242a12a", "comment": "Malware payload", "value": "79e8d7df540146d39eccdd89a526dc51", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704981797, "uuid": "d5f63407-57e0-4886-bc9b-cbe996f16c8e", "comment": "Malware payload", "value": "f7199741396138635bb8dcff3d2594927a71d9a432581987c30b98438575aefa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704981797, "uuid": "91143e64-e024-4368-a45f-c59dac6e2e9b", "comment": "Malware payload", "value": "2ba2f351c061d151deef177dfdf54e1864c77d6e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704981797, "uuid": "3540be48-34d0-419d-b736-8602a5a70d55", "comment": "Malware payload", "value": "6fa619ff483eab3654f819ee4e8ff6d1d7bf125f134173c227482cbde4418c15cfe040a104b3450e89dd220ddad8a141", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704981797, "uuid": "21040714-3637-4940-9bde-e155834625eb", "value": "T1B4C5AD96B758693FC877003309AA5632227BCD168B829787795C372C6C776EC0F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704981797, "uuid": "54ac643c-4b0d-4d11-b901-12739b7290ed", "value": "49152:lS0+VThicJQmEdrIhIpVeDRZgQsQsI6TBY7cEBgkazfrFL:lD+BeEhsVYXnsQp7cE4zfrFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704981797, "uuid": "b1dc01ee-872a-4294-ae7c-d37008ffa2d9", "value": 2580765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704981797, "uuid": "297ae10e-90f6-4243-9a5f-60521b1fd6d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704981797, "uuid": "2b9ef716-32e5-48d9-9066-d6d5275f8464", "value": "My_airtel_africa_apk_1386818018.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8482c6aa-b04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1704956606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956606, "uuid": "54a6e92d-4bc7-40d4-aecc-24b56568855d", "comment": "Malware payload (Sliver)", "value": "e462594d074cc5168eaf4b5b120c70ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956606, "uuid": "f1013c34-1d91-4062-bbb5-dd9780c55f51", "comment": "Malware payload (Sliver)", "value": "faa08b9df237134013697a74026442e00ee185b8c8025f37e87238ecf5e2dc27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956606, "uuid": "ab611603-065b-41ea-adf2-cd26d8398ae6", "comment": "Malware payload (Sliver)", "value": "b04c6d2610a5268dd31b6f1feb3a5bb1c2f12a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704956606, "uuid": "f3b554b3-ddf2-4984-a10f-c8a5054a8b16", "comment": "Malware payload (Sliver)", "value": "09364235716ca97e3ae80e249c55f036b2052e3ff339a3f4035653ad9a535e33e7660c455f8991265dca5892d8cc3e5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956606, "uuid": "84cd2b87-a027-45dd-bc47-a7b0f4965a0b", "value": "T135E6F794F8DB41B3C907983088A6212F1338B95D9729DED3D6403B56F8737F30A7666A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956606, "uuid": "6a26aef0-b2eb-4b31-acd8-4c221b5824d1", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956606, "uuid": "6d7f167e-bd04-43e3-baf1-d35f77325c89", "value": "98304:23g9V8+a5TTG2eJDwkOv2g6BhlOH7R6Q45bNvHpkAvHa3X15KZyQnmrVGYaY6EnF:2g/4IgwJO1qNvHpk53X15KZRag1E9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704956606, "uuid": "beb47191-e85f-4358-ac22-8ceeaa07febe", "value": 14860288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704956606, "uuid": "81edb6fe-e62f-4479-94a0-790c81a210a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704956606, "uuid": "f910aa6f-a2a1-463b-84ca-f45aa40af7dc", "value": "win32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08906a2-b026-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLog)", "timestamp": 1704939044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939044, "uuid": "06852140-5d02-4718-9573-6b029bca6a47", "comment": "Malware payload (PureLog)", "value": "09fcbec7377248a4176ea92a72d3bbe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939044, "uuid": "ee7d4fd5-44ab-40b4-a431-dcbf8c6b028d", "comment": "Malware payload (PureLog)", "value": "fabb2f61d079f431599bc61ab386291dbe3da947531024e25b1737b6e7084c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939044, "uuid": "2ca402f4-8d5e-458f-94eb-c45342789ef8", "comment": "Malware payload (PureLog)", "value": "e0a9e9d844cacb563c4ac3c9b03b924aa3969020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704939044, "uuid": "62db52cc-3e55-4240-9710-c108bcf407b9", "comment": "Malware