{ "Event": { "published": true, "date": "2024-03-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-18", "timestamp": 1710806581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b0030d3f-d60b-4d40-bfc6-65c912be7c6f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe5b363-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767870, "uuid": "080d1afd-5f47-4559-996f-158368ea3522", "comment": "Malware payload", "value": "b8fe4dc60457c853396e9d2ec3f22e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767870, "uuid": "7e7af5d2-9777-46db-9790-041ce430a5af", "comment": "Malware payload", "value": "006e6201e286d3040428a8eb89fc7238917b9af0c83804cf5658ecfda734d8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767870, "uuid": "dc96d647-80aa-4a94-b0f9-a54a4a8146c3", "comment": "Malware payload", "value": "7498fa82fed8229c3a7e3c618d55a16762d80bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767870, "uuid": "3b3c4aa8-541f-4aac-aaff-5f319b17f332", "comment": "Malware payload", "value": "ad837c71f5161a83ea5d72cdfda49b0e73064723fb4b0e011bfcff9c46085a11d474ad87d7b244dda2df92bcc44bcb4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767870, "uuid": "921d0ff1-9498-4f9b-9c4c-9a687d8228fc", "value": "T1CE55CE0273D1C032FFABA2739B6AF64556BC7D254123852F13982DB9BD701B1227E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767870, "uuid": "466f7ece-09e5-48de-a2e4-2455fdfdcb1b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767870, "uuid": "d3f16a42-7676-417c-9f24-be1a5077aaf0", "value": "24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaO+s1p88MY0EIZgpYQUN66aXr5:5h+ZkldoPK8YaOr+Y0EIZVQUN66a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767870, "uuid": "45c0178e-b7a1-4001-899f-7e4fbc6dcd58", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767870, "uuid": "462a6929-cfbb-4fc9-a734-a5ba31e6fa5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767870, "uuid": "68b0760c-a462-487a-bad5-01ccd7e434d2", "value": "Swift copy of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c717fc-e574-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1710799997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710799997, "uuid": "ec335310-8159-4639-840c-da17440556a0", "comment": "Malware payload (Stealc)", "value": "97e3b987724c4a6df897694167fb972c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710799997, "uuid": "075cebb0-be04-4714-a057-0c2a38fcd428", "comment": "Malware payload (Stealc)", "value": "009d58f95f59dc6d9755e988ce47420d1c2a239de89b5631df0303301c6eba68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710799997, "uuid": "0131d986-fa51-4ea9-849b-5aec428e70f7", "comment": "Malware payload (Stealc)", "value": "c18a81f956fa94725f7e012d3ab7a0c5f5981ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710799997, "uuid": "c12bd582-99cf-4716-bb09-c9aee444f2f7", "comment": "Malware payload (Stealc)", "value": "31c668500dfa8eb34749009431aa856d9aaf3dcca05fa4923b0dc157d84494768a8ec28c47ce76a4be9dc0817b28f967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710799997, "uuid": "341939d3-d0d9-4799-96bc-7dc5e2c3948c", "value": "T126A5230DB493AD76DD0201744C43E6FE5A30AE31DE688A47F1C06E6BFDB2EA69352741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710799997, "uuid": "ab4153a3-8acb-46db-a783-6ad95ac70e4e", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710799997, "uuid": "496e8dcd-70ad-4749-a3c0-10eeb2c859df", "value": "49152:LT0OJT1frbck6hKwwT/cAjNNp9j2tWmvaVpmr8:vJTdoZo5bpNVj2tWomm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710799997, "uuid": "ba4c0ad7-10a2-4022-b190-6f78d64be123", "value": 2177369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710799997, "uuid": "e4735570-22a5-4a69-bfe3-f955c51647fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710799997, "uuid": "b7737d68-a5dd-41da-9298-78900cdb1374", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075e1b60-e538-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710773929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773929, "uuid": "3750a869-e510-49cd-8223-c2db28cdf1c3", "comment": "Malware payload", "value": "cacacb40bb7c38b7deebb77f163bcbfe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fixing", "colour": "#DD5CF9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773929, "uuid": "f6ed0ba2-6350-4156-98b2-3e2bc7bebb49", "comment": "Malware payload", "value": "0109cbcb123786ca9fa77f130538c58b215071ba74ba8089565cdb08702b8efc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fixing", "colour": "#DD5CF9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773929, "uuid": "279357f3-3f60-4299-b4ab-0093acddb833", "comment": "Malware payload", "value": "880d9d5ec8fb67d6072092ddc55baf57f5f5ba40", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fixing", "colour": "#DD5CF9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773929, "uuid": "9d788649-bca1-4be6-be86-46a56538cc44", "comment": "Malware payload", "value": "d7506a8d9ceb8d47bee989e065045768f75fb508681747767733dde867fa596e575b2c41bea85e815217ca4e0a6234a0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "fixing", "colour": "#DD5CF9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773929, "uuid": "98a052a0-8714-4591-92e5-1007e8f8c96b", "value": "T1FFB6F187F75C9A2EC4775172CC6A5232E66E4F118A8397476808372C38775E88F79BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773929, "uuid": "95770980-193e-4ab1-85c0-d96810e40b12", "value": "196608:vfg0XZWNiWM7aIiWpLunYl6UJEXYDk7O7YaDmPnLWUkrMjL/BrvApDG6SC0eiw1H:RWpIiWpi2d2FFkmCbrM2pDG6Q0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773929, "uuid": "8842c9f1-7025-4b6c-a462-a7f494751e35", "value": 10506785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773929, "uuid": "541de47b-63c2-4a99-b136-dea40bad41d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773929, "uuid": "6a6bc577-384e-476d-9332-dd417f623aea", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b9e4d5-e513-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710758300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758300, "uuid": "bb3835da-d6cf-4a88-802e-4d71e5956f99", "comment": "Malware payload (Gafgyt)", "value": "922c032cd5d4ac50ba5085d51a4b3c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758300, "uuid": "bcbc97b9-9310-4ad4-b6cd-a1409b400f21", "comment": "Malware payload (Gafgyt)", "value": "014060d3af8bcf5f9d45b6c2c61937797e133b8c0c0b959af2d94e83effca896", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758300, "uuid": "de2a894c-4127-437a-a051-80938bad384a", "comment": "Malware payload (Gafgyt)", "value": "c8d63af6b94e3218c598820bf6edd12a3a301d20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758300, "uuid": "41f10cae-5340-4645-905f-98cc01c05f54", "comment": "Malware payload (Gafgyt)", "value": "1c0de2ad7e7fa4f7a834ea179c539beef4f5b54d8540fddfb3efdc51f2904ce2271e6a3d946280620d94ff0e56c830c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758300, "uuid": "a68f8e6f-09df-43d7-8616-bed0f2bdc678", "value": "T1F7932943771C0B83C59B6EF12DF727F1836AB9A117A76280A10EEFD45732AB02512F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758300, "uuid": "c6957418-6998-4462-a16c-77e4793d9748", "value": "1536:PQhMT44Qn7opBSg261Kzs1E3yxbMBRLors4rzmQqs9+qQUK4We:PS6pMC1lEWiRsrs4rzmQqs9+nUK4We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710758300, "uuid": "19b52be4-9f29-4dc5-b4a9-2abe0f3cf185", "value": 91829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710758300, "uuid": "58dae681-236e-40e1-9767-0e6496db7909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758300, "uuid": "1e13a069-f4e7-41bf-ba68-fd1da2a61467", "value": "922c032cd5d4ac50ba5085d51a4b3c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6183ad-e4d1-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710729916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729916, "uuid": "e2d9fb18-a208-4075-ace1-dc0190106c11", "comment": "Malware payload (RemcosRAT)", "value": "9a57df005b00ca4c9f0cd5f7a3d7e7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729916, "uuid": "ccc9d997-0c91-40e6-9c81-8432706f4ae5", "comment": "Malware payload (RemcosRAT)", "value": "0168646bfeec864982cff43a4969ad4d0ab5e0df69cd27f7334fcf339f752e4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729916, "uuid": "aec906c6-6a8a-4b1e-88f3-f33b80d74ec6", "comment": "Malware payload (RemcosRAT)", "value": "63547644d4b7fe80f696bc8aae6f09830df81b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729916, "uuid": "9f9183c0-a7f3-4715-b2eb-20cd3cf240df", "comment": "Malware payload (RemcosRAT)", "value": "6b7eb958752681b79ff90686336e8787bb4c1943729cd5f9d1291e6513fff496bd0550055afffe022c076b5d2ecfd3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729916, "uuid": "21b90d4b-a29b-4c14-84af-936ad74b7912", "value": "T19465E0F7A4A10477E23601349C4B74D4A425FE732E7435C62EAE7A4C9FB83913A69363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729916, "uuid": "81654e8d-6f52-4796-a173-00340d5a39c4", "value": "7a4c55e13d9df5dfa0e37b1c32bfa31f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729916, "uuid": "cb63e47e-1923-4854-93f2-60aba9b75867", "value": "24576:916ftUKJqekypS2EBJYewl7+6izHE+lsx4sAXsd1AqVjxW7RXtLgiED+enxbIl:9AfgQvslHE+l4wgmNdtECebIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710729916, "uuid": "72e4f472-e900-474b-b796-964f3e9fdd56", "value": 1463808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710729916, "uuid": "77535728-c7ec-4d3c-bb28-45aedbdc9fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729916, "uuid": "0e34221f-6185-4179-bec6-480cce69194a", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e65441d-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745648, "uuid": "844f5aaa-2b62-4eda-aa9e-02e0171ab85f", "comment": "Malware payload (AgentTesla)", "value": "008ec1154d67b3b770435feef8fdc290", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745648, "uuid": "a6c63218-c3c0-48f5-833c-856f23d0a2b4", "comment": "Malware payload (AgentTesla)", "value": "0199b8e1bd516e1a3951a3aaa87ad4d73f9a31df911b6bcb6d74a6f78a733a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745648, "uuid": "ed1b0f18-2ad4-4e30-97c0-ca536fab43f8", "comment": "Malware payload (AgentTesla)", "value": "282f45725a6d4cbee4f73a229a3663fba5387706", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745648, "uuid": "38701e66-1292-4eaf-8045-ee3d81e27327", "comment": "Malware payload (AgentTesla)", "value": "93e3c87bbd61dc00a84e9719b8668c122a6973050b3c8cf4d5febb2e00d9cb87179a47e598b7b10b3ffa3c424cc1071d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745648, "uuid": "8b232c05-a198-4901-84bb-a4be991aa9ac", "value": "T1F0F4F19D766072DFC85BC936DEA86D60EA2161B7430BE243A05312EDAE0D647CF250F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745648, "uuid": "62423ae0-65bd-4b27-b39a-5eb25d13af6c", "value": "12288:zQBFztgfHZRS1QJggqOD8UVSU/C8i4L8OxPfdmi/3BntBmD1ERzJnkyNocOL+kzX:zQBj6012gHOzzLbxPfdmC9SWXnky+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745648, "uuid": "36415bf6-975e-4033-8905-82d1a17a6ce2", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745648, "uuid": "0e1c49b1-3030-4fc4-b9d1-c5c5aeb62b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745648, "uuid": "a6ed205d-3ea4-4b89-ae46-691d48704642", "value": "Order Confirmation 00417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ca30d3-e550-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710784334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784334, "uuid": "62a0427b-b16a-4a4e-87be-dd31b311167b", "comment": "Malware payload", "value": "bd824d170b9422375b3c9931f746f1f2", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784334, "uuid": "d1bf9e85-2a0c-4131-ba1c-76702b33a606", "comment": "Malware payload", "value": "01b09cb97a58ea0f9bf2b98b38b83f0cfc9f97f39f7bfd73a990c9b00bcdb66c", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784334, "uuid": "4156e930-6d64-4948-9d34-afbc91bb4493", "comment": "Malware payload", "value": "5eb6c7b72120fbdacc41c4abcf676af7b58daf69", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784334, "uuid": "695153e7-1a2c-445d-9796-0b908a7b6b67", "comment": "Malware payload", "value": "2784dd02b7cd8745a8e9d72db9311236d3dd1f82296a237dcb7b970dfe2cba590540b9181b21f8e8a223c2ac1afb7581", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784334, "uuid": "2ca9c27c-fda6-49c1-8788-ad0392e90172", "value": "T128946A19F76844B5E0679178C9B3CA06E2B1389E0B7097EF53A8475A2F33BE5493D720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784334, "uuid": "c795c24d-4139-4026-ad71-036226c31dfb", "value": "21746d7f612d7fc519490a664cdf2009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784334, "uuid": "e5a9155f-3165-43fb-8781-38fee6256ec5", "value": "6144:M5NZecEJgw+OCfl5a+jLQI9JdTb1TL/nKeeV0v4+sC4G7Xx4uTBUjjOfIB3dSo2:8Z3agcCjNY8LC0v4+sC34uTmjjNSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710784334, "uuid": "0142111a-4a8c-4f05-814c-6dfd63ae244f", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710784334, "uuid": "0e905c07-f953-47ad-b50a-532e9a888537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784334, "uuid": "af411425-4a51-47ed-83ee-413521157001", "value": "2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb78e22-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767875, "uuid": "c285e4e8-b86e-4ee4-ac20-f563d5a4eaa3", "comment": "Malware payload", "value": "10cb76ed9f076bf77bc847ebb44bd4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767875, "uuid": "0d002d36-b531-4a51-bade-eef981152fd6", "comment": "Malware payload", "value": "02dbaf98cd7038a450c9fda609b729738aa039766668a92015737fe96aed1a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767875, "uuid": "1a0d5839-1b7a-49f7-962e-e33db3c3b36e", "comment": "Malware payload", "value": "00e80300145de688c5541c7d699ae19b23b11d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767875, "uuid": "ecc14a22-c9d3-4f1c-85d2-7c9f552b2eca", "comment": "Malware payload", "value": "08ac5004555f1ecbb59ccc8bcc920c7f1e36a15775cae26968468fdd4113e79469f03ad0f9e8b69c0b06669b8cd032bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767875, "uuid": "1244e97c-18a7-408f-a490-781e35f6d780", "value": "T17A458C05AFAD8435FF9693734A19F50A66787C1257F384EF2388392A6B743F0523D226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767875, "uuid": "cf47671a-adf8-4911-b366-4130760005e8", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767875, "uuid": "dc97845d-ca0c-4331-ae33-7d1e483edd21", "value": "24576:+AHnh+eWsN3skA4RV1Hom2KXcmtc0a9i3sJ:ph+ZkldoPKsac0a9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767875, "uuid": "e752d4be-95a8-4789-ac40-6a562eea4a6a", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767875, "uuid": "eb175fd7-ecd6-4441-9b57-6dd983ca0ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767875, "uuid": "95b8b019-9870-4a08-9a1e-1ab1e4e14c65", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51325175-e515-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710759021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759021, "uuid": "4d02113b-6270-406f-afbf-8f02d8b8d9e8", "comment": "Malware payload (Formbook)", "value": "21254d4ade3043b3ac0deaeb6a87f468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759021, "uuid": "6e6832b6-a198-4759-9206-a8fa8521cbbd", "comment": "Malware payload (Formbook)", "value": "04babb9fbfb5fac1664cf1b46f9e4ade586c3502da5227da4feba4b1d3c6b6c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759021, "uuid": "04187d3b-6fd0-4049-abea-4e5109bc57bf", "comment": "Malware payload (Formbook)", "value": "f415a9812bc4ba2438e092f4c1302e0ddd1a7fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759021, "uuid": "bf89d94d-f9e5-40b2-b2b4-1f909a0aa66c", "comment": "Malware payload (Formbook)", "value": "eef53e653fbc64a69660d60e561f5011c8b048a25660cf0202d8126679f3b26bab5d21b60b22c7bdcd98975fb7d91444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759021, "uuid": "588eb6d4-6fad-4eee-9e67-bd9640d2154f", "value": "T1E945AE027781C062FF9B95335F9AE23147BC6D660127A51F03983D7ABAB01B1167E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759021, "uuid": "7d1ce9ed-3c7f-4a25-8b35-ee7c81809495", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759021, "uuid": "68419ff5-a6cf-47f2-8d1c-f674ec79f224", "value": "24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8azByaDZMgaL/igBR:LTvC/MTQYxsWR7azBDFe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710759021, "uuid": "005fa3a3-4c26-473e-8e88-ddbc321c0942", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710759021, "uuid": "f49dda29-28e8-467d-be7d-cc1a08bb20d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759021, "uuid": "804d0260-9d98-4f2f-a4b8-38f17952f04b", "value": "04babb9fbfb5fac1664cf1b46f9e4ade586c3502da5227da4feba4b1d3c6b6c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b029f504-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751879, "uuid": "7ad02606-060b-4b28-b3aa-c69cde8ddd25", "comment": "Malware payload (Mirai)", "value": "dc4039f98f3015499414e2ce082d29ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751879, "uuid": "0e30dc66-5d3d-460c-9166-b7e89a58a3c4", "comment": "Malware payload (Mirai)", "value": "04f1b9ee7a6a132ea6d19f669906c3a21863ab43c741a754a9b9c862a7994091", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751879, "uuid": "5fcac5b2-f903-4765-831e-be170abfe131", "comment": "Malware payload (Mirai)", "value": "f9c2a902574cdc595664cdfc881ebcd02fb6c3c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751879, "uuid": "387e8af6-9e75-4e7b-aef0-f008989b24f5", "comment": "Malware payload (Mirai)", "value": "78c7afe0357bd2d0764bdd2fe144bba356be1fac4e93fdcb1db70e3cd6620e6b1f3e6dbb1da4b7ff16cd53461025e8a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751879, "uuid": "7e309863-6e31-4201-bbd8-e04817c75916", "value": "T169534A217A792E17C4E4A07E25B38314B6E5678E32B8C65D7C723F4EFF1066064171B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751879, "uuid": "d2eb91fb-8878-4395-918e-e6d7eafac2c8", "value": "1536:IDK6bb9lTEFq1X6JySbe7METbrv0kvbpdYm+A:mKQ27be7METc03N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751879, "uuid": "a39d2d18-c033-44c7-b644-3513dab4bd67", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751879, "uuid": "63c37263-c9b8-4c15-94e8-20e9673db9fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751879, "uuid": "54e91b0f-fe6f-4671-b2f9-dcfffbff0788", "value": "dc4039f98f3015499414e2ce082d29ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1b0545-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710749027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749027, "uuid": "bb1c74f6-70d8-45b9-b329-8673f108d981", "comment": "Malware payload (AgentTesla)", "value": "0bad15184fab095c3c2969b1bb88a0ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749027, "uuid": "edd7b027-20c7-46a7-b1ff-2ec460d9ae7b", "comment": "Malware payload (AgentTesla)", "value": "05ab73be8a170396164d6e3166e195c8688d384a3da3b29cd7efd6a4a161286a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749027, "uuid": "82fa9f28-1d8a-454b-ae64-84a27d6fd379", "comment": "Malware payload (AgentTesla)", "value": "e7e7ee3dc9d120f1c21c6e237efef4d66f314dec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749027, "uuid": "a8d37173-ccc0-42bc-adf1-0b597a6987b2", "comment": "Malware payload (AgentTesla)", "value": "aaddff1c80b239359b9982fbbb927f7f9addb466bfc2f4f61250b329ee99904983fa8c9abc22b7d0beff2d4bb27b20c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749027, "uuid": "d3205ff7-5bd7-4354-afc8-c68580b2213f", "value": "T1D14423C6EF0C9F4261A5B0652949807DCD638F7DEF6E48A0D917EE93A2C2B1D1133692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749027, "uuid": "eb7c5691-d8e5-47b5-b90a-5dffca4609dd", "value": "6144:Iy7xGqQMMNIP3NxV58JNm8T3goyxb4pB67cc199X9Y:IsPiGdxMT3PCb4K7ccb9X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749027, "uuid": "aa15ba5f-fefd-47bf-a6ee-ae935a8caa18", "value": 260645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749027, "uuid": "5dc7a2b5-84fc-4ecf-b808-fa05995860e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749027, "uuid": "c6f32f0c-945c-483d-a1d6-48b1ee8adbb3", "value": "PO20240314.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f956add6-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752431, "uuid": "1dd79455-7e94-4efc-9c55-d4c2584a8744", "comment": "Malware payload (Mirai)", "value": "e6909a7e31e4d45a78d69fa3b7aaf0f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752431, "uuid": "4a041f4b-efda-43b0-b48d-0f08ad3afaed", "comment": "Malware payload (Mirai)", "value": "06840e970796c764f58531ef329946c4ed2913d75cac6f3abc29a6f5d5f4a3b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752431, "uuid": "537ab0ac-221f-49cc-9724-a8b365a27007", "comment": "Malware payload (Mirai)", "value": "61dafbb76b32a8b545165a7a06dc9c9774b4d05b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752431, "uuid": "378424a4-b0be-40db-ab08-5219d6dbef32", "comment": "Malware payload (Mirai)", "value": "b1566341df7d49c04344c928e013abdd528fb9c17d8597d76ad9df41f917a62380913c363f2312810cf62b37ab0ac57a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752431, "uuid": "5a12ad3c-0880-427e-834d-b9c8604effaf", "value": "T1C9234BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752431, "uuid": "e69690a8-d948-4599-ba29-3a5faa798d7b", "value": "768:c8/MjSNW4GBs82WELXamRfWzqNYeZj91FEwaK3g+ZdG:c8/MjSNW4GBz3ELFdNYer1RaK3hZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752431, "uuid": "ca393533-b82d-45d4-a4ce-c6102165846c", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752431, "uuid": "cf853c7d-107d-4619-8211-61c541995d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752431, "uuid": "e5eaaf5b-1991-4a34-a2ae-f245312e87ae", "value": "e6909a7e31e4d45a78d69fa3b7aaf0f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1a08d3-e526-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710766373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766373, "uuid": "ec4a2dee-beea-4a17-a4cf-ed4386c26062", "comment": "Malware payload (Mirai)", "value": "8492db867571747884f9958a3594fa47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766373, "uuid": "15a7eb5c-4567-4ef3-af4b-d4d775801604", "comment": "Malware payload (Mirai)", "value": "06e80cbb1e8313330ed3a2fa7f4067a26268e3d1389bc18ec928e97f533455f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766373, "uuid": "25172c0d-8ad0-442e-8ac7-3125ea3f39f2", "comment": "Malware payload (Mirai)", "value": "2261f18012fa9aeb9e99d0ecf461abc6c04bbc9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766373, "uuid": "8c1be891-db34-42b1-80b1-16b349cddb70", "comment": "Malware payload (Mirai)", "value": "5452407172f46fe137310979ba21c9b3de235cd068df502308f144b5a3cd8d4ea35374b8b8efa7824485891dcd6bbae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766373, "uuid": "abc6fdf5-ce0f-44ee-ae43-b2bd613b49b0", "value": "T185331984B9C1AA16C6D553BBFE0E42CE3726639CF3DE3203DD252F5127CA92B096B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766373, "uuid": "9422d2ab-921c-46cd-abb5-748e241792cd", "value": "768:7FQd95D+spWdNS6KldmhH1KTlIuQqk0Q3wUSt+p3sB3Tlcs2XhbBw504NJI:RQDMdcMhH1L5aUA+pcBDloXhdZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766373, "uuid": "14486df6-0029-4226-8153-edbbe999991c", "value": 50508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766373, "uuid": "8bcdc588-c629-4edf-b44e-c6b9f732589c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766373, "uuid": "f274651f-91be-4fde-87fe-5cafb393df0b", "value": "8492db867571747884f9958a3594fa47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9c852a-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710767841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767841, "uuid": "5f98f8a1-db46-47ee-a9f6-c06a02957e24", "comment": "Malware payload (RedLineStealer)", "value": "3ca1479d77a23d47a2f01e8ef30a6365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767841, "uuid": "dfb3d2f1-4def-49cf-9acb-88e9e22b70f8", "comment": "Malware payload (RedLineStealer)", "value": "074170a0febc20013e9c8cade256a031be328cefc2838f8f6ed394b4caf05b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767841, "uuid": "05b1abd0-739c-4e43-9039-538e7ec90003", "comment": "Malware payload (RedLineStealer)", "value": "3850b7445cbf81387f910ebe710d0dbdad33a91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767841, "uuid": "0bcdfc04-f948-4df4-bcdc-80c0b19de3fc", "comment": "Malware payload (RedLineStealer)", "value": "c651f3a4067746edbd01cb78a93cb3cc2ba81118ec6199fdffb4174565ddf05962fe3e6f6fa773bb693cc8abd9da3294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767841, "uuid": "70b3d596-2865-48fb-9d84-6a38b58dab98", "value": "T18D459E0E6391B027FE96BD735B65B305467C692401E38C1F1AB42F6C68723F31A2D66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767841, "uuid": "dde231b5-18ee-49a0-9498-ee0959a8c12b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767841, "uuid": "11b7b85b-b8be-4599-a72c-5a494ecf22ff", "value": "24576:WAHnh+eWsN3skA4RV1Hom2KXMmHa+rttp28yuTdWJdV5:xh+ZkldoPK8YaIHQ8yKdCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767841, "uuid": "8aaa94a3-b242-4ee9-b9ec-20d7b88f1c53", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767841, "uuid": "da6ae25a-e30d-4c70-b21d-ca3185063671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767841, "uuid": "9cec95fa-1605-4e88-8680-633d1fda5596", "value": "ekstre_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9c4ee7-e515-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710759067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759067, "uuid": "53f4a3cb-6ace-4a86-ba55-4ebee3d7174f", "comment": "Malware payload (AgentTesla)", "value": "7fb3a87678f326d2e0321a01f05b6312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759067, "uuid": "9a32b509-b17c-4f54-9473-f56113ddd73f", "comment": "Malware payload (AgentTesla)", "value": "076f3ef16618cefe16ef0d98d8369fbfcd5276ce35bf37a97c9fc95176849534", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759067, "uuid": "23d2869f-a3f3-45ee-bbcf-7be20e88edd6", "comment": "Malware payload (AgentTesla)", "value": "6e47b260d5ad288b51f91ca7714baee33d4e7aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710759067, "uuid": "bb92deb9-b3ad-47be-bf9a-83154f4822bd", "comment": "Malware payload (AgentTesla)", "value": "225911388ab39f2070bf6b4dba751d192752c32ca1f66fb8d64b9ce69e6b3afbe97ba1efdaf43d3bc36d8f402cae7278", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759067, "uuid": "eb29d889-0b93-41ba-8b5a-3d7461ad2f4a", "value": "T1BA35AE0273859062FF9B91334B56F63146BC692601A3A6DF13982B79FA701F1163F7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759067, "uuid": "6c8179ba-1608-4d42-a6eb-4a305f873895", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759067, "uuid": "65d42dc8-6190-4c0e-b3ab-22b4bcbe5b94", "value": "24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aJGb8RtBH2da:CTvC/MTQYxsWR7aJGb8RDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710759067, "uuid": "504d0a3d-749a-49ad-8f69-f811d1df6db7", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710759067, "uuid": "b7eb3230-e189-489f-9e52-e919f3194a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710759067, "uuid": "30850bae-3520-4063-b0bd-297f9f2ce928", "value": "076f3ef16618cefe16ef0d98d8369fbfcd5276ce35bf37a97c9fc95176849534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08a49cd-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757463, "uuid": "2f162054-b37d-4442-a3b6-9bd26e8ae8b5", "comment": "Malware payload (Gafgyt)", "value": "05819b6fb40955d8228c949eaed1e4cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757463, "uuid": "dcfc4010-8e46-4e0b-ba52-a80b6e0842ad", "comment": "Malware payload (Gafgyt)", "value": "0791970ed5e80bcc8867a82336c6e8b85c8c4031c63162245118ff8d0b6d451c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757463, "uuid": "7cf1dd54-e94e-4d68-939c-c3a117d6bdd9", "comment": "Malware payload (Gafgyt)", "value": "e73883c20d0d46778ef23f6dd06c6a6884fc15f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757463, "uuid": "e967dd51-2328-46b3-b349-7d1f174f3bd3", "comment": "Malware payload (Gafgyt)", "value": "a5c67ef5bfd85185054867505724ea43907327f278c4286e88a6281ac13c65d1d2c9a641da60b77876c80b0a9223f5b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757463, "uuid": "031f6b66-5cfe-4d2b-83f5-fcd3119a543b", "value": "T1F7A31A41F9408B27C2D327BBF79F439D37366A5497D733116A247EB42BC27982E29620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757463, "uuid": "ca8d1f14-b283-4476-953e-4f78fafd0441", "value": "3072:Ds2prtXl7gECRpVB1xWRfmRfmCayQzW0Mygxe:BprtXlc5VPxWUfmCayQzW0Mygxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757463, "uuid": "e493315f-05aa-4f6f-af9c-49d4a78dac31", "value": 106347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757463, "uuid": "78f8d900-eca1-43f3-ace0-17d088e95367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757463, "uuid": "1ed54349-8d84-41c5-9fbe-f7a38a19419a", "value": "05819b6fb40955d8228c949eaed1e4cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801cdb7e-e522-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710764683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764683, "uuid": "7d522e66-06b0-4902-a309-14890272b530", "comment": "Malware payload", "value": "66972fbc66b0466f180752c6713c5cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764683, "uuid": "f3fedb28-7e30-4f04-a701-7e8e4604b2ca", "comment": "Malware payload", "value": "0830bb406ed621cfc95d0092b8512685be88b7653fd92fc2aa980a64673ed82e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764683, "uuid": "e6c4adb0-a7d6-4279-80d1-aee6b6b762d4", "comment": "Malware payload", "value": "ef9f9472c683bbeb73336eedc435de49e48b0f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764683, "uuid": "731beef3-f64c-407c-b6b9-0df4b341f009", "comment": "Malware payload", "value": "9774412b33ea3d178cbecb18efb9e0c9842b9626a354acc4f719b2a9d600bfc6803cb58e4eb5edfb5957bf91aa14fad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764683, "uuid": "82bf7a75-92ae-4d72-8f87-80a1dbb69c69", "value": "T1BC749EE46277EA2AEBCC037C70565A0197BD468AEEE3F70984155DE08C02791DA139FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764683, "uuid": "6ca0c817-a10e-4066-86a2-eae7012f4ed4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764683, "uuid": "694aa2fb-63c1-4d58-a4ab-6dcab6508157", "value": "6144:jhxgnQrEyBNjNb8VZ3dAaYCVAARuVLmpuC7yAWFuu2+eov:jTgyEy3JcZ3+bCOUu2F7/WBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710764683, "uuid": "d46659e5-c516-4b06-932a-e1afa3aadf7c", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710764683, "uuid": "62950984-a2dd-4377-83d4-b83bb5afa3e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764683, "uuid": "bd668431-a972-46bd-8f66-c50a77da9d5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db883501-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751952, "uuid": "251e133e-9efe-448d-a20f-457fbd2a4765", "comment": "Malware payload (Mirai)", "value": "8aa0a4d3e81e297b6a75bf807b406b43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751952, "uuid": "073242b9-a98b-4c2a-afd1-1f5855face0d", "comment": "Malware payload (Mirai)", "value": "0b14e84980a0a69794df89661d5ba6c560b53d0f8fb94e9e2a46a65eefe959eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751952, "uuid": "9022d33d-52ae-4055-af13-d62b4911c17d", "comment": "Malware payload (Mirai)", "value": "35798f58224a3bc1ac417ceb33c46d7beda52323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751952, "uuid": "2da69bf5-faa5-43fb-a295-60751a3dcc3d", "comment": "Malware payload (Mirai)", "value": "2aed15181f5f2a126b5d758f2da7f4c18c49ac83c5813f274bdcbb74488cdac9e2ac2bd21b5847ba76d27c9930e216ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751952, "uuid": "3b1294ea-1063-415c-9641-634f610f3323", "value": "T163330885B8C19A17C5D413BBFA2E41CD332563B8E2DF32039D256F14778A82F0EA7695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751952, "uuid": "2a2daccf-7ff6-4261-a355-9947eac7d874", "value": "1536:YqWvCEvs5Fx1nzgapdoTcawt5fMBA0z/:YqWvCE8d/RnbfMBA0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751952, "uuid": "fb51be25-9407-4fce-a78d-947e7d2ac078", "value": 52912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751952, "uuid": "d987181c-9aa9-4e5b-9ec6-4d2426f230a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751952, "uuid": "0c9022e7-1014-42f9-b2ea-36fe4baa54ab", "value": "8aa0a4d3e81e297b6a75bf807b406b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d825328e-e503-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710751516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751516, "uuid": "32d4fa01-4368-4c74-8132-69b82cfea680", "comment": "Malware payload (AgentTesla)", "value": "da17a1860df26595c181659b58e09427", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751516, "uuid": "89c01fac-4846-49c7-ad17-ad4d33abe5c4", "comment": "Malware payload (AgentTesla)", "value": "0bd77d683a92cf70603a00ce8e049cb43e390d4c25c2ba9dbaef4946a56ffaa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751516, "uuid": "017def23-ce7b-49ab-b367-b9c80e5d9bc8", "comment": "Malware payload (AgentTesla)", "value": "2750d2145982c78483f88e20377e8514dd1df04d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751516, "uuid": "d7cc4c31-5e56-4d4e-a6f2-072798d03282", "comment": "Malware payload (AgentTesla)", "value": "651875969a53c74f445d0d9b21bcded34209780fafc69f56a449447210bf92a97cfafb3cb2291854c99214f5427bd523", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751516, "uuid": "d74bf2ae-4a56-444f-98a8-3046cea5ab41", "value": "T166D423CA3B0C8697CE7A073272E509138F795315B069E3F53089E18519E33A497AEF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751516, "uuid": "9196a8c1-2be0-4e50-b750-df19537aab3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751516, "uuid": "40cd9ff9-0c43-4193-a861-6d08099b5919", "value": "12288:YgRhH7vlKJakffGFtAkLEVIBr98shEbbKmQZO/n7PwYck3EdlUGzvStkR:f3vlKaboV+pFEvKmQqnkk3EdqGjSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751516, "uuid": "4aa7620a-74d5-47bf-8779-49b474af14a1", "value": 650248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751516, "uuid": "63ef3774-d8cd-4fc1-801c-7a4dbebca6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751516, "uuid": "48fa59b4-9886-43f0-a9ef-5c6841029a82", "value": "PO m\u1edbi_#28809466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8998f8a2-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765988, "uuid": "da34bbc8-275b-4b39-8cfb-22d023e866c3", "comment": "Malware payload (Mirai)", "value": "86829b6f395e730e1e0d1bf220f94b26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765988, "uuid": "019ce90c-01f0-40c0-a0ac-0856eda6a3cd", "comment": "Malware payload (Mirai)", "value": "0c52f0d1c2deba6db7128748656af82df89a76aee965e10ed660a8d3c8ba1a67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765988, "uuid": "819ffd87-8e1e-462c-988b-9eecde50bc56", "comment": "Malware payload (Mirai)", "value": "45271f679813a7002bfb0cbb27f6cc481f3de4d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765988, "uuid": "fd85c995-3200-4266-84e5-224fa8691f91", "comment": "Malware payload (Mirai)", "value": "3b384ad51da3b1e13ba8f4f84a51f83c4efe957c0dda3c4ccdac3f5e0c2cae5c4e126d7a57afcee981be3a9b0f47505c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765988, "uuid": "e8f84b16-bb7f-4921-8eb0-c11c2d78c99c", "value": "T13253A65A2A218FEDF36C873447B38E22975833C627E1C6C4D55CD9001EB438DA46FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765988, "uuid": "a01313a6-f492-47f7-8152-884e964fd143", "value": "768:95WtY03QmMSkhSC8WIx6r2MxuMyicYBNw3MY2TNzFqth6rLpVFQOKtyxyR/gkEy6:952TQ7/8VAL7MydMth6rV7ax4iF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765988, "uuid": "c2d36896-c84d-4622-b9fe-9bb51fad87e6", "value": 64852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765988, "uuid": "d9542da9-e28a-4b16-b369-b97600991151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765988, "uuid": "4a61db29-d154-4fef-8c69-de7264f92fd3", "value": "86829b6f395e730e1e0d1bf220f94b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb801de2-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751978, "uuid": "44545a0f-62cc-45e4-9695-6996def7a686", "comment": "Malware payload (Mirai)", "value": "5862526c6d41d70e240c0e6f95e98bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751978, "uuid": "3ea27f83-f41d-4377-9de8-faae95b09696", "comment": "Malware payload (Mirai)", "value": "0c618ed4e7eff84bf6ffb2454901d6fb1c62abd295c4cf996bf89bb9bf365f4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751978, "uuid": "4be10f39-00c3-4150-9008-6754eb2c39b8", "comment": "Malware payload (Mirai)", "value": "0a20f65656c22f6146705e4d4da4eeded841e3d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751978, "uuid": "20cce625-df69-49f6-bd0f-face32ac7ce8", "comment": "Malware payload (Mirai)", "value": "0a0ed96d2e1c014ff0f37e38eb0e15d25f4acfaf4c0975f570f3fd684ad3d67d87da0a1723d90ca20a9265a00697d382", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751978, "uuid": "e902f41a-e201-4f27-b69e-948d6f135b99", "value": "T154335C0272280947E4675EB0753F1BE093BFE99021F4F688684FDB5A8276E371586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751978, "uuid": "42bda967-07e7-4e4f-bc43-2ab4e47efb3c", "value": "768:snhCrA2xSRBXT5WJtrgjZbGMN43AitBl5LK+0Wmvf:sQrPgJWHCZbbe3Rr5LK+XmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751978, "uuid": "b2aad3cc-ea72-44b8-9f0f-0d216314fa60", "value": 51040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751978, "uuid": "0d73c341-588d-466c-8b82-2bf4fff40df0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751978, "uuid": "51eef787-d8a2-46c0-a571-045f3905d561", "value": "5862526c6d41d70e240c0e6f95e98bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccb44fa-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741673, "uuid": "cd9d112a-626a-40f2-a4ff-6e835aac698f", "comment": "Malware payload (Gafgyt)", "value": "e145ccc26115e3bfb0b602c54a089266", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741673, "uuid": "d9b49b88-90dd-485b-9770-7e332f63a299", "comment": "Malware payload (Gafgyt)", "value": "0c67ba386a1c7086de2bdfe3d4af8e5d7bf76a9e123e990d05601c8c737b71f6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741673, "uuid": "c4cfa126-1f37-436b-9d48-32d584d9bc80", "comment": "Malware payload (Gafgyt)", "value": "6d7b4ec9d8f5bf5c998b503b623371aa20c14a53", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741673, "uuid": "28228293-9088-4f07-914a-943c61de2265", "comment": "Malware payload (Gafgyt)", "value": "9dfc0cdee8f8bf2b48cb2b8be200a5ad99029bb9ad424cb49fb64e6996c376f03dae1e420a12129c7917582de6427139", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741673, "uuid": "093a109f-53fe-4dba-9a1f-ced3a74c9de9", "value": "T10A934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741673, "uuid": "758e0b27-59d8-4638-bf62-e537ef674ad7", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v37phauH/VPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGd7phaE/XVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741673, "uuid": "ebc6568d-6024-481a-8087-e57ee02ea98d", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741673, "uuid": "ad9a1b5b-8a13-4a1b-8b24-acf6a6e7faf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741673, "uuid": "71044e3f-3af7-44c9-bd2e-6df1b30b4461", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f7b61-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757876, "uuid": "be73ca30-05df-4ac8-b444-a9269091a221", "comment": "Malware payload (Mirai)", "value": "037b1c96b3e49a077d720400a954737b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757876, "uuid": "f9a60250-ea54-4744-8e82-1b8d55beba72", "comment": "Malware payload (Mirai)", "value": "0ccc13eaa7ba6f0155e1bba5dcef8db276c7dcd83718f1b153973357eda36bf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757876, "uuid": "b6315b04-7f80-4abc-8a8f-135a51bab730", "comment": "Malware payload (Mirai)", "value": "6ed65dabfad2f1f40d0654e07d760848c7b9fc50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757876, "uuid": "27d93554-b6e2-49f5-8287-a52b5c4b1fbf", "comment": "Malware payload (Mirai)", "value": "d1c331faa930160ad1e513fa02e87c0c9136ba3731ce753bda7491f444244d5695cb0d8e8b133098d1c9360622f46b8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757876, "uuid": "3404e0b3-bf6a-4268-80c7-c6d1c5d7f9a4", "value": "T1CE431C682A41F77CF3A610BCF02312E655B22F1C2F9DA6F39083793AEF6454452B9D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757876, "uuid": "88d6178a-cea7-45de-96ff-66ccee0bc6da", "value": "1536:r5v04sKz8rnNu35cRiSkgAUhlZWPLsqv5:tv04sKz8LY3cAUjZWPLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757876, "uuid": "78208e30-b103-4954-ae86-a1bacb99619d", "value": 58832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757876, "uuid": "dd566fe8-8221-4f57-ad87-f30aceb2308a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757876, "uuid": "172adeab-9206-4e80-aee6-7037d2e39fe1", "value": "037b1c96b3e49a077d720400a954737b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e96665c-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710763875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763875, "uuid": "83fc47fd-2b5a-45fa-89d6-090fc653f46f", "comment": "Malware payload (RemcosRAT)", "value": "a1cc10092e7a19859fb5bcc32101578b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763875, "uuid": "7581d1a3-4cca-4acd-9c9c-0d44624ca77e", "comment": "Malware payload (RemcosRAT)", "value": "0daec5d74297591bda4fb4aedd1c91643b7cd4312d65e5eb664d2328f0cd5c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763875, "uuid": "71e8b32d-02e3-4ae4-b6f6-645d52138426", "comment": "Malware payload (RemcosRAT)", "value": "ddd0c1097cb8b4a24699c88adf23ac020121fc16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763875, "uuid": "24008d65-65bd-4edc-9cef-8757e75652b9", "comment": "Malware payload (RemcosRAT)", "value": "3321bffca77c5b765295629c69b00a6714ebf019f29426c19a5398c0559d8d955ddcdd63d36fb3182ea3f8efc1430c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763875, "uuid": "afda389f-d50b-43a4-9291-7402b37840a4", "value": "T193D4234931E31246D110CFB0BD655DBFE2B5EA5506778B2E1B050EB8ABF3A0B4E46273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763875, "uuid": "590bdf1d-44fd-4b88-822b-def472206221", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763875, "uuid": "794a7784-2b28-4382-aa6c-2475014207d0", "value": "12288:7R2/D6NgsWNlQp1TFqblyEocs8vMylZrwnwXifiKPt4r:Y/mWNlQp1cpyEocZMyDzXiaKl4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763875, "uuid": "38ba30c2-a160-4897-b7d6-eaddefd429c9", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763875, "uuid": "da03816b-1342-4044-b19b-9da22a959f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763875, "uuid": "b6330f2a-755e-47b2-bdeb-94fe33a6aa51", "value": "Import_Declaration_3155066471_1235623E21045M.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b64449-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710761872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761872, "uuid": "6e749432-6fda-436a-8b56-db4a522bc935", "comment": "Malware payload (Mirai)", "value": "b7edf819b72c95689ea9d49c79b2b50f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761872, "uuid": "233b84e1-3308-4c8d-896f-31f1351f74b6", "comment": "Malware payload (Mirai)", "value": "0de1d7adde7c9b0b58d2ffb47f9e324c6fdddb62c93456a80aaf0e00432f47d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761872, "uuid": "d49f5a19-30f8-4e43-8308-2e4897dc8692", "comment": "Malware payload (Mirai)", "value": "8455b9b85cf33c015cd052ac17cb4d4dd186bfb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761872, "uuid": "add29f6c-1e08-4bf9-b91e-99617d50700f", "comment": "Malware payload (Mirai)", "value": "8f2981b621ec6861df4a33be11787c6fc0251c849895cf4bbdd2d738068750f2c2669b33c0e3d87a5be0e6b412766f22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761872, "uuid": "551e7a0a-5d2e-477e-a516-8410740d61b3", "value": "T13D11C026AFE35D6BCCD40377CCDB57506322AA8C818CF513F31216120C6FA059F16045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761872, "uuid": "63147187-0b6d-41ff-bf61-2e6f70f0753a", "value": "24:op/08taDEMwd1q0D+FF+i7DDIdHTP7TRII43NfeFX:opvaDV5F+UnKIxNml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761872, "uuid": "feba642c-4e47-448f-9042-342c9214c1e0", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761872, "uuid": "d1e48b56-12b8-4d49-a2f7-208a5e0cbe2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761872, "uuid": "82b8dd2d-5325-4933-b80d-007bcbb885fb", "value": "SecuriteInfo.com.Linux.DownLoader.523.3014.7255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29549179-e56e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710797179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710797179, "uuid": "8a2e4e7f-c2f5-401a-a436-784006ef9920", "comment": "Malware payload", "value": "5328ba6bd0e05fea64e70db94cca1540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710797179, "uuid": "f51bf4b8-ba88-44b3-8a36-eef20cf572d9", "comment": "Malware payload", "value": "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710797179, "uuid": "0a72d10b-1671-4868-8b0d-f2e58a0b346f", "comment": "Malware payload", "value": "2fa6461bb990b3553b17b2139ece685f8e51a837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710797179, "uuid": "89b7d28d-cf22-466c-a740-160bd4da4028", "comment": "Malware payload", "value": "21b059dfced88eaddbe2240cc535876a2f471bb6b19688d595a53d482286d01e47d0c235d0455be23399965822549cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710797179, "uuid": "071e3892-35ad-4d74-b83d-fa2283d44fc7", "value": "T178749EE45637EA6AEBCC037C70525A0093BD5A9AFEE3F70994154DE08C02791DA139FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710797179, "uuid": "0e7ac99a-4599-4d19-bf12-bdb8fa76f7e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710797179, "uuid": "179c00d5-1cbd-4cef-b1f2-96f421dcebc8", "value": "6144:4HagWlD3oYZaIyFdU9C+u7+5rY/3Osa1o7v/:46ge6IyaRa/+to7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710797179, "uuid": "c0364860-0a17-46ed-afa6-a88d7c0eedbd", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710797179, "uuid": "01f74bbc-a637-4256-981d-243f9b46ce74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710797179, "uuid": "37e14275-125b-4476-9199-20ab2c734c4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4ee74-e4e7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710739279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739279, "uuid": "5728538e-0d2b-4f54-bbcb-f47861f623bd", "comment": "Malware payload (AgentTesla)", "value": "9d1c61913c00b57a73e1b7b4dc0e882c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739279, "uuid": "c9389d10-b38f-43e2-bc3d-0d84e677a5dd", "comment": "Malware payload (AgentTesla)", "value": "0ee79831a187a469e04beae58eb73ab345975daa2d40161e3b8cd46c742f6d83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739279, "uuid": "d1ef2484-b4bc-4d4c-a305-a52149162ff8", "comment": "Malware payload (AgentTesla)", "value": "36c9d7503e1d1213dabebfdf4ef63b1cf631cae5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739279, "uuid": "9b98a935-f320-40b5-9a98-a08a3bf84c47", "comment": "Malware payload (AgentTesla)", "value": "84bbb9d4f5507fe2415739334730b78ad75a8665fbf486dd3d21da6f9c82d890e2cc13f51a02aea2b7adfcd656d3d71b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739279, "uuid": "e2657d67-a555-471c-ac6a-d64554d3f340", "value": "T1F773296DD34B02698F620377AB571E5142BDBA6EF38452B1306C533933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739279, "uuid": "b92fda37-8cf0-4e2f-b7d3-6a5b75d6de5f", "value": "1536:mwAlRkwAlRkwAlRT25LmJMKAB2u4omTX1Y:mwAlawAlawAlZdMuupmTFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710739279, "uuid": "805d010a-fe1d-41d6-b35a-19e15eed075a", "value": 75754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710739279, "uuid": "8edf4507-7750-43b0-83a9-a9a5a2c0f24d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739279, "uuid": "d41630c5-3cab-4286-ae3c-033a7898b5c9", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.7272.18965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff37f99f-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710761890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761890, "uuid": "4e3a4664-c065-4a41-906b-8ce0a1e7b5fe", "comment": "Malware payload", "value": "577c84b48375cd25b1a42c8b7cd08f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761890, "uuid": "e5a7d431-a2ca-408e-835f-e4ec6592264b", "comment": "Malware payload", "value": "10432d2c9e3f65eb672a79de639fd2afe35a38ef3de49bdb12d1f0c2712e483d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761890, "uuid": "791fdca8-ead3-4dab-aadd-02ce4b8c7a40", "comment": "Malware payload", "value": "9bc20af58c4b1c0d20e7670dfa3ae315709e748d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761890, "uuid": "5b3b599f-380a-42d6-8e43-4360f103edf4", "comment": "Malware payload", "value": "28debe28df2a3a2766ac43b2fb14bb221c973628b7fa3a0b78637725893487261ddd2a195413493ae2f9c696cf0b7cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761890, "uuid": "4ba3355c-fef1-4871-aae0-a30331b78ca6", "value": "T1D5B4E1343AEA901AF173EEB69BE4B4D6ED6FF7733A06A85D109003860613A41DDD253D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761890, "uuid": "649fe68a-d698-4416-8202-0c9dd74eaeb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761890, "uuid": "caa576aa-8892-4d0a-a2a6-1a38f1ebabb1", "value": "12288:/5dpUvt4snXViwOByWYdJNp4mIAYgM8JoRlRFOQaOww4GB:/5dOlLXTs6JNjhYgnoRljOXgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761890, "uuid": "45471ee0-fdd9-4ae5-842b-9f24c0fe65fe", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761890, "uuid": "4dbbe0e4-8cc9-4bbc-81dc-a18b72cb8842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761890, "uuid": "f40e6bc8-d1da-447f-af17-9f2fd4023f58", "value": "SecuriteInfo.com.Variant.MSILPerseus.195234.2089.25330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f045ca49-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751986, "uuid": "94e050a5-ca75-48cc-9da6-f446583ac4e0", "comment": "Malware payload (Mirai)", "value": "01155b32692e90d4ae5e0741f47b1992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751986, "uuid": "f05bb51e-2d44-4272-a201-f8df062d92d8", "comment": "Malware payload (Mirai)", "value": "10b20ffe6efe5e03abf6ce10e922d7f5431917bba7d56bdaa32039935e33cec3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751986, "uuid": "15d6ea86-8108-4b1f-b54f-1ae33222d43a", "comment": "Malware payload (Mirai)", "value": "7b5ef601670faccf65da395e04675b7325d3637f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751986, "uuid": "75d0cb71-0f03-4e79-8806-f647ef628fd0", "comment": "Malware payload (Mirai)", "value": "225e87969c3f851b0cfcae3b8892b8af0c1e98bec4721f598b51fc78516927d591d6b78a8e85064a435fba4ce4f69012", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751986, "uuid": "a6d2e2af-1341-43a2-92b7-d5381276bdae", "value": "T107F36C30693A2E97C5C8B47B22F74355B1E2338A38B8974D7CB00D0DEF5CA9065576BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751986, "uuid": "961473a5-16f6-4dd7-9651-7f0a51cfe843", "value": "3072:8iHZ2b9Dw0xDTFvPtyvfKSrzYMH+13NIIyt:58tw0xDBvDM63NNyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751986, "uuid": "a0175b16-7fbc-4f70-8920-6c85dbe30e47", "value": 165696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751986, "uuid": "a5806167-9bef-4272-a03f-c53fd1b75ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751986, "uuid": "249c3227-2c30-4f11-8c5a-4db9e1c7dd4b", "value": "01155b32692e90d4ae5e0741f47b1992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76cde53-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710761877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761877, "uuid": "f828da1c-c01c-4eae-b8f7-0f1e5d5ceebf", "comment": "Malware payload", "value": "9373ea11c3c4485a5df76c8f20d0eec7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761877, "uuid": "95ca2b59-57ba-4789-9ea3-15fa36117019", "comment": "Malware payload", "value": "11530b92593341f1dfd74f2b0fabb1ba67d34ce0b4d026570c722f4649f7337e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761877, "uuid": "fe5f7c85-f209-4ee1-86f7-86f78aa587d3", "comment": "Malware payload", "value": "9e27b7edf312d57846bedd9582043c528a0e6138", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761877, "uuid": "f1a7c14c-1ac6-4518-9d96-fcfea2bd9064", "comment": "Malware payload", "value": "6b2624e6d6308f3798c00b715f50f32c65ad98ac85d4ad5ec9d57edf49f51017855da1f622d5e5de71aa558b7bc5e2e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761877, "uuid": "a21f778b-9100-48ba-95b0-d0d9eec29b07", "value": "T1A003F1A3897E9EE9C06630B301292258F855AC0EC7DB4DD70991E2B98438D7DAFD1E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761877, "uuid": "92c63e01-fd6a-4b30-8742-ac900175edfd", "value": "768:7C1po7aHHWz/Qop36YEINGq8JR6op3vpsm3OOGAgIM8+xISQlYNx0RL:ePIaH2zLp3pNBopsm3OOGg+xjSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761877, "uuid": "1916bd4f-4ffd-4897-a88b-bb9325592e83", "value": 40228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761877, "uuid": "491ed506-9b7c-4f58-a2d2-dcc1ca1466e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761877, "uuid": "7a6bf31a-f824-4b49-a11c-5e8b71c30a5b", "value": "SecuriteInfo.com.Linux.Siggen.9999.24712.26910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc28960a-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710767817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767817, "uuid": "06b6b8a2-b8b0-4aa5-aaab-99274e986f30", "comment": "Malware payload (Formbook)", "value": "f1d74313ef1a2f8e320a6c89f7534d54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767817, "uuid": "cc459d08-e397-4a42-8f11-47f96f57d8af", "comment": "Malware payload (Formbook)", "value": "11a1a953f9c30190bd389d52db00d83ee4020c7b57c2cc4bd54a4cdad9b151df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767817, "uuid": "a15717eb-69d9-4c5e-ae6d-6ce11f70195f", "comment": "Malware payload (Formbook)", "value": "2ac48be64d044a4a40fbc578b9057a08b335721a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767817, "uuid": "2a57bfa8-f51a-4217-9c22-1c7559099ed3", "comment": "Malware payload (Formbook)", "value": "666a08ccabef0d7c0e4b0575960eb198ddaae8883f771694dc14ace2d52f2819ec4a2e70df343565f488906fb0e3cc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767817, "uuid": "b1dae695-79aa-4a83-aff9-4b4f255b51d9", "value": "T1354423F3C505F825E73824F2177B32AD6865F36BBE2C1B1729D85B94997013E24ACD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767817, "uuid": "976e4280-101f-4d8d-856b-d23c17f35e1c", "value": "6144:6v0slpmg1tidmowIRALtD3apADGvkmzUYm49kXTm:ZslpmgXgdtRWt77YkVJ4QTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767817, "uuid": "e2d3651b-bdab-459d-98ca-e25b72c347fd", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767817, "uuid": "bde2520b-e002-4abe-bd2a-91c2a53402d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767817, "uuid": "eff14f94-8b63-4486-8065-e2e49f29c96c", "value": "11a1a953f9c30190bd389d52db00d83ee4020c7b57c2cc4bd54a4cdad9b151df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91b49b6-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783328, "uuid": "81b006d8-4f8b-40f4-b80b-58da9c5c77c0", "comment": "Malware payload", "value": "87dff3375504a1b04de92d06a3d2ef3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783328, "uuid": "f9164f3f-77d6-440d-85ff-08c20e1eeaf3", "comment": "Malware payload", "value": "1224c6707dedb794c1adab7d225c2348e92b60d71224a42f3fac0f02b32c4cdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783328, "uuid": "a00dc269-9838-4b61-bbbf-4e7a2b1cfbf7", "comment": "Malware payload", "value": "0fd48fcc8dc695f9e774c8a7c9ea3b99927e8b7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783328, "uuid": "a82ca096-791c-4f57-9a96-23549c7aa23e", "comment": "Malware payload", "value": "9f5cc10102fbf940500fcbd646f3ae96b008f058fc1f7a2a6381d789d51ebe5c5841bc9413d9f095f61bcf8fea4cfe7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783328, "uuid": "7231b03a-6aeb-492d-beca-5c0b4467dfb6", "value": "T15DB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783328, "uuid": "24ef1324-8f69-4407-8149-5da9205e481c", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2O5N2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUre0NTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783328, "uuid": "94769f27-f724-463b-8c61-73a34e790718", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783328, "uuid": "259d38bb-dd6e-4fef-bad3-6817ddb9b0d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783328, "uuid": "ec5a20de-5547-4709-9010-60ee53397dc3", "value": "87dff3375504a1b04de92d06a3d2ef3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729eaf2e-e4cf-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710729012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729012, "uuid": "92a74c34-ba48-4e24-bafa-f245189ae028", "comment": "Malware payload (RemcosRAT)", "value": "356cd19d418e85b96cb01215f9dedec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729012, "uuid": "4f622f66-927d-4fa8-b991-5ec31624b963", "comment": "Malware payload (RemcosRAT)", "value": "12cabee8f5b4f01796bc3897da9efec25a005d5fd5b87e7a3359cac241c9ea72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729012, "uuid": "f75216e2-05f7-452a-b209-02c404fc8b30", "comment": "Malware payload (RemcosRAT)", "value": "a0f7f298e229aa11873e0d34e4480a9a530da05a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729012, "uuid": "9d41a4d4-be29-46d9-b5fa-fb20ef6ceb98", "comment": "Malware payload (RemcosRAT)", "value": "36cb11bdd775045b068657a7d5722606610866e75a488be0d13f5483cd991168cf63099ae06414c075f40d1f5420d728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729012, "uuid": "4fdc601a-5a00-4335-b488-66abccf9c3b1", "value": "T12515AF7669401177D4121F70CA19E39DA80C78B27F2460DF1EF80EACB679F9BF809962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729012, "uuid": "8f33970d-4791-43ef-9ff1-da3ce7f307d9", "value": "48cb53e6073981d79ce56fb69707e743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729012, "uuid": "d7ab4ada-e0b9-494e-a217-dfaa9c4d0e20", "value": "12288:oXxu5oy0XhL9ljnp9zIO6S33Ys1fCjPfeCMVAgfMCfse9:ohAcXhL9lV9cHSY2ZCMVAgfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710729012, "uuid": "24299e48-6ac2-4d22-9aae-c75051eb1e8f", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710729012, "uuid": "3dc2abc9-de5b-435b-8b73-bd5e7df7347c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729012, "uuid": "36f4933a-000e-46e3-acdb-dd570a7bfd35", "value": "repeatorder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b0ca51-e537-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1710773631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773631, "uuid": "f588779a-a8de-4202-a51c-d56a187b2af2", "comment": "Malware payload (Adware.Neoreklami)", "value": "41bf2693033eaed432dfa5c1d75cdeec", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773631, "uuid": "c18744ec-731e-4a3a-8f7b-112c58043786", "comment": "Malware payload (Adware.Neoreklami)", "value": "148c3096bab88a675414bd9463c60c44317f3ee5d12f949526847827cb108010", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773631, "uuid": "7d5934bf-6ec3-4354-82eb-9c1b8c6cb71f", "comment": "Malware payload (Adware.Neoreklami)", "value": "ff038cb9e992a518106c80868176785e987c301d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773631, "uuid": "80f08dba-0a82-4bab-8520-22b7c4e722b0", "comment": "Malware payload (Adware.Neoreklami)", "value": "1724e0cd6fd0603db747bd86812961958265521a5bc6114899f5d92426f65de8c363bfa2cb38fad137d4eec47d6b8d4e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773631, "uuid": "4893d28a-7cd0-404b-abe6-5599fa86a57a", "value": "T1547733837DE890C5EBF56CB73ACF4EDC869588D815B1369236220C4C2A736AD7833B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773631, "uuid": "f53469bc-0e66-4c48-96b5-5a4397465eb4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773631, "uuid": "7a7fba20-bfcf-46f9-8b5e-3c3e176b68ed", "value": "786432:ELlFuTirkoTj4mAJidZgSekJEUlvgBNTTz+Ndz+t:fqjzddlekmg4LU+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773631, "uuid": "558b4fb7-146a-41b3-a3b8-5f43f992895a", "value": 33220376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773631, "uuid": "5a3c604a-4cde-4acb-83d9-e9cc1c16620a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773631, "uuid": "98f82bf6-095c-4e1e-b47b-b647bce279f1", "value": "RUN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb78430f-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741670, "uuid": "4aff6ca0-9441-4518-96a9-293d690edd41", "comment": "Malware payload (Gafgyt)", "value": "d7a93c4df46e21899bcba32206436060", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741670, "uuid": "6c19c3ec-d792-449b-b0fd-1f5bc8917928", "comment": "Malware payload (Gafgyt)", "value": "152517f06d86037bbc2797bc927cbd225b50844a277ac0d6fedd13f00aa37e29", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741670, "uuid": "284b0a6a-0638-4c3a-9380-72baf935fb20", "comment": "Malware payload (Gafgyt)", "value": "0896ec0813c735343dda031aea7decdfec83ce4e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741670, "uuid": "2c0639e5-0a09-472c-aaae-4ab7456be424", "comment": "Malware payload (Gafgyt)", "value": "23baa95ba9c0a387631d58709b7704e336236667a3dc54d908a05799c7ff54398568a0d70c6ff39585e999cf02079b87", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741670, "uuid": "cf78b5d2-0e8c-4aa5-b32a-3bfd7e04e2a0", "value": "T17FB3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741670, "uuid": "74c1dc9e-7f34-49f0-b964-ce6e72189ea3", "value": "3072:C/4g3Kd1rT5hZmxgA9OKdwwjF9GhsR1Ae:O9anT5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741670, "uuid": "7c2365c1-efd9-4880-afc8-53106516e790", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741670, "uuid": "0400af99-e9c3-4ea8-a552-66098765e6a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741670, "uuid": "b47cf5d6-841a-4edf-94c1-ef2061bf08fd", "value": "fuckjewishpeople.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b14e84d-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783089, "uuid": "b3ada1fd-0b3c-4cb3-ab23-a359537b7d43", "comment": "Malware payload", "value": "8138f1af1dc51cde924aa2360f12d650", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783089, "uuid": "d9702700-9b6c-461e-9639-8f971e5e5e86", "comment": "Malware payload", "value": "15412d1a6b7f79fad45bcd32cf82f9d651d9ccca082f98a0cca3ad5335284e45", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783089, "uuid": "e80be5a3-7014-426d-93de-c30e71eebbbf", "comment": "Malware payload", "value": "74b1da190d670fa4c207afb0fbca4d7df701538a", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783089, "uuid": "0fcec31b-6662-4129-8000-b1e46247e554", "comment": "Malware payload", "value": "0e3fbd810e38fa8fc14d9725afa66509ccb286ac858516bc40bb23d0251be52851999bcab83cb9a20f0355ad264d7643", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783089, "uuid": "de2d878d-5f27-44ae-92c0-4d7a6befe105", "value": "T18844E647F1BA44BDC44EC0B001DE2639D5E1B41889967EAF2684FAF117F2B90AF94B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783089, "uuid": "eaf9114c-7ac8-4b8f-a98e-0f743a9205f1", "value": "6144:pP+dv39axq0rT+DnuokS63QeYqn3b6gu+vG/US8NvVkN2Jy8zcvd:k39aVSq7JYq3GgbeT8NvVru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783089, "uuid": "d45a72d5-a67d-465c-8f5f-781733c114fb", "value": 261344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783089, "uuid": "10020bf3-ba99-4854-9783-a298b3ff0c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783089, "uuid": "9ac66c22-4293-4ba5-b6bb-64f6741e7b28", "value": "8138f1af1dc51cde924aa2360f12d650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134f6781-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763642, "uuid": "d86b1536-7156-4da9-953e-cb51a3b15a62", "comment": "Malware payload (Gafgyt)", "value": "e3f345f025994f8114261ef8c42b055c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763642, "uuid": "3af306f6-18c6-44e3-ab67-fc401f509120", "comment": "Malware payload (Gafgyt)", "value": "16432fea61782b07c75832dc93e97ab6c333c54d4956b558eb6ed37b44459c1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763642, "uuid": "75901dbb-3602-43a6-8cdf-d8d383b775c7", "comment": "Malware payload (Gafgyt)", "value": "a8fae3e9a87855b3bb778a0af7b00ad36204a17c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763642, "uuid": "7516bd1d-fda5-45d1-9edd-ecbff4cf5bb9", "comment": "Malware payload (Gafgyt)", "value": "ec68519f3cce89ddf0c03f2bf2fbcbf207fd85b1fceff0b2c68ee1547457b71ee32d5bf6f648b271da8c1f3fd1b38b5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763642, "uuid": "fc3860ae-b29c-4bbe-953d-07da78d5c7d9", "value": "T1F4B30A04E8418B27C2D267BBEB9E478E7B3597986F9B332256295DB02FC17483E3D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763642, "uuid": "0835d677-9a58-46e7-884d-a2a57097aa28", "value": "3072:lHr0Ut7q0dEK52a0auLvK4O3y7KcA5h5+LeyrF8NpoQA3llEShM:trp4O30rA5h5EesF8NpoQA3llEShM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763642, "uuid": "1c8b1e7a-1d8a-4e68-a7ed-63abfc6e6999", "value": 117456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763642, "uuid": "6556d3c7-e948-481a-8536-57bf9b1dd5a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763642, "uuid": "e89875fb-70b0-41fd-83c2-755d2460c3a5", "value": "e3f345f025994f8114261ef8c42b055c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d66e6e-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751888, "uuid": "eb68b72e-3222-41ac-b42e-6e13112ba6de", "comment": "Malware payload (Mirai)", "value": "9feced7895dba3a3fa6d750c3f65137d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751888, "uuid": "4d06fa30-093e-403e-bdee-d994745b5df7", "comment": "Malware payload (Mirai)", "value": "16a6dd8febc34ffc3806ed2bc9fecc64b1e56f57fb8672c1c6b7b065042d99f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751888, "uuid": "b672cf8c-9faf-45a0-9be0-291deddd14f0", "comment": "Malware payload (Mirai)", "value": "0af4012cd055e9947c888d6b96a740673613c55d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751888, "uuid": "18b8cb3d-f4eb-4713-aaa4-8faf687a7a24", "comment": "Malware payload (Mirai)", "value": "0357162db35d6b9cb68cb3f8a614a1900fae2090213a0a2c3481091e3565093b2df7c7a35842b57f44da384fa2361e28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751888, "uuid": "ff1ec686-8942-4b9d-8564-149f9a05297d", "value": "T17D434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761182F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751888, "uuid": "52f7775f-dc54-4f48-8bb3-25967bff2281", "value": "1536:q01NDkjhWBPe1ZUaDy0wYrudk/Gr/d42+P:qEgoBv3YrucGBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751888, "uuid": "f4b39aba-28d2-4eec-87a6-14216434694b", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751888, "uuid": "6b00e484-82a9-49f9-b5a7-794976191340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751888, "uuid": "843ea872-920b-47b6-b492-bc7bff20fafc", "value": "9feced7895dba3a3fa6d750c3f65137d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beb230a-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1710753912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753912, "uuid": "274306f1-464c-453b-81cc-048cde44a46d", "comment": "Malware payload (Smoke Loader)", "value": "87f42958b0558b85a4a799d76330eb89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753912, "uuid": "0cd019ca-6a17-4d70-85fc-84a0d1413fc1", "comment": "Malware payload (Smoke Loader)", "value": "17f9ab3ff113a9dda69111ab6ab03c0da95d47ab419a858b54374e3333ce516b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753912, "uuid": "b90888e3-33ac-46c1-9a6b-a7452896728b", "comment": "Malware payload (Smoke Loader)", "value": "12621bd5045dae3d9f1afe6ea8a5363e5fe5ede8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753912, "uuid": "1b937133-7019-46f2-8d22-e4f5974e6fd6", "comment": "Malware payload (Smoke Loader)", "value": "0f816276f86ea618c5c6646da6ccd26fdf6a41e9bf110a25421d12bc7a97695d94f08cf813b08f4d84c6bc755b7d2bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753912, "uuid": "bee2d1df-5856-4edc-8a9b-091e33c26e73", "value": "T15D646A4365E1EC64E56247314E2C89DCB73FBC61AE61575723983E0F28312A0DE9B762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753912, "uuid": "d97c1574-f088-4fac-83d3-a2e01a08901e", "value": "5428a38f0c6440648123ecccaabf4115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753912, "uuid": "2ca01c22-da67-4c89-8555-d0147cffee97", "value": "3072:K+J2XhieipHjagnf+NHMGpbCccu9vp/R4e0Q/yfstLRRTSPi:KdFip+cwHM0HrD+e0Q/yfQtJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753912, "uuid": "ef164350-10e3-4925-8d40-0058de7eb114", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753912, "uuid": "317b5fae-7027-4467-95de-74196e30db16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753912, "uuid": "e65fa712-ae2d-49d3-a3e3-0d8f58693867", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ba0c12-e536-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710773360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773360, "uuid": "f9cebc4a-fc5f-4279-9a22-02a2e8903b51", "comment": "Malware payload", "value": "cfec3d8d0d46cd1654cbf2d5be2beb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773360, "uuid": "51c051de-d391-4617-a94b-84ddb1cd5f6d", "comment": "Malware payload", "value": "18ff2da984275a0dd5b55357c27a69891c16fc8f84bd8bbef724d41b55f60bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773360, "uuid": "a77a7901-f7c4-48c9-bb17-6c87b1b0ccd8", "comment": "Malware payload", "value": "6d33188bb76ddceec1f2518031a409aa6c88d90d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773360, "uuid": "a6e6e644-58eb-45fb-a005-c39226fb0d24", "comment": "Malware payload", "value": "75792a9b20e8a9492042f4c6a1acc8d405fce83f96c5229766c761e4c82df1f6d966749f4a72abeecd813fa451ce7c05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773360, "uuid": "74b5d1ba-6bc8-47e9-ba76-f05e8671a29d", "value": "T1DF473347FAA26EECE5ADC074422553B2F632FC6C4420AB7687C047313F99B205ADDB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773360, "uuid": "0b6e279f-c2c9-418d-9649-7b03ddbc3ffc", "value": "4968a00e8017740306d0d35ab4f23b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773360, "uuid": "1e928879-7060-49b6-bacc-0d682e357261", "value": "786432:ItkLM0MrozmffGVv+jcOG85a44HvIEJB:ydraYM+r5alg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773360, "uuid": "b30987c3-4c95-4c2e-8caf-72e39b630dc7", "value": 26442680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773360, "uuid": "f2b21ec6-228e-4623-b05a-d124a009b4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773360, "uuid": "46d1352f-6b13-4c23-bbdd-3920d0f136ea", "value": "GoogleUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c096133f-e506-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752765, "uuid": "8727a004-9c91-4420-bad2-2d95048e61cf", "comment": "Malware payload (Mirai)", "value": "3f471655836f641059bc2da85eaf3aee", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752765, "uuid": "b5f02ad9-f379-485a-b74a-725ec03593e3", "comment": "Malware payload (Mirai)", "value": "190be0efc2d9727289bd74c4cba38ba52890ebfb20d7539f47d17575807c53de", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752765, "uuid": "ea2841ff-37b9-4467-8a62-771bf5eb4e92", "comment": "Malware payload (Mirai)", "value": "b4339e8c1b20145e2814724fc24606b5a3014a63", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752765, "uuid": "d82b8f86-67eb-47ac-a6f4-0e49c2bdf005", "comment": "Malware payload (Mirai)", "value": "8296a0a4982e42e37dca29a3476e33573812ac34b35742c94a86af887b62d3fa0648e186598c663387e925a848fbe6d0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752765, "uuid": "d786a517-27f4-4e87-9db1-d8566dfce05d", "value": "T1F033F1AB5656CBB2C89720F3B1B6F140DC230501791A833744DFB36AA4F9D967A27782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752765, "uuid": "29ab45d2-c03d-4cc3-ba2b-988954ba530c", "value": "1536:ogVYnH4HZrV9wm3FcFSmP9NvWZL+LEiIp7:op8ZrVJ30qB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752765, "uuid": "20978130-3381-42df-9366-e6b905b6cb32", "value": 55000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752765, "uuid": "72ea5d5a-6aff-42c3-ac86-2d96e62fea20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752765, "uuid": "43694477-9ac5-4b28-9e7a-2be39202c7c7", "value": "3f471655836f641059bc2da85eaf3aee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd50e8f5-e4e5-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710738613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738613, "uuid": "bbe78f5e-7515-4de9-ac26-bcbf816fd865", "comment": "Malware payload (LummaStealer)", "value": "3412ae5ccb6dba38fdfecfd8418b0a83", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738613, "uuid": "ed41ebf8-10e3-4bf5-a5f0-910fee17f02b", "comment": "Malware payload (LummaStealer)", "value": "1acbfcf52b220ea104b2cb9932e2461e5b0576b70e61d8ab102d7babf920f8cd", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738613, "uuid": "552375c3-9e52-4fd5-811c-c5dde3e5e565", "comment": "Malware payload (LummaStealer)", "value": "5ee577fa4fee079525deaafd50f00fc9b59d4614", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738613, "uuid": "5e3dab77-48f7-4b3b-8697-7c5df64bcf1b", "comment": "Malware payload (LummaStealer)", "value": "b5beae3712bdb237e947dab9356ff0266d3d1b7d316e8ea9ce05e1faedab224df7809a7a0c72ac39ea5d82746e2d0acf", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-1337", "colour": "#8AC3DF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738613, "uuid": "3b145012-fc30-436e-ae01-f99174161dff", "value": "T1D407337A73DF42E39EF88FCEAD931A434A69BE4DC238187D22816C11CC508759DA95D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738613, "uuid": "49950e67-1d40-4ae1-ae53-74e65e60dc64", "value": "393216:kKuIiL0Pp72T5J5PM9RVB0fwDPAZ9TIujFIyLQUiqn2bZPNF:WIiL0xyl3CVB0Ie9fj8vq2bPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710738613, "uuid": "7cccf5ae-17b7-4cac-b2eb-baae21140ffa", "value": 18445086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710738613, "uuid": "7f2606cb-f4c8-4eea-a8e6-b436e01e20a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738613, "uuid": "d525ff8a-95b9-47e7-b8b7-385deaf9b8e8", "value": "AxoPac.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03c8b15-e517-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710760120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760120, "uuid": "3f892e80-c4a9-40ec-a631-c1a21bfd1aa3", "comment": "Malware payload (RemcosRAT)", "value": "df8e95418a781c112e9c35bb737aa9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760120, "uuid": "d1cbb71f-a51d-4d8b-8d99-508d3fb69b31", "comment": "Malware payload (RemcosRAT)", "value": "1b5ba1755ed43689d38dd0ece8c01b5fa25a21a16834eb9ce13ce7d7da8d1982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760120, "uuid": "0302e833-c02e-44c0-963c-728ee9ce2070", "comment": "Malware payload (RemcosRAT)", "value": "aa3171e7ee030c1b0a7fc21be53ccef8b1b13c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760120, "uuid": "aad28750-8cf3-4e55-bae2-92a29976980d", "comment": "Malware payload (RemcosRAT)", "value": "58b0b906185b689530a80977de3eacd487ea846aa8901782d4371c9eaf2a414d51e65be89540a3902f5220c618ce8cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760120, "uuid": "61b5e335-fd92-41c4-a36a-7cb62d578833", "value": "T1BC759D0673B18292FFFE91720F4DF2110A7A6A75065BB61EC2772C79FA30171262DA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760120, "uuid": "fdaf8a45-5449-469a-8ec5-1b59648d61d6", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760120, "uuid": "e08e9806-b030-4702-915e-0e65d1687f06", "value": "24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aIj2Yym2PN17b3Spe1BnCg:/TvC/MTQYxsWR7aaYN1nS01BnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760120, "uuid": "f5c40bfc-57dd-4e5d-b4e8-3845df9df9b0", "value": 1566720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760120, "uuid": "5960a0f6-511f-4265-a3db-b3081f85f9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760120, "uuid": "549b70e1-22db-4a4b-a9a0-22ea7abe1bfc", "value": "1b5ba1755ed43689d38dd0ece8c01b5fa25a21a16834eb9ce13ce7d7da8d1982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dba6ed-e554-11ee-a120-42010a9c002e", "comment": "Malware payload (Meterpreter)", "timestamp": 1710786146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786146, "uuid": "cc66860d-ec2b-4898-a98e-daabc3acb49c", "comment": "Malware payload (Meterpreter)", "value": "ccd26298318a95ff4dcb6748acf7d217", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786146, "uuid": "71e3e893-49e4-495b-8fbb-4072a40c228a", "comment": "Malware payload (Meterpreter)", "value": "1be5fa8b12a5df4d34be14d79e5339d818ce460315849c52b84bddf46a098033", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786146, "uuid": "28cc835a-b378-4e5a-9b4e-580818690cf9", "comment": "Malware payload (Meterpreter)", "value": "5322aba102a4c1fa73609ac0167c880987d9a5c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786146, "uuid": "a615610e-758d-47b3-ad82-31e2722a8954", "comment": "Malware payload (Meterpreter)", "value": "dd6bf6bc50ebcf83863cef866eadf63e8b6a62ca5e1ead40578d73c8a8b8d565e22df4f272187d1de7c5f86863ba618b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786146, "uuid": "22663a8c-16db-4312-adbe-7a151694c1b6", "value": "T1D973BF43E6C45031D1A221BD67B53AF5AA71F1F63306C2AA7A4CCDE9DBD18B063253C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786146, "uuid": "9bcab56a-161d-4c64-b144-121b1373e5f4", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786146, "uuid": "800fdd32-a418-454a-aae3-e7b262b87f65", "value": "1536:ITASCcY7pXhPw0LgCpwCQ5gs0Mb+KR0Nc8QsJq39:lpZw0LgDZ5gs0e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710786146, "uuid": "30bc95a7-5eef-46bb-835c-61726d733a3d", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710786146, "uuid": "76b82b19-822a-4610-af34-5edf60a0664c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786146, "uuid": "6148e232-184c-4940-86fa-d3fd227f8c3d", "value": "ccd26298318a95ff4dcb6748acf7d217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8441f9-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752436, "uuid": "a156fc36-28c1-45d1-ace4-017fb6759b96", "comment": "Malware payload (Mirai)", "value": "4bc0e02797e56b2b543dfa02162ca392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752436, "uuid": "287f4769-d23b-491c-b2c8-e89202179501", "comment": "Malware payload (Mirai)", "value": "1cb3348e3f8ce19f97fa7ced738953eb5667bda83dd712713d4ca6a960de8388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752436, "uuid": "9bef30eb-ede0-4d67-aedc-176cbb96ed46", "comment": "Malware payload (Mirai)", "value": "eef7835a97ad71b874d9c9a57b2d08ed17249161", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752436, "uuid": "ca733348-b273-47a6-9a53-96d3538ea5e6", "comment": "Malware payload (Mirai)", "value": "d9725261dd69bc264f219f191c3c2249c460b8ac2747a1a82876335c24c9db5d77bb23084dd3560d13f2e64071e7ee1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752436, "uuid": "cf3d0dd9-bc97-4d8a-b599-8b15b7c76989", "value": "T105F35D96B4104E7CFC8B95BE97330F08A021525870A31B17F296BD9BBE721DD9A0FD49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752436, "uuid": "d17b9c12-49d6-4113-b414-aa709e219b9d", "value": "3072:Y0UJifANk/G23jh9+6Vd1c/fRD2D7cKpgCfzNOj+f5soiqj1QsM:ZUJJI3jh9zvVsKpgiBRsoiK1fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752436, "uuid": "13805fae-977b-4372-ae15-a614abcb45d5", "value": 167144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752436, "uuid": "f46bcce6-958e-42b3-86b2-30452f64f8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752436, "uuid": "9c190f17-4fc8-46c2-afb4-dad108012c7d", "value": "4bc0e02797e56b2b543dfa02162ca392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efde5129-e544-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779473, "uuid": "b7497522-d008-4e12-a56f-3fccf48c0247", "comment": "Malware payload", "value": "aac4141dba6328f3529b38a28f8dbb92", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779473, "uuid": "cbb3fb87-8752-4477-b9cb-dd4ac06ccd0f", "comment": "Malware payload", "value": "1e278cfe8098f3badedd5e497f36753d46d96d81edd1c5bee4fc7bc6380c26b3", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779473, "uuid": "fcce1276-dba3-48d6-9b44-a3fbc295bf10", "comment": "Malware payload", "value": "e5bde7ae2fde36edcab5885cb5fbc52a905e06ea", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779473, "uuid": "ef70572c-61b1-42f6-a196-f83e5fe2dc0b", "comment": "Malware payload", "value": "277bd11a890020b146a76508b0cc051be54a7b45eb24c37219b7c04277409f3dfbdbb46ed208aa95b62542924545066f", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779473, "uuid": "2ea2eb51-9b5c-4a53-ab65-befbafc67465", "value": "T1FF944D24F6B800B5D156927ACAB3CA86F2F13A990B2187CF42A555AD1F37FE7053DE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779473, "uuid": "c20bb763-3df7-494f-8379-52f234649f74", "value": "0050e2be629782ee695e498cc353d014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779473, "uuid": "751a5513-1a92-44d4-98c2-c6f51b333342", "value": "6144:ux9dr+RP7zg6kUNSfYLTSdX7JooKoRcJiE3TFdBp3Sn9sSSKr9:vRYUQfYLTUoxMRr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779473, "uuid": "e47226e1-7489-409a-b498-f71c5dc9278f", "value": 408240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779473, "uuid": "723a651e-d1ae-4f5a-9cf6-125d34e4550f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779473, "uuid": "4d657be5-309b-4516-956d-92c087ccb840", "value": "twain_64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1316ff-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760383, "uuid": "a8dbde90-96e5-455d-bd2f-46501785d31f", "comment": "Malware payload (Mirai)", "value": "059205d61f484fc85e71f73deaa262df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760383, "uuid": "56d0400b-1347-415c-b2af-2a5a17bcd5f4", "comment": "Malware payload (Mirai)", "value": "1f26cba93e121f96461d657c318bfdf16bb43c2bfded51d71bb8273e29271a07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760383, "uuid": "362a7d08-c247-4968-b877-25cc83759c24", "comment": "Malware payload (Mirai)", "value": "4096bd241bd0e77a93bb02d9f92004c349061c9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760383, "uuid": "3070aacf-0d40-438f-8a7d-506fb12dfee9", "comment": "Malware payload (Mirai)", "value": "04dad933bc2db6d6027f0819de539d69d42c9dc59a7f210719da627d38a808f9b30271e977ffe4e9a926428764a4cc2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760383, "uuid": "77d4617d-82ba-41e8-9323-79a5f5e27c4b", "value": "T129310FA1B3E05DBCC8F451BE9E1B032573679F04E1CB7122D20CA368AC1AD3C6D26845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760383, "uuid": "48bb3674-f539-4421-9305-0e9f4a24fa31", "value": "24:qTchKGTA3wnHflfmoUxz1tmv3gRGI9iLBuLlBvY9gHW29:thKG83wnHtmoUxBws6BuPvYYW29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760383, "uuid": "e11cdc99-4251-4aeb-81de-51f244a1877f", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760383, "uuid": "40fe09cb-848b-47b1-bc87-4ed5569c7122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760383, "uuid": "4b116852-2d6e-4de6-b744-5a83382f08b3", "value": "059205d61f484fc85e71f73deaa262df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82dae0f1-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765976, "uuid": "ca7eb160-eb82-4793-95cc-969c2f1784d7", "comment": "Malware payload (Mirai)", "value": "791fa425a9dc42943d71e8ca22f4ccf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765976, "uuid": "771c4d51-6a4c-40bf-a286-689771655a09", "comment": "Malware payload (Mirai)", "value": "2007d40f741ea23e49e8239a9f67b36c2e6073301a1196882ba14835dc3d7a33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765976, "uuid": "8c1aa817-b8bf-43c9-b4e5-2abd679dd932", "comment": "Malware payload (Mirai)", "value": "a425111fd8e912b9d826f519def99d3920f27014", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765976, "uuid": "eccee8b9-949e-4919-af0f-8099585369ec", "comment": "Malware payload (Mirai)", "value": "90aab20b197e4be699ba19706756392bb05cf97274af37e6d7a1e46088e2f664594646ba2c35c2452dd02128a8374994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765976, "uuid": "4231382d-fe9b-4a81-adb3-46d6c80f86f4", "value": "T1AB037C72CC753E18D5A88678F5349B3E6B63D552D28B2FAD846782398103ECCF8093B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765976, "uuid": "d720b54a-c271-465a-b7a0-1b6954c358bb", "value": "768:krIeCvsrruyHMxklKuZl543/SlXtnXosQ2KCcoJIL:kSvsrru6MOkYl+OOh2KCcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765976, "uuid": "c12036fc-b8e1-44e1-ad72-2d906fad615b", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765976, "uuid": "e57e9201-5edb-4166-962b-fbbd041bf274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765976, "uuid": "a08a7c4a-d035-4c97-8758-6802b8ae86f1", "value": "791fa425a9dc42943d71e8ca22f4ccf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfcd85d-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710782985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782985, "uuid": "e74dba8d-74b9-46f5-87eb-b7b613da5f91", "comment": "Malware payload (Gafgyt)", "value": "cafba0e9fd9f742ac9ffbee696adc162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782985, "uuid": "ec4987ab-452e-47dc-ba25-391135f3881c", "comment": "Malware payload (Gafgyt)", "value": "20ab2aae90d93c4c7cec32f14b807337c98fccea859181e9182507f901668e30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782985, "uuid": "912c03b9-c594-4a8d-ad7f-805d0f8d2f8f", "comment": "Malware payload (Gafgyt)", "value": "fcced5a1f4fe3977ae4b4d333a2e87bf7ff003a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782985, "uuid": "c6375077-f089-44ae-95aa-f86caf4a1770", "comment": "Malware payload (Gafgyt)", "value": "9b2daf9bf5f5fee67f1daaa9ec2102231df8b311044521ea493c354ab881bcd8321cc3d852684aa6af436091d53f20f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782985, "uuid": "01937269-0caf-4478-8c44-48d0611bcd46", "value": "T125931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782985, "uuid": "746bb6d3-b6ff-4fbf-acbb-0badbddff75f", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvLNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGLNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782985, "uuid": "7e9ff2e5-e4a6-48cf-84ad-29061dc2cd5c", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782985, "uuid": "a3e39e1d-1e7f-4df7-867c-99816e70445c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782985, "uuid": "bb1c9d0b-a30e-4e38-a2d4-e3d254e75de1", "value": "cafba0e9fd9f742ac9ffbee696adc162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddab6783-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1710745942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745942, "uuid": "50c2e74b-ea74-4d13-8886-95274d0612a0", "comment": "Malware payload (zgRAT)", "value": "4f17ae42ec9072ad980e3a141e0de8ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745942, "uuid": "31922a8c-76be-4bc2-8a3e-a5a47116b405", "comment": "Malware payload (zgRAT)", "value": "20b89a8296a96e52a88a481dfcc75233cc55a800eda489ff0a3adc978dba3c82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745942, "uuid": "1712249a-ee23-4165-a1de-b484b3c1bc9f", "comment": "Malware payload (zgRAT)", "value": "eefee2367bff4605a644a6c5971ec72afd0a1298", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745942, "uuid": "721b3bf7-0339-41e2-abbf-8d4af35d00e6", "comment": "Malware payload (zgRAT)", "value": "299ba290f71efe6217c91e9fcb56f9de9d5e3e205b9b243c9f21d6fed416ef410e8fbe93edb441d93cc0c9d196a53f2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745942, "uuid": "97ec3739-6a41-4083-8d80-c81662c4fd7b", "value": "T1FD95338058835AADC4DE0AB88FAED29383F31261B91D1C5EBBD976694F3F74C1637121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745942, "uuid": "4a4a63bc-227b-420b-9b23-72377c72fa78", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745942, "uuid": "74d54850-5ca2-4d4f-8e83-597dc1a89241", "value": "24576:SCPOY+YZtr7iTac1Vqb8AGwJUHa2tZ3HNBRcDfGETf3XOiTX5ajXKoydFx5J5aSP:SCPj+Waac1FAq1HX6DfGETfnNXkb2rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745942, "uuid": "0089fd17-78eb-4775-a5d0-036793b55959", "value": 1942528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745942, "uuid": "3430e02a-1853-4ed3-9994-5128be384946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745942, "uuid": "c2df4a0b-9435-410e-b7bc-d0c56c829ff8", "value": "4f17ae42ec9072ad980e3a141e0de8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81fa93e-e4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710743383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743383, "uuid": "8d83ef6e-7a3c-4479-834d-797504007566", "comment": "Malware payload (Gafgyt)", "value": "6fc8f6f9edaf4ab3f56f4a131744d2cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743383, "uuid": "417b0e56-d0b9-4d84-af54-127f3d6618e2", "comment": "Malware payload (Gafgyt)", "value": "210012f56a0d687d718de65b8630ac9c48d508287dd48222989bfa3b64208c90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743383, "uuid": "95559f6c-0c91-4d60-8e67-a93c7e05eeaa", "comment": "Malware payload (Gafgyt)", "value": "fc087b5e99a7fa9de197282eb9877cc289922c35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743383, "uuid": "5f816e77-64da-456b-807e-ca0e7344bbc4", "comment": "Malware payload (Gafgyt)", "value": "89ae5627815347c9ee6cf8b69abc72b2bf355fbcc97dcfba351ecfc437fa5caee790955410f0d1566a5dd690badf2569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743383, "uuid": "addd782e-2622-406f-82fa-72cc0954ac9c", "value": "T16FA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743383, "uuid": "84da8987-23f5-43a6-ac6b-efc02fc29ca9", "value": "1536:xfRuqNM5h7t/RiRt4nAphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRzphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710743383, "uuid": "f6882e37-f8f9-452f-a575-30df78abd228", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710743383, "uuid": "ffe6582a-fe41-42b2-8442-2759883de00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743383, "uuid": "a5a71132-78d1-4cb8-8865-30619a2796d3", "value": "6fc8f6f9edaf4ab3f56f4a131744d2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fba990f-e53d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710776145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776145, "uuid": "b3c3c0d5-87f4-4ae3-876d-0bdf2191e26d", "comment": "Malware payload", "value": "16dd44b07d4d8a44f6433b24cb5f1654", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776145, "uuid": "3baf71e7-8bf6-48cc-bf5f-57375290355b", "comment": "Malware payload", "value": "215211a9fcdb1adb86e4cb140081975fda6346dcd41e3563cdaa56e50a80e32f", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776145, "uuid": "76f30ab9-af69-4b69-9ed9-31c3813a00ad", "comment": "Malware payload", "value": "c5f0b51dfdc2c81562e287c57858bbf4bb213b8c", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776145, "uuid": "6a01994e-ff0b-4d50-a4dc-707896c3be23", "comment": "Malware payload", "value": "c381db07851085804fa00b1fc1297876c68436b2461a527f7ed169aa865cfb66507882677e8a4795eea97d399c2bed95", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776145, "uuid": "f3499fbf-df79-4181-bfe8-f5f45f8b098d", "value": "T1FE024C45AF83CE2B95B1BE9AAF8B0D018AA4905DD0772441B580075F20CA5F572BDFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776145, "uuid": "4433c753-3435-45ef-b7ee-ef761f397394", "value": "192:bva0/9gBNxSKSVc17p3MHE3DqZGEY1j8y9j:Dx/ixkVcXDP7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710776145, "uuid": "3639efb1-b518-4f74-9c3c-238f37b51c61", "value": 8275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710776145, "uuid": "c74b50c1-73f7-4aa2-9507-eb662d0b55df", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776145, "uuid": "99930f73-566b-4760-b325-3058ac687f9b", "value": "Vansire1r.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82910e6-e506-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752778, "uuid": "33801f4b-8f44-4ca5-93ef-67eeac354be5", "comment": "Malware payload (Mirai)", "value": "a837a433bcfaf35b4023d37f73671025", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752778, "uuid": "70a2015e-03cf-412d-95cb-458aefb71cbc", "comment": "Malware payload (Mirai)", "value": "2171e582cfb1c19555d743d0e8ccaed4b5e7171395b7ea3d63b39708271bd63d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752778, "uuid": "631dd7ea-67f5-4ab4-af45-66ea9efa3e46", "comment": "Malware payload (Mirai)", "value": "ff7cef9b9b848d843f71fe299ebea9fad0097228", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752778, "uuid": "be85136d-d53d-4615-8a54-7733fbb7bbf4", "comment": "Malware payload (Mirai)", "value": "6c17ae0ace00d22a524a99b82d5bffc628df281637bb8d97c522b368b5c1f0bb5996536412ada80ac2f69d88dfbb4e90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752778, "uuid": "427ef27d-7540-481c-a81a-868fd51f4b19", "value": "T1F2D34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752778, "uuid": "e0343b32-f84a-4e35-9484-dd9d3f025452", "value": "3072:ZgauByoyut54A57i5tmFz7rRUQ0IqBDHUAYM/9kAYj:mauB3yut54A57gmFz7r2QIHUXM/9zYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752778, "uuid": "b3636b7a-c5cf-4fae-959a-0fa1f2908646", "value": 136306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752778, "uuid": "c8ffcf45-e961-4ee9-8991-a39ec7f4cdd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752778, "uuid": "bbb37116-6c4f-4fe5-b17d-b5a83c518f57", "value": "a837a433bcfaf35b4023d37f73671025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc297b54-e54a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710781991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710781991, "uuid": "4647d71d-3efe-43ba-9c4f-ece899055ec0", "comment": "Malware payload", "value": "d25a792939751a5161fe34210c0105c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710781991, "uuid": "6e00912e-ad5c-4dc3-aeb4-8b5730649cc3", "comment": "Malware payload", "value": "21dd50d1d9cd20194952310152af7ab896a1d2cd6707548f23942a860bed4e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710781991, "uuid": "e99dc842-44be-480b-90ed-f45a8f551ad1", "comment": "Malware payload", "value": "b16dc041aaec1fdbce351640aeaae708e223c13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710781991, "uuid": "24282c12-3e58-44e6-ba85-23be55e9c4da", "comment": "Malware payload", "value": "281f04bc402b33dff679c894f59da3fc280a9b06a75c682af5489555a0d5fe4e9f5cdcd2eb08baa5ec5a10203348d9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710781991, "uuid": "bd8baf32-1c11-4b95-9a54-70a897ca9b76", "value": "T1BD767B07F89555A8C5EAD230CA769252BB717C880B3037D32B60F7B92A73BD46E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710781991, "uuid": "06c72702-916b-4e51-a07e-79495f725af2", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710781991, "uuid": "97ffb4ec-2d3a-46e4-80c5-4de21fab3eaf", "value": "98304:33F6+czh4i2rjTEfzlCr4ZPMqpmzbcYIDYY/VXU:H85f24tMqpmEhD3dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710781991, "uuid": "ada845cd-ebcf-4b2d-869c-ee29ad90edf4", "value": 7139328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710781991, "uuid": "e9792a05-b1fe-4e1a-b3ae-c4a11b5fd5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710781991, "uuid": "ae8c60ea-efe8-42d8-97d6-639e14a54f28", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1993e383-e4c7-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710725427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725427, "uuid": "040fe149-05d4-48fa-a03b-e2aa3bc991e8", "comment": "Malware payload (RiseProStealer)", "value": "76a40ba1272e483cdebb46af89c083ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725427, "uuid": "b39da7af-6eb5-478f-8805-3a81f683e2fa", "comment": "Malware payload (RiseProStealer)", "value": "223ca31f57ae2a9b8a4cd1e7eaa6c9b9d5506e8d6ab53e56ec976bf88465a39e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725427, "uuid": "8e5cdebf-7e2d-44cd-8514-82558b359c76", "comment": "Malware payload (RiseProStealer)", "value": "3206ff7f204e001e194ad988cf08bcb5d4cd31e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725427, "uuid": "e8cf508b-6cf0-4b12-8086-448b508fd8e3", "comment": "Malware payload (RiseProStealer)", "value": "f0171042b594276c4b082681270ecdbe0377af14756c4206aca2519033f9b93a39a73d2205aced178e41e5e816b01bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725427, "uuid": "bc6e1a36-ac5b-4b34-bedc-335cc4deb006", "value": "T1EBE56CD2B49873CBD48A2B74D427DEC2685D46F9472508C3996CB4FE7D6BCC026B6C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725427, "uuid": "e6082ec3-8110-46d0-a46f-aa2197fcc24f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725427, "uuid": "deeea18c-fced-4e19-ac91-e208fb0680a5", "value": "49152:dXN3u+RkDMYW0p/+TXLpp344216ZWcBwl6w/tibDmrVTSr:pUTVF/+TXLpp3442AFu/AbGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710725427, "uuid": "7dbc33cc-8d61-42c0-b876-dc324d2f6e39", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710725427, "uuid": "596d41f0-f3a8-41df-9718-de5686b14323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725427, "uuid": "07545078-b82a-48a4-856c-98ed66a947e8", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24885.25657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe87ff18-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710761889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761889, "uuid": "bac628e1-0647-4fe2-ab5f-988ef98f8de3", "comment": "Malware payload (Mirai)", "value": "819e006d2244e91925176b8b07c03b2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761889, "uuid": "5b63d581-fdf8-4014-a5ef-26f30be12c1c", "comment": "Malware payload (Mirai)", "value": "24575625452129d85e668ea7d497ac01103222eb57121d796b3f0f17f9f455c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761889, "uuid": "fe022b23-98ac-406d-947e-725663643a02", "comment": "Malware payload (Mirai)", "value": "19a54de02fb63b651c1612e39f0908391c05057b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761889, "uuid": "20110b4e-c653-42e5-a15c-2666ab1327b3", "comment": "Malware payload (Mirai)", "value": "5c07acbb4b2b76d264c73305ed4cd9d0589f7a9eea129ca6936c7b817fbbd5a946462b0a1cefa7b0b55ed41b3b233f65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761889, "uuid": "7a4f828f-9364-488c-9b6c-cee7ad62b8b3", "value": "T17611CC27EBE35E6BCC940777CDDBA750A322BA48828DF913F35612120C2F6159F26086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761889, "uuid": "331b8401-a4a0-4241-ab2e-7b7f98b42df6", "value": "24:tElC8taDEMwd1q0D+FF+i7DDIdHTP7TJIbrNfep:tM5aDV5F+UnCIPNmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761889, "uuid": "dc9f6b04-8ab3-40b3-a628-bb28e086a580", "value": 1072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761889, "uuid": "5bc220c7-0321-482a-8643-aae710fec891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761889, "uuid": "2dd2f15b-e295-4b8f-afbd-7f3c0ad033a2", "value": "SecuriteInfo.com.Linux.DownLoader.523.8624.7909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f238d472-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741682, "uuid": "1000d7a7-26e5-4049-bb9d-c4ba32f62b0c", "comment": "Malware payload (Gafgyt)", "value": "cc60ca662a6471ab6e1b63e92a0414da", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741682, "uuid": "a41c1169-4696-41b2-ab48-acd9ba409b84", "comment": "Malware payload (Gafgyt)", "value": "2492506b4c913d13b1f07c8e646deb49efbdb43b109d6cd53d306a83563c7816", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741682, "uuid": "c3495b5d-9808-47f5-bff5-f7c6308dd68a", "comment": "Malware payload (Gafgyt)", "value": "325679503fca23f0b0f287cb755e5f58a8a1e517", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741682, "uuid": "5720fe4b-9f4f-4176-8cc0-4bb4c1f970f2", "comment": "Malware payload (Gafgyt)", "value": "7fdf5850ddac7e0b4263969d909bc0dc85d6dbafd37206bf420607a4765dcda83cef182e2f0efb5e041f60f4d88987c8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741682, "uuid": "eae787fd-4f25-4f5f-a541-a2a4005df396", "value": "T1CAC33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741682, "uuid": "4df7db51-0d1f-4bc3-a2e3-4ffd2d1d5281", "value": "3072:idwracAAviNmLpMQ1xL5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxL5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741682, "uuid": "2a028d9e-0c1b-4b49-afd2-9ef683731d43", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741682, "uuid": "7ab740cd-e5d4-4bf2-9ed3-8f598e78eab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741682, "uuid": "8bbe77d2-779b-4df7-a6b8-d142e8918f90", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9a2559-e4de-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710735611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735611, "uuid": "72a53ca0-6419-4ccb-ad83-bb2a77b9fe39", "comment": "Malware payload (RiseProStealer)", "value": "9ec4f90795990f9cdc212a8aeb1d4950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735611, "uuid": "ff1e5239-96d3-497c-a4f1-1d07ccbac4a5", "comment": "Malware payload (RiseProStealer)", "value": "255f81a760ca5f92ba93273cd332bbc9d17e3af2e706d301ae5a9980b8ae24e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735611, "uuid": "942d2062-5fb6-46e2-9b33-8bfaff36c9fb", "comment": "Malware payload (RiseProStealer)", "value": "95aa87b6a5ebc9c28c22eb7322dd56925964c83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735611, "uuid": "abca87a0-f9bb-49eb-8be7-f48d2a5a8967", "comment": "Malware payload (RiseProStealer)", "value": "77cef00b345e5efb7fcb785774ffaafd867ee8cd2c471f0b99819dbfa9ee3a4a0659d4c119449e8e8b46330aa886e2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735611, "uuid": "e07a31b6-e3a1-4dc1-82f2-45551f474e54", "value": "T1E8E54B62B40879CFD48E22789467CD826D5D47F9471088E7A87C78FEBDA3CC121B9D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735611, "uuid": "95664b38-15bd-4b32-90e0-8455ea7a9a68", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735611, "uuid": "e010aca4-e2bc-46a4-beab-bce75c127a10", "value": "49152:hDPPBnOH3/nkaafC0XWtzeh+HmlMwKT6ghYnMqe:FPc3Poq0XWtzehqmewENGMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710735611, "uuid": "d4985456-9c10-4f19-a8fe-e2acf6e445bb", "value": 3220992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710735611, "uuid": "55e94b33-e8e0-4185-a7fd-e61cb8d99770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735611, "uuid": "96a8cde3-7735-4c12-add4-01e2db2ce37d", "value": "9ec4f90795990f9cdc212a8aeb1d4950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f77e335-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710760307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760307, "uuid": "c82245c3-0064-4241-86f8-6d641fe91d60", "comment": "Malware payload (RedLineStealer)", "value": "50dc0b1a9dbe1bb035c7cc37a18bcbdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760307, "uuid": "3e91fb6f-a99f-47c0-829f-fd6a09e249a2", "comment": "Malware payload (RedLineStealer)", "value": "25b63b3a026c90ec93761d36942c35359bb0be3ba1a8bd3c850719cdeb3a8ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760307, "uuid": "96cd0bed-2ccd-4b32-99e5-a7a767ac6dcc", "comment": "Malware payload (RedLineStealer)", "value": "091b15eebe735fbea53952a4a1b41aa0fd30f3a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760307, "uuid": "cd703039-94ee-4bef-b103-4c8cde1c05d2", "comment": "Malware payload (RedLineStealer)", "value": "6823156c22ed3da6811f49c8e0d6461aec3f9d8f07472a55429876651b340e6881bec60262b06d923cd8106944cd9a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760307, "uuid": "05405d75-7ffb-4cc7-8aaf-09c8966c4afc", "value": "T12845C0137BC58039CAA226F19E3EF795562D6D3A8315E29B37C43A360EF15C12B25723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760307, "uuid": "86d2aa50-ddf0-4359-bbd3-8f7e4f0df813", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760307, "uuid": "af5d2717-38f9-40ac-ace8-efec25698f84", "value": "24576:oRmJkcoQricOIQxiZY1iay8ib9RqK98LqBfDZoM:NJZoQrbTFZY1iay8ibHqK98LofVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760307, "uuid": "eb314dbd-3d6f-40b6-afbf-7c6665dff763", "value": 1169687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760307, "uuid": "f00a118d-2a62-4a3e-ba0b-e89fbfca7349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760307, "uuid": "5ca40296-d596-494c-be7a-07423e6a0ae1", "value": "25b63b3a026c90ec93761d36942c35359bb0be3ba1a8bd3c850719cdeb3a8ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71f8f9b-e4e6-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710739006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739006, "uuid": "3a00abb1-f215-40f6-953b-58b1f1fa65b8", "comment": "Malware payload (LummaStealer)", "value": "816dd8b601ee365db21c9ecf3b448098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739006, "uuid": "5c4f0c8f-1e64-492c-ab99-36b45946cb3b", "comment": "Malware payload (LummaStealer)", "value": "26abd887a2ace236890b4d89a2fc7f3499609d885f1f314afa8b8e4542d15dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739006, "uuid": "459538fa-b969-4cc2-86c4-2e7476075a31", "comment": "Malware payload (LummaStealer)", "value": "1555712d7f56f64a7c8c5076ca67022a2a140103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710739006, "uuid": "ca3a701f-259b-4173-af69-cd426c8b17c1", "comment": "Malware payload (LummaStealer)", "value": "41abfd45097414485f71fecc95feb7f2a132e3a1dd3dc482f12077b2526ec47b61f61977e25fab2e8c879884cfd57fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739006, "uuid": "b2c1b986-efca-4d28-bd75-28d8727ab4c2", "value": "T15CA4BFE4527BCA76DBDC03FC60626A0197BC4A85DBD3F708981448FA8C16792D5239FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739006, "uuid": "6deeed14-133c-458d-8bb7-10a4ea7be3ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739006, "uuid": "9d8e855a-1113-4ee6-b77a-bb48233a1a98", "value": "6144:4hl6C8zKLhxs95ewR//TEGxCHZheI+h3FfMKvvuA3gmLh/3DCAMWTrB:4Dz1xUew5KQtFfzxgmLh/D/RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710739006, "uuid": "73cfc1cb-7cee-4cc2-b866-8e595a0655f9", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710739006, "uuid": "4ceb004e-228d-4f09-8a7e-5ab203b49b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710739006, "uuid": "e3bf81e8-286b-4357-85d3-fec900721e5b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff971eb-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710757784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757784, "uuid": "9e963c67-d2d8-4c09-8d10-7117ef17d5b7", "comment": "Malware payload (AgentTesla)", "value": "ba1edecb30690e596d931cf8c1c6662e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757784, "uuid": "f5baf62c-c58b-4214-9371-3b3cac92520b", "comment": "Malware payload (AgentTesla)", "value": "275f0215c61c0ac28c4da0e355f33fabdf5709dfc46eca4249a76f7925805030", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757784, "uuid": "15a03345-df4e-4bf0-b2c4-0524de7c081e", "comment": "Malware payload (AgentTesla)", "value": "013af08233848b25a7a03c04bafb61edb1ccd607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757784, "uuid": "c589c008-461b-4001-9918-bc4a12927660", "comment": "Malware payload (AgentTesla)", "value": "98a8d1191f9834a755b6f0465de0bae2d512c60227b6987e9657afc0325ee103111ba376698627c1600effed67eb4d62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757784, "uuid": "bbf8caa8-8608-419f-bbcb-e0d8fd9adfad", "value": "T1C9D42360327DEA60C8ACB2FA64EB550243EEF1C18946F778AE486744BB17FC4D541A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757784, "uuid": "a09fe77d-6b67-4eaa-a19f-973d90885cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757784, "uuid": "32ed7379-5df8-4f9e-8974-fe3b312f3e58", "value": "12288:TWvDUdCU/ng/wNE5s3KEPDnrLePB9UYWYiXgRh:SvD7U/nq++saCjgB6lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757784, "uuid": "59c44cd7-b4ea-4bf2-9138-ac2fe748f008", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757784, "uuid": "8091ec6e-60ed-4519-9d3b-5b87c4120502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757784, "uuid": "aeb846af-9abf-45e8-a391-b18f76f01fec", "value": "TUBITAK SAGE TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc292bc3-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710760543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760543, "uuid": "a511f39b-67ef-4a1c-ac68-ee85b17f3c43", "comment": "Malware payload (AgentTesla)", "value": "5f460f10630cbaaa64354b7122aecbf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760543, "uuid": "af5d9109-74a3-49ed-8de8-4ef15dc2602d", "comment": "Malware payload (AgentTesla)", "value": "27de1b93d393256db83dc9c4c0cb85f821edee6b11fc68c19634916c62c51197", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760543, "uuid": "190db273-055b-4474-bfd9-30b459edbe71", "comment": "Malware payload (AgentTesla)", "value": "ae5c5bb7f34705200d77861771c4f0443b3808a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760543, "uuid": "aef7d554-381d-4198-80a5-b2cfa66c9af5", "comment": "Malware payload (AgentTesla)", "value": "94990dab5b757d34e9763ebdf939c19b54e35fa7f95478eda5c2791b1389c39943baeaf9269337fd773eddd9927c0fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760543, "uuid": "966b0a98-54f9-440c-bd3c-b10280117b65", "value": "T13835BF02B381D062FF5B92734F66E6115ABEBD260033A51F139C3979BE71162163FA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760543, "uuid": "605bba49-3d13-401d-b0e6-f2e2d2c7128f", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760543, "uuid": "ee382f2d-7870-4605-899d-8edfd10671af", "value": "24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8aOOSIicQ+tZOhFp40UTtJbnJ:+TvC/MTQYxsWR7aOOSIbt4h740U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760543, "uuid": "cbe69308-1fb8-4597-90ef-88c1816e915e", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760543, "uuid": "ed6b2b78-e20f-463d-b96e-6ce8067c4f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760543, "uuid": "852f83de-0081-4a27-9494-60c99e992b0c", "value": "27de1b93d393256db83dc9c4c0cb85f821edee6b11fc68c19634916c62c51197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb31061-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757884, "uuid": "268bd2c8-17bb-43b3-b88e-f0e8867e3573", "comment": "Malware payload (Mirai)", "value": "39d21b91666d4632b0bcdaa788c43d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757884, "uuid": "95c20904-31e9-4580-86bc-aafcf16beb86", "comment": "Malware payload (Mirai)", "value": "28f6f060ca4c6f55e6dc54030644cabb32edcd98a25944ce730d93faaddd65d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757884, "uuid": "62299a18-3ed1-46af-9d22-4d287d5965a0", "comment": "Malware payload (Mirai)", "value": "4b762c6f38f87517899df27ed4e4f956f1bf4c01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757884, "uuid": "7a5c3152-28ed-470f-8d29-1176d3697469", "comment": "Malware payload (Mirai)", "value": "314c250e799416bcf197e4c5a40499b5960c6f2cdfde0f4d8d48df4cacb458d4f4b2bcbb5040278d915be4cecb9b7d1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757884, "uuid": "9b24d963-12b4-4834-87f3-b8a346a4c52a", "value": "T19E534B41B30C0543C5A25EF0363B27E1E7AAAAD222E4F689750FE749D0B1D339546ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757884, "uuid": "120df08f-d6ef-4fbc-b7ca-a68fdea5d8e9", "value": "1536:SwdhoapNT1M5y8t3X6KrPM7AYIkIgiGptr:Sk7Tr8t6Ik0YIxgLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757884, "uuid": "757c80aa-dadb-4b0c-ab1e-85c6ce4b07ee", "value": 64152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757884, "uuid": "329dfb38-577b-4c31-9356-ed0744523279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757884, "uuid": "7850958d-823a-4e57-b2a7-1c5c3e43b57e", "value": "39d21b91666d4632b0bcdaa788c43d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064d0ce7-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779941, "uuid": "d7faeac3-b76b-4a3d-83e1-b54bcfecdacc", "comment": "Malware payload", "value": "8858f4e012d6f7067ccf2b14ae404b11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779941, "uuid": "87f46f55-fe93-42da-887a-7c06517ac851", "comment": "Malware payload", "value": "295ab464ee42d6154dcda22b97c1b2ad5f1b93bea591005f41a91cc554437d65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779941, "uuid": "46900e10-e53c-460e-86cc-9c6cbe4765d8", "comment": "Malware payload", "value": "c1161250c581aa30dafa71baac12df88bfb1d7af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779941, "uuid": "6726f5cb-4ec9-4742-9b2c-a4e9ee8626b6", "comment": "Malware payload", "value": "0ea261b88f4fb20565034e912037b5bd34029fe13585fbf0966a7ddeee3c383b59de33fb5c0db0af1367849d3feb0edb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779941, "uuid": "72839c98-c34c-4e81-b7a3-c9d96a0f7a6e", "value": "T1EFA4E009915E2A0BC346F4787AB6E7109656FB3422B9BF227356CF1CEEB511CE812352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779941, "uuid": "d93d42cd-dea0-4cec-9e75-0fc488d6c039", "value": "3072:5LXEfF1CLoL2IfnjwBEClJDCryse98Ipzgg/P68OC3VQHwuHGB:RUfbCkLLfnjgZjIyse9tzgg/PiwyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779941, "uuid": "9e456ad0-859f-46d9-b8ff-17da518d96fb", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779941, "uuid": "0ad48485-7968-4cd0-97c7-a5cca6d0c925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779941, "uuid": "6fb9e9ff-7c96-4cc1-bf75-87d449ee133c", "value": "SecuriteInfo.com.Trojan.Tracur.97.5304.28137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988cbe13-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710766013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766013, "uuid": "afdfada9-663c-467f-851a-d0980c4d4fc6", "comment": "Malware payload (Mirai)", "value": "ae1b513a76ad913a7002229913c5ebaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766013, "uuid": "7ecc1d85-a6d1-4854-a6ec-fba6f264f07b", "comment": "Malware payload (Mirai)", "value": "29b0e1c0df16a4c75cc6b69a0f56af513f5beb8a368a4ed8af4f071146ed80ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766013, "uuid": "976add8f-54c4-46a1-a22a-6f57879fa05b", "comment": "Malware payload (Mirai)", "value": "c5b2d7784985c6fa67be29919a0be28f7682cb65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766013, "uuid": "3e2b198a-6b6a-409d-afbf-7083a660d0f0", "comment": "Malware payload (Mirai)", "value": "96710f9c05e69e4a21a7268d86da98bca5763da5bc3480d88b5fde36ff30a5f980e0fed0d9a037745a47d63d58818999", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766013, "uuid": "2b6fe69e-0dcb-465c-b49a-2d46fe9bc6e0", "value": "T142231995B981AA06C6D543B7FE0F42CD3726239CF2EE3213DD252F513BDA92B096B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766013, "uuid": "71f0e7d9-e602-4047-8828-59f4c1249c45", "value": "768:TlvAz5gYFdzVpj7/H8e18VJDCtAlDT5UW2aN2w6oSbV18h63lcflVjrtD6tOqnJ9:xYvdxpjbcd2tAlhUU6oSV18hElGVdTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766013, "uuid": "e84fca42-8b30-4f3f-9f24-5c27dfc769cc", "value": 47524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766013, "uuid": "f5fcb22c-bb7b-4c96-8f42-fb423426e5d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766013, "uuid": "2617b416-c436-4774-9070-da01a1707fb7", "value": "ae1b513a76ad913a7002229913c5ebaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0736e1-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752409, "uuid": "e988acc5-c078-4a6c-85ea-8538dc8c4c9c", "comment": "Malware payload (Mirai)", "value": "7787854f14dfce9297a29bae842382e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752409, "uuid": "b9df24f5-e28e-411c-8c56-60d032282db0", "comment": "Malware payload (Mirai)", "value": "29b78bb68ae1a4a1463e28775c00d66b70c848964803b20a91c068ffc10a5d0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752409, "uuid": "b80e3b9f-96b6-433e-ad5e-7619ce0ce30b", "comment": "Malware payload (Mirai)", "value": "afc4e940484824d20b7e140debe6708aae01dc50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752409, "uuid": "d5f4d85c-8372-4348-b87f-81c976757f57", "comment": "Malware payload (Mirai)", "value": "41863f458cd07b82952a8ed5bd4dfeefebc25d03d61437810fd62693d87a73cb57442d02256f708cebba95e247f0bd1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752409, "uuid": "da60a9bd-f9e8-422b-872b-2144c7394321", "value": "T1AC33020AE9E26DA28DF9623DCCADD1CF85FA15D0E5E052486128E714EED630D15FC2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752409, "uuid": "bd020b23-c4bd-4660-8be6-796a6afbce63", "value": "1536:xk5g/E31PjsjYVyaCeDTbeP3hxwr0yzz9:250ANDWvnwr7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752409, "uuid": "1edf2433-9e25-4afc-8d96-365b6e502580", "value": 54044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752409, "uuid": "76e55ec8-afdb-4e63-ad2f-81cb7e656ce8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752409, "uuid": "c735a415-40f4-4095-97e7-3fd7da06c5bf", "value": "7787854f14dfce9297a29bae842382e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4e59cc-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710761887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761887, "uuid": "7e825f08-06af-42f5-b48c-a8020af6b12f", "comment": "Malware payload (Mirai)", "value": "8a48952abaef0783c9082702689cbdc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761887, "uuid": "41ae8bc0-f6af-4495-aa5e-fe3b8bb63e45", "comment": "Malware payload (Mirai)", "value": "2b02fe3baac9439334197dc27d2a5efe49d176cfffaac30dc21669918ee9e8e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761887, "uuid": "deee1f77-cd61-445e-b646-13a734a51fe2", "comment": "Malware payload (Mirai)", "value": "8a54a0c711ad64eff9d1e93bd9915e03d4eb6f0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761887, "uuid": "3523f57b-5323-4341-8b59-f363ab5a0cd6", "comment": "Malware payload (Mirai)", "value": "17793070156efa3d766ef619c0d15d984737e0e92153cab68d041925f0442475d527afce97dab4b6b2a4a2a952a18b0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761887, "uuid": "ebeb720a-9375-47db-9dac-5ecb13be1774", "value": "T19241E10A5FC02F33DDB6CC36468B17522ACC942F616A33566278E964BD3E60495E38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761887, "uuid": "c5513add-b2da-4821-9258-67bad67ad871", "value": "48:iPs0T7YouDjou6df94eSsTL2Pk+T3LOOnp:iDYouyf9xSIL2bT3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761887, "uuid": "e6a5bf6f-59b7-4ca8-9d9f-4b0254059557", "value": 1904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761887, "uuid": "d01558cc-2fb1-434e-877f-477e25d71656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761887, "uuid": "951c0589-6778-4af8-93d7-3ddc937e5a80", "value": "SecuriteInfo.com.Linux.DownLoader.533.8932.29658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a432b4-e519-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710760765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760765, "uuid": "165306fa-c6cc-4865-b31b-a0ad6c9b91d9", "comment": "Malware payload (RemcosRAT)", "value": "38d3e6dcf4ee879abde67c70b05f7a9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760765, "uuid": "7cd37df9-d367-4d56-a54e-7f93d885af66", "comment": "Malware payload (RemcosRAT)", "value": "2bbc0e3aaebedb1d1eecbcb357dc51562294e2b73ab8fc77c87a0942fb5760c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760765, "uuid": "9a2a9f62-39ff-4c58-83a8-386570308884", "comment": "Malware payload (RemcosRAT)", "value": "a194f689063b601cfb8d52fe1af55481ddca0a5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760765, "uuid": "46fc78a9-cad5-40e2-90b0-c67e383c5884", "comment": "Malware payload (RemcosRAT)", "value": "10e1c3ad68f54c6f76a1c918d771602589b6236613d7a7c63a33e62f794c5b98bb4f3e40ba574aa9dd805ff84404993e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760765, "uuid": "b4f2c91a-3628-4c58-87d9-4d42eba0d5f0", "value": "T1D155D00373919022FF9B91334F96F65187BDA92A4127A62F13981DBDBE700B1463E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760765, "uuid": "498b767e-51fb-4704-9220-c6be5865ca3e", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760765, "uuid": "f4f3ee14-a215-44a6-b346-a816e695e0a9", "value": "24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aIvtiwhfLSogicI+y/gxtHVH:/TvC/MTQYxsWR7aIvD0o0/Dx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760765, "uuid": "32b4dbd9-8180-40aa-bcfb-940797211d0a", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760765, "uuid": "06f8262e-bdb7-4fdb-b28f-c57bc7b63b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760765, "uuid": "51c6f9d3-f6e1-47ab-8a46-73a95b850476", "value": "2bbc0e3aaebedb1d1eecbcb357dc51562294e2b73ab8fc77c87a0942fb5760c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3779d0b-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710767829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767829, "uuid": "db609dd6-20b3-4a1e-ab0e-d6bf1508cdbe", "comment": "Malware payload (GuLoader)", "value": "8a1422827315b9db63cd6b399a454fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767829, "uuid": "d74685b9-ffe5-43a7-9315-4375aed7e2e4", "comment": "Malware payload (GuLoader)", "value": "2d49a4fcfdf17af26d78ec4eea4eb75176ab9918c7644855d4d80454ce7382c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767829, "uuid": "d80fdf60-9876-4242-a6e7-d2c8c96e95d4", "comment": "Malware payload (GuLoader)", "value": "235c6e8149097f00ac26e70b0022c7b5a2f49c1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767829, "uuid": "cd5a6dbd-9b98-4184-876d-3da7482708b3", "comment": "Malware payload (GuLoader)", "value": "70b5fb7383df5f3bede02007c0f3c53f0b34071f0392954c8e804bd68910c31048b7582eac3a850c88405fa2dbf35796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767829, "uuid": "10c633a9-4242-4fdc-9100-09659b5ed861", "value": "T18A0523261283A041F9E584F54AD7B336DD70A7D94136EB0E6F751ABA2504B22CF243BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767829, "uuid": "f3ac69a0-fbee-47d4-9a37-f2df53049481", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767829, "uuid": "19bfe74a-1d56-4e76-82f0-939b49000fe8", "value": "12288:nqLWnK6qSn2bcfB/5FsfecOs8c3ObwMB8aqEEbViGCyQRy1/6dzgA6zZxfb5R9A:8WnVD5h5FoFJBoZyQqNbbfNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767829, "uuid": "e1723622-fbb4-4e4e-abad-8c13abeb548e", "value": 800824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767829, "uuid": "911bb3bf-47df-45f3-ad43-d8a84cb6fbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767829, "uuid": "33d33593-b6f9-47ef-a6e6-8a50d403c6b4", "value": "comprobante de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03e2f3a-e505-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710752389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752389, "uuid": "8627583c-a604-4073-97b2-852d37878388", "comment": "Malware payload", "value": "bd2fa2f7fd89d65ffd15ef0d43b81886", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752389, "uuid": "32d9cd31-fda4-437f-8997-23e43bff342b", "comment": "Malware payload", "value": "2d5c95525813d0f2cab5b7b6f3b6a7fe7f67fcfcd25e0f62846c97b9d515889f", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752389, "uuid": "11a53ab6-2bb0-4b99-b346-9ecd58c1235a", "comment": "Malware payload", "value": "45b6be2255a1cf8c106132be71ffac384fbd61b0", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752389, "uuid": "31602a84-a1e4-44be-b41d-2511e53e3da3", "comment": "Malware payload", "value": "a67a461f9989095610d5194e2dea265b2a47e1f9bc5644c0da2b999d2c158cb9c7aa152804b40df1d8c9ac079d3b5607", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752389, "uuid": "fba6b90c-590b-49e7-b065-a82a76927dd8", "value": "T12523F13AE3292940C8F4983C126D1793B986059C8743FA777AC9790D5146EFA33AFD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752389, "uuid": "f0c47f44-09cf-471f-af76-603c6c1ccf2b", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/M:tLq94YV7JMxXyd4x+gzexTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752389, "uuid": "257e45a4-6017-467b-9238-9790472de181", "value": 49374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752389, "uuid": "0447676c-b006-4036-8d0c-822c8144a162", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752389, "uuid": "7c185e88-ee4f-4a2a-84bd-3c4bcb577b35", "value": "ACH-9528-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e05a2c6-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757834, "uuid": "ff1264d6-68a0-45e7-8489-6260dd4332dc", "comment": "Malware payload (Gafgyt)", "value": "5123e5e2835c114febef112bbaa74cd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757834, "uuid": "ed88611f-1e86-4bcb-8ca1-13c0f095ff84", "comment": "Malware payload (Gafgyt)", "value": "2d7b4cbfea5a5f8950a6296d571f323f52a9819f80e25d7e7eb7fe8da08a14d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757834, "uuid": "8ad4cd31-2b27-4486-8155-f9060d4a460e", "comment": "Malware payload (Gafgyt)", "value": "8d06aff4ae2aa9e7acd12d01ac026a2aa57c853f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757834, "uuid": "dc499148-fad8-45a9-b473-b9ff458fb118", "comment": "Malware payload (Gafgyt)", "value": "a543adddfc21e2be4689f06a0dae8cfdb60a30a3d6d359097e60206b6f012745d0799bebcebeecf52f853872b6cdac41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757834, "uuid": "0771badd-ecdc-4c5e-8b25-9e7d24ddf04a", "value": "T140B32805E5508B17C2D217BAFB9F825D37336B68939B33215A24BFB42BC279D1E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757834, "uuid": "b4fe7872-4ec5-4831-91ad-c3f59bd1cfac", "value": "3072:8NEFarEOeq4UgSbrXQJ/IurXtMNm/QTbLX3kn:8OFaoOeCrgJ//7mNm/QTb73kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757834, "uuid": "71f9c584-cdca-4d40-a434-99d4e946fc61", "value": 117197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757834, "uuid": "ba28a798-ae06-4db4-a337-ee54c67dfdc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757834, "uuid": "99e8037f-a99d-44ba-ab86-5aac8491b270", "value": "5123e5e2835c114febef112bbaa74cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd08d58-e50c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710755203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755203, "uuid": "c3acd88d-9958-45ea-ac26-44162387d377", "comment": "Malware payload (Gafgyt)", "value": "39980470a2514903b8eeff419ed9564c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755203, "uuid": "b026ca2c-e3e5-4e08-8500-b32c9ae17cfc", "comment": "Malware payload (Gafgyt)", "value": "2da1641756bb19fff7837079971d4e218ee48d702c0cb5922d9fce9426cf653f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755203, "uuid": "11a533eb-0bd2-4b5a-851d-74e6256a2eef", "comment": "Malware payload (Gafgyt)", "value": "2d74dea06b616fb1eee0680ab924b9ae5ef99fc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755203, "uuid": "3b479172-dd24-429a-b3b6-93a090d5b17e", "comment": "Malware payload (Gafgyt)", "value": "90bdc6ed24607aa648a0ae09ec2348150e19aba555539411473d172f7b4a49dde13c65505b87b8d76235a3c516c70b1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755203, "uuid": "d126956f-dd99-440a-b796-9fcabab50d52", "value": "T103D31857F800CEA2F4099A7601D35725B671EFB70E8321B2A64B3966AE322D53477FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755203, "uuid": "9e613680-b8fe-4eaa-9555-bcdcf1c5dedc", "value": "3072:Wo3hGPzRI4JWdB2Y7Km85yFcH/GRZgq329UnHi1mMqKQiVGngBmk:WoRCOdB2Y7K5yFK/GRZgqHymMqKQigno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710755203, "uuid": "52278a2d-bcb6-4340-a842-75c8f1bebc21", "value": 141106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710755203, "uuid": "09092428-a74a-4c99-846c-4de61bcbd456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755203, "uuid": "6f407773-de80-4557-9c11-30c1c5bb95b6", "value": "39980470a2514903b8eeff419ed9564c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f89e63-e545-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779865, "uuid": "568725d3-fe4d-4eab-a960-5a96eba8f607", "comment": "Malware payload", "value": "87fb1af534b0913bb23fe923afd34064", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779865, "uuid": "370408ce-1e12-4b6d-b2b4-06029978bf28", "comment": "Malware payload", "value": "2e3645c8441f2be4182869db5ae320da00c513e0cb643142c70a833f529f28aa", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779865, "uuid": "c265447c-e428-4c5d-a582-1f587b0b54da", "comment": "Malware payload", "value": "8d4770c418ae0e99fb4d5e3c70d3cbe15e45602c", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779865, "uuid": "54a20956-2eb2-48bb-9ef1-30093b5e3bcb", "comment": "Malware payload", "value": "246ee9c057bfdff19fef6cce76a15efdfd1e63235027fb206ff2e0f7db1741b0fa9860e0628a905b3230453004fbf036", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779865, "uuid": "83050433-e73c-49b0-946c-7e9299e4902f", "value": "T17C638D127692C036E05219308CB4E7A25A7FBE630BB585CB7BC406BD5FA22D15F39367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779865, "uuid": "1d27e809-1cdf-4c47-97cd-f3e2c0e502c9", "value": "79ed833f90b585ce7dfa89a34d1b1961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779865, "uuid": "4132d76a-0622-4736-af7b-c2e5dc76a7d3", "value": "1536:L+ClFQO4Iy3SpaZ8UYOoqH55NJRkqWt+mq:yCkO4Ilps/YK55NpWt+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779865, "uuid": "6c24c681-d2ed-4bd1-9be1-37e855ce68fa", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779865, "uuid": "ba08a579-b67d-481c-a8b1-4b68bff8a629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779865, "uuid": "cf042650-7376-4a14-9ac9-623c1509e844", "value": "svrhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4040bc99-e54c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710782615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782615, "uuid": "6614fb5e-71c0-495a-9edb-992c19f7383c", "comment": "Malware payload", "value": "c667cae395fd34323e7acecbed584db8", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782615, "uuid": "470a8ad8-c0f1-4066-9da4-ce079691a890", "comment": "Malware payload", "value": "2e850cb2a1d06d2665601cefd88802ff99905de8bc4ea348ea051d4886e780ee", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782615, "uuid": "0eb366c0-8614-421b-9245-ecb115698b86", "comment": "Malware payload", "value": "44cf84693216f7a4b44c89bdbffa10e72fbfffdd", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782615, "uuid": "5be8ebea-7b0a-453e-b28c-d545f6d87885", "comment": "Malware payload", "value": "c04d43d069a65957a4c0401701b223447ed4b2deddf46a66c22d47b34cf1dcc77282a43949e1f6e1c395c7229a327bc5", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782615, "uuid": "f44802fe-4407-4daf-9280-4998ccd1d923", "value": "T17FB36C1A32A800F9D067D2B5C9E29A49E3F27C660B7593CF5360439A0F73BD25D39722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782615, "uuid": "633586d4-312c-488c-9485-d97ad477c48f", "value": "4ae770c3d3f6130d918943dc30985e0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782615, "uuid": "52eca16c-1a7c-40b6-adc2-83b7d6fbf8ca", "value": "3072:QghXvOL9cOYqWDHjgT7byoftqQrVI6N/nJIRLI:Qg8JnYRgT7pftq67JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782615, "uuid": "70cf52bf-088b-4fce-8c69-0f7647c61bfb", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782615, "uuid": "f49620d8-3701-4882-a8ce-cf330b3d3c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782615, "uuid": "59900640-3434-4788-ac53-663c78d9835c", "value": "GoogleUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b97a41f-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763655, "uuid": "a0609269-c089-4803-8209-3d3c5102a4c3", "comment": "Malware payload (Gafgyt)", "value": "b449ed9a84a214baa0f67c84f0b82a18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763655, "uuid": "e438536d-0814-4bca-895b-65f86b2d492e", "comment": "Malware payload (Gafgyt)", "value": "2f552672a4a77402b9612ec2b98084d33fbbb583f79579f256920806a81566e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763655, "uuid": "1fb9df17-b6ee-4f31-9f2f-f9d64d321ec3", "comment": "Malware payload (Gafgyt)", "value": "fc760c2f521dcedf375ab4945d18d4946bdc9bc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763655, "uuid": "6044abdb-4bdd-42cb-a74e-467613ba2377", "comment": "Malware payload (Gafgyt)", "value": "e03bc303b68442886bd4daa3cd4977d7b200c9280e53d7181deae0b93e3c2a3ac2e9b5b527d1f5e76685d9e56313d1d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763655, "uuid": "06534765-560b-4d1c-8786-37e4bd8bcb66", "value": "T170E3976D3A11AF7ED26CC2310BFB6F70D35521D626E29355E29CD7481EA038C9C5EBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763655, "uuid": "76f82763-c32e-4e0d-8b10-39df88949cd8", "value": "3072:WyKkFSZ8LJjl5lpKZ5hkF0z8U+3rMsBRTFCj4jM:G+SZ8dBTkZ5hkF0z83rMsBRTFCj4jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763655, "uuid": "f7aeb91a-d711-4faf-bb6a-394b3490bc36", "value": 153077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763655, "uuid": "b1becdd4-330d-4410-adfa-109b20edef7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763655, "uuid": "f37cbae8-519e-48bb-b4ec-1d18584ad1b1", "value": "b449ed9a84a214baa0f67c84f0b82a18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d82b52-e513-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710758445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758445, "uuid": "b93af245-4338-4ead-814f-ef8a66e04a1c", "comment": "Malware payload", "value": "869aa45ae2a322423589e56bc4908ac3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758445, "uuid": "4ba8109a-3e5b-4431-97a6-791b64c94c9c", "comment": "Malware payload", "value": "30235784fba82b023be3e964b389f31c423f353fe26145677032f69c619c4497", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758445, "uuid": "9991f5c6-995b-4b78-a6f0-90353a4f5b45", "comment": "Malware payload", "value": "10258b4ac089d4f4be58bad244faa3cfc33e9e99", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758445, "uuid": "25b6f9ed-1465-47d5-a29f-d4a31b5bd64f", "comment": "Malware payload", "value": "302cf6888727f24da2aeeb8fb62ec251fc4fb4bc7f59c7fc37a14bfa56b1668f42c79c9d3770ae719187bdb3d796a6bb", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758445, "uuid": "902f3652-f373-4c35-a8ec-b2c1f9c70ca4", "value": "T1E664E1E455F2B4EFF6B241B8D3922CFBC26DA840CBDD2E5687B002255A57805CB6783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758445, "uuid": "f321af79-c0bf-4b5c-8ba3-7146aef19857", "value": "384:XR1ozrVHdZamT2FXKL+FXDHUhkN4tvOB5grYMtUbgA1k/5fxqAZgwTv7nw1O:XHozZ9Zae6tsctBYtjA1k/tQcRz7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710758445, "uuid": "bd80e379-98cb-49eb-b7d6-525936f8636a", "value": 332384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710758445, "uuid": "a8dd472c-748b-4697-ae8c-b6979aa07789", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758445, "uuid": "582aedc3-5ca2-42b0-8fc8-7c201aec3d04", "value": "fresh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d5d3a9-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710745654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745654, "uuid": "54e06631-0247-406a-a229-1ed7cb96f4cc", "comment": "Malware payload", "value": "0b6f1b4020ad6ec9bb2308e50ebf6d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745654, "uuid": "770255ef-88c3-4c56-815a-f20cc69d39ee", "comment": "Malware payload", "value": "30352ca2f03b538558d24e5361c4f0f3b6fe85dd2d2a6b7167a511d0d39621ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745654, "uuid": "4631d2f8-a75d-42db-8e97-3726f97fbf62", "comment": "Malware payload", "value": "69c58aecc6c5eba78751933ce682f303c6a74519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745654, "uuid": "33c89b15-6b40-4e61-8d5d-c6be81aca5a8", "comment": "Malware payload", "value": "9d76e34794b48613c0950c56fb33eaa41e30389387a24b70303fcdda3dbdc154e0b75f882c64a5f2a2d3dd2f6ccc58d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745654, "uuid": "49f133cf-4a71-4648-b665-3e8d039a352e", "value": "T154F401AC365076DFC867C9B2CDA81C24EB22A423430FD617965722DCAA0E597CF156F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745654, "uuid": "60efc68b-29bc-429c-9aec-c283aadda4fc", "value": "12288:yHTUBFztgfHoNk6zEyeIiyq/kehsciHoKA71Pyt1yABXKB0uhSYLXz4Yix1aArwg:+ABjBNuyeIiyCscyoKsctEjB0uhSS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745654, "uuid": "82c9b10e-6583-430c-b65f-9e0755e470b6", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745654, "uuid": "a2d567af-7156-4e24-9526-2842796d77dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745654, "uuid": "f82559c4-c708-4c73-b976-aa1e62f492c8", "value": "SC_TR11670000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442e94f7-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710751698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751698, "uuid": "0615d332-fbe5-422b-b5e5-d5c40d32776a", "comment": "Malware payload (LummaStealer)", "value": "ccd1df4af63cf5952624bc1760d4008c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751698, "uuid": "57be7e68-1bb0-45a3-a491-61fcf59df684", "comment": "Malware payload (LummaStealer)", "value": "30a6387c39e499294f7ab0f1b033b39965a9490f17daceb3539bdd409e8b589e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751698, "uuid": "67173457-8e5b-4f70-931a-013610c6777a", "comment": "Malware payload (LummaStealer)", "value": "9d61cb4fa34c541dc2c3dc9e7e3df0b7d7fb382d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751698, "uuid": "175a85c8-717c-42e3-be8d-06ce28b3f934", "comment": "Malware payload (LummaStealer)", "value": "5cbfacb993f8e4c9b65d5219e12f41098e79f0a52921b4bee7072b9db591f4a668e1391c49e19fd05b3a2ce87145e445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751698, "uuid": "038e70e5-1e6e-4b01-bf11-0ea3c881f3a5", "value": "T1EC949C8369D5EC74E46207314E299ADC377F7C669D249B5732843F0E28312A0DEA7F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751698, "uuid": "414bbb2f-72de-49d3-9dcd-69ebbaf76823", "value": "5428a38f0c6440648123ecccaabf4115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751698, "uuid": "cf38acc3-e9e0-4a85-86c3-9adf3dce66ba", "value": "6144:da7i4imvYV17EiM5FF+yYtE8NDFF8Jr1WSrOwQSkHruY:da/LvYL7NMMyYe8NDFFKQSrtQ7Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751698, "uuid": "289d6bf3-027b-43ab-8f32-900ce4a5d615", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751698, "uuid": "2f8a49c9-8f68-44df-8cc1-9fa0ef876dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751698, "uuid": "8d95697a-ce27-454f-b370-256817daa55d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b2d980-e546-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710780314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780314, "uuid": "8f9d8a4e-1107-4e9c-815f-717381fd8ea8", "comment": "Malware payload (RiseProStealer)", "value": "722d435514d169290a526a1309cd1703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780314, "uuid": "151597c8-e83e-4e30-92f1-1b966ede4aa9", "comment": "Malware payload (RiseProStealer)", "value": "30baf54d50379893b23b24203611da331d436dfc35f2d0a805bac4da0d310489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780314, "uuid": "9f664331-e682-44be-8309-ff7da6de1b55", "comment": "Malware payload (RiseProStealer)", "value": "955f04d5f5841b42a8601a22f8be7f2fdbfcd3f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780314, "uuid": "3db4b9a1-a355-4892-8f86-335b7b6ada5f", "comment": "Malware payload (RiseProStealer)", "value": "1a7d5b972194e9d9aa4152dcef7d27a8ae471d52e94c5a4af95f4c4372b73cc2f3ef3cc6cbc32b7e510ae52dfbc1ed7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780314, "uuid": "8d0c7733-376d-46f9-a715-acf53856c803", "value": "T1ABA53351E6E188FAC57423708AEFFB1F28725C6812F05844B61F17E977EA91D63B62C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780314, "uuid": "b4d9167b-72e8-46d7-9820-7f0d6afda653", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780314, "uuid": "848833cd-f896-4798-b9d9-81ee1638636c", "value": "49152:27x9bpL00L5naGrjUN/Hby/H9OpTlGQusfXMv:izbpL3VnaOWjCyGQPfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710780314, "uuid": "2759e6a3-81f6-49a0-8817-1b4527566515", "value": 2092032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710780314, "uuid": "f435a9d6-df67-4cb5-955a-e89ee9c76e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780314, "uuid": "f023a1e6-3713-4b35-9b27-07194e7582bb", "value": "722d435514d169290a526a1309cd1703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72460d47-e526-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1710766378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766378, "uuid": "b4bbcaa0-2480-4aad-8321-1f2d1a719fea", "comment": "Malware payload (Socks5Systemz)", "value": "57bbbec3cc5c3cb8024bc5c7f2999dd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766378, "uuid": "09412de8-875b-4c71-9994-e2b5132ed084", "comment": "Malware payload (Socks5Systemz)", "value": "30c20c68369acf6e0977ae90a4238b3a2908025f08075fc04ffa5f23325029ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766378, "uuid": "9c77b3a3-de9c-4209-85c8-3b24a74f6075", "comment": "Malware payload (Socks5Systemz)", "value": "7eb3c008cd273d06aacdeaca5e35f4d504bdf676", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766378, "uuid": "3cf7cfa6-b944-4785-b5ac-1c8ea6dd7a3d", "comment": "Malware payload (Socks5Systemz)", "value": "7de726039be09cc02bcdc1e071df42d21b06eccd31846eeb2ee8c1f34b8c9f9178ec5252ba3ae47908ffc37dc8b17118", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766378, "uuid": "15783160-8a92-41ce-9b18-04778082a5a1", "value": "T16C953345D9D6C1BEEC6B8EB44903DA044A71BFB035FA6415732D7E1ECB6B6832642343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766378, "uuid": "491cd55c-c834-4924-aae1-763cff715442", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766378, "uuid": "dd503885-72a7-40f6-a4ce-b645a975c340", "value": "49152:321gyyaS3zL8aDEFGqua9cnfUi5xrMbwKJV/:mPyvM1ua9cnh5asc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766378, "uuid": "2dc31023-82b5-4436-aaf7-17b7f3c16865", "value": 2053066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766378, "uuid": "a9a651ea-c2b0-4c1e-b501-4ae1ef1fa1d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766378, "uuid": "72c5e668-dff2-452e-ac90-4d94455cd166", "value": "57bbbec3cc5c3cb8024bc5c7f2999dd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad195a49-e54f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1710784086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784086, "uuid": "0a6361ca-e11d-4808-87ba-828ee36a19e1", "comment": "Malware payload (Socks5Systemz)", "value": "bcaf8584c71483dce5fbdc98436101db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784086, "uuid": "6828fc14-a839-4d00-aaf9-1ca7c70bcdd8", "comment": "Malware payload (Socks5Systemz)", "value": "30d6fbbc596412fc08e1a0ecfa044cc35bc2b7a299601db35ddcd2bd46054e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784086, "uuid": "28c16bf5-f219-4893-b2ea-e624d56bd220", "comment": "Malware payload (Socks5Systemz)", "value": "46cb0d2d1a121d1b45c43d21edf0b5ec83f49742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710784086, "uuid": "2aebf7a6-170e-4212-a387-0317ec30a5d7", "comment": "Malware payload (Socks5Systemz)", "value": "c5e66d2ad8a8d67075df69b91b8ada9e17616b245f80ae44785d39902361d8ae1f1128fa9a623b18ac1704fce3ae238a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784086, "uuid": "1a0ab6a4-4f31-4163-a41a-efcf8150c125", "value": "T11D953342AAC4713EE130CDF45F64DAAE1AA0AD04FBB655C835CC2A7ADF17950B8493D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784086, "uuid": "a1c94240-e797-4324-b4fa-7bb36bc0cb4a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784086, "uuid": "386e5c2b-acf0-4723-b6f3-64af62562c8b", "value": "49152:32TrfK/f9EtaSiEZVRufiUaF3AePmI92cAM9KJV/:mPC/lEEDg3jUa+Y92cvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710784086, "uuid": "bb5446fd-cb70-4e6f-9621-81aa1d52e6d0", "value": 2029503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710784086, "uuid": "9036a8a0-10b9-47dd-aea1-ea66257f3b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710784086, "uuid": "1cbc5aaa-d0c6-493f-baef-cc88ccb7681a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed92c0b2-e4d1-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1710730078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710730078, "uuid": "2cb3c4cc-4a70-448e-8173-f8582a1f5186", "comment": "Malware payload (IRATA)", "value": "6d2a244b9f0f6bebe60b3ece6e54a289", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710730078, "uuid": "0ebc2e70-b011-4b59-98b8-82fbe6bd1085", "comment": "Malware payload (IRATA)", "value": "30ed3d74c98ae9ed141c8ae7a263decef971003199f053bf55676ffe2b1caff4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710730078, "uuid": "b94a251b-1a33-4c7d-b41c-082adf8ae4fc", "comment": "Malware payload (IRATA)", "value": "0a2f59224c58ef6451507145ddf217dba631771b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710730078, "uuid": "534117ff-d8f3-4292-a9c4-020804a06969", "comment": "Malware payload (IRATA)", "value": "1f80caf4fc2337f1e4cac666df1a118f5ceff67d784c373162b3831ab1bd455368711e284d33b078385348ec6b727128", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710730078, "uuid": "80260b14-a1f8-4f26-84f5-cb56198bd242", "value": "T102951243F766985BC5F2D33331741636A4378D19CB43A78A2E487BBA78B78E84B855C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710730078, "uuid": "9b012518-3a46-4fa7-9e94-2381921a16b2", "value": "24576:x/cDcvb6Tpm4AsRiQci7JQBaib5LbX3zj/jEJubhsmqecEZD/INFky6X6XR+XgCi:x/Lb2AZDi7JQMULTr+ub1zZkNFkyvQQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710730078, "uuid": "1d4e4d6a-9ca3-4e5f-9e61-9488648113b4", "value": 2007790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710730078, "uuid": "f8fca5ad-1cc4-4beb-a49a-0680eed2ad8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710730078, "uuid": "308e21af-9461-487a-993f-6254491a5818", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7936bab2-e525-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710765960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765960, "uuid": "bf1a4fc7-5e02-40b6-9ec0-ca11a343a6f0", "comment": "Malware payload", "value": "cec2ccc6c33066fbc0ed9bdf6a1b3ad1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765960, "uuid": "d5586f5f-f313-4f2d-b088-fe341792358e", "comment": "Malware payload", "value": "30f79d6974e8af8b2155478fd162a74bd2884569322218f1dfcf0f9acf64938e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765960, "uuid": "4f503f75-5916-4bc6-893f-b501599b8257", "comment": "Malware payload", "value": "a5f368413f96a85c71dcb8408b00f9299b637be8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765960, "uuid": "4eaab03c