payload (PureLog)", "value": "0cb682438defb22b7ee0ea4828e5f042fd10e9f822d06fd462ba8650991ce6569e82c68a384dd9ed0b5b5928d17ff21d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PureLog", "colour": "#C5B355", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939044, "uuid": "1b151567-f20b-4b57-a34a-f57447413f88", "value": "T14F253A54A798DFA7FA4F33B7F461251C57F0C23A5592AB8A2AC4F8E41C42320590D7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939044, "uuid": "f9255732-c03d-4683-ae05-2ef95c4ad723", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939044, "uuid": "769ff014-5799-4084-99e8-8c8ce3e08e81", "value": "24576:cClYXhWytPrpsPpH3W4KOfJWVBhB0qqo:QW2lsPp3wBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704939044, "uuid": "632a4498-a11b-4cfa-8384-cd93e36377b2", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704939044, "uuid": "c539bf23-653d-4137-9a2a-9c13d97ffab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704939044, "uuid": "7107d745-1a28-41a8-84c1-e70e434adc0d", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1afe4d-b031-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1704943811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943811, "uuid": "c11d118e-5821-42e3-b0ee-bef93238c7b1", "comment": "Malware payload (AsyncRAT)", "value": "9ce2ce853faebf582eb9059d1517a861", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943811, "uuid": "7f9c243c-7d3e-4383-8ad7-d0a7cb4d6ec4", "comment": "Malware payload (AsyncRAT)", "value": "fb0cedd17622c47554bc9fada82b2135838059aae5fa17ead92ab3fd222cfab5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943811, "uuid": "2df7ee7a-3a72-4fbe-8d25-b89c47b447bd", "comment": "Malware payload (AsyncRAT)", "value": "a0ecd9cb66dbb0894ac6f5c7f24129311a27a2da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704943811, "uuid": "e29fb631-be42-4f01-8b48-70ddbf093d46", "comment": "Malware payload (AsyncRAT)", "value": "6bb6f7e224cf8caf758c5e4c7cb30537166991a653149527a0aff8f88c32b0cdc834f936e73b162d0189957e40e37163", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943811, "uuid": "415b80a2-dae6-41dd-936a-bf94bcf5a26a", "value": "T18BA43F2839EA9019F173FF769ED475ABEA6FB7732B07A41D109103864712D81EDA203D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943811, "uuid": "ab4dc11a-8a71-41e2-afb9-f7286520bb3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943811, "uuid": "69b1177d-d634-480b-8b5c-170506727705", "value": "12288:ILi2FcpKLRjSMEMX/SdoWKrZbs/aJmzpxd9h:ILi2FcpKxkoGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704943811, "uuid": "dff0de3e-e61d-4ae1-9d6f-a9c7d2e7376e", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704943811, "uuid": "d7e65869-95e6-45b5-be3a-5fe688b0a292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704943811, "uuid": "5f4af6cd-81df-4f0e-ad45-6aef0384e371", "value": "9CE2CE853FAEBF582EB9059D1517A861.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f7bb2d-b055-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1704958996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704958996, "uuid": "25dea794-91c4-4f8f-8c14-c673fdcf7ade", "comment": "Malware payload (QuasarRAT)", "value": "25a6395154a076a0cde54e1e3b84c81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704958996, "uuid": "e844a6e9-e931-4d4e-9f47-3cc7a81baf2c", "comment": "Malware payload (QuasarRAT)", "value": "fc6db6c30bc8cd0320881e6d28dc66369b6498b158a000e741e8ce5133a880f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704958996, "uuid": "eeb7f0ec-3e68-4f7e-9aa8-324f2f1037f3", "comment": "Malware payload (QuasarRAT)", "value": "ce41e5f44953088f086d6c3f933e3a5299c5522b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704958996, "uuid": "d2146792-0932-4c8b-adf4-635dbcc481e2", "comment": "Malware payload (QuasarRAT)", "value": "f2b0a69047b2ff161b792b46f688d8ebc85b47261e818f48b6e8e182d082c66107ea4bdce951fe98ded9a465a8083360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704958996, "uuid": "078ff126-b942-4792-aae0-71146f958521", "value": "T160E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704958996, "uuid": "982b23de-91c3-4e86-8422-370ee80ce291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704958996, "uuid": "24a18f71-e50a-460d-a412-209a71568e52", "value": "49152:evkt62XlaSFNWPjljiFa2RoUYIH5RJ6ubR3LoGdaDtTHHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIH5RJ6oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704958996, "uuid": "448ccf0f-e593-4a20-9bd1-f4ea43d35f05", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704958996, "uuid": "2b01c595-726d-4712-99ff-e2a8a557ce75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704958996, "uuid": "d49fe215-f30a-4aa2-989b-1f546b5a44ef", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab06d32-b086-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1704980158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980158, "uuid": "b143558c-0059-4729-9399-f73969dd4c8b", "comment": "Malware payload (Formbook)", "value": "86f59231b4d4b92d9d41a16a142380fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980158, "uuid": "24c275a5-0fc6-467d-838d-4030d8f1e420", "comment": "Malware payload (Formbook)", "value": "fd032e026a2d0dc8f80370acf62e120c4a04fb1fd46318839f162f1949ad0edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980158, "uuid": "4c15b212-9635-4b41-aea8-4743ca1c02bb", "comment": "Malware payload (Formbook)", "value": "3bbadc59af1d5358c0565eadc51ce777d47a0dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704980158, "uuid": "ae8d3311-d35f-417b-90d5-a0fd4bbf8048", "comment": "Malware payload (Formbook)", "value": "061d5e3a64b6e652c0022b4ca3fb3bc8acd4654c69e6c01e9a7597b1efbf124635d552ebc905cd825917720c90476b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980158, "uuid": "bf98ef08-1ed8-4995-8d79-d02e87a0505c", "value": "T13815D23D5BBF1227CC67C6ABCBE8DC27B15194AB3C11EA6485C3439D5376A4225C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980158, "uuid": "b691cd9e-a7ea-4167-bc37-0a5b84987e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980158, "uuid": "bb9cb6ac-58c7-4de6-901e-13541fa8da6b", "value": "12288:gU6HguXUVUAfIOsgKwDV+nm5vc19ApsWSyO7rbdTrcL/SIIcM8zh:EgzQwB8mhMtV5g8z8zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704980158, "uuid": "b6c8919d-0bc3-4909-99ec-3008a194f6be", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704980158, "uuid": "8c133d01-f298-472d-b721-38614098a379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704980158, "uuid": "990df556-9efd-4f76-b105-a310ec31796a", "value": "fd032e026a2d0dc8f80370acf62e120c4a04fb1fd46318839f162f1949ad0edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa73f75-b029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1704940296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940296, "uuid": "63e4b98a-b7fd-44b1-b244-4ee695074ae9", "comment": "Malware payload (RedLineStealer)", "value": "4571c803f5ca89feeb635393f2ae569e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940296, "uuid": "fc986260-d889-458d-9712-8e47f4a1c2bc", "comment": "Malware payload (RedLineStealer)", "value": "fd49ef5bc25a401c934ff5b3c276741b41933e62e2e1fd3223e4ab8986ec60ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940296, "uuid": "128295c5-06d6-4a34-a140-16c1bdd5203e", "comment": "Malware payload (RedLineStealer)", "value": "e76400f436a1723bd1edd102e4dd9a6174e3fc22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1704940296, "uuid": "8f42037b-92d3-4927-9e8d-7921d7e01b6b", "comment": "Malware payload (RedLineStealer)", "value": "d3b59bf983923c3f0f76548342744d2da95e49c1ddc99989d5dab5435bcf950d01a23b267a6ed4432987aeab567afe2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940296, "uuid": "cc75499d-62e7-4583-85ef-f7d20a1d7530", "value": "T15034F103739B07B1C61142BA80EBA51807F1A39B5A33DBA53E5801D94ED6B979BC3FC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940296, "uuid": "13624c90-544c-4674-b592-aa846382f643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940296, "uuid": "6253663f-9485-4c43-bee0-8fefdb73b814", "value": "3072:RE3v0riELqZP1GDvKozIiQwWzpz/sheRXH1hYoCHSQP0LqKnGmaPIN3r:R6vFtGDvdzIrpzQiVzCH2LzaPI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1704940296, "uuid": "097200cf-5744-4619-9069-15c1f538c563", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1704940296, "uuid": "613810f8-a979-493d-8ad7-7fa23099970a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1704940296, "uuid": "f15d8443-0329-490a-a6dc-947f3a366833", "value": "4571c803f5ca89feeb635393f2ae569e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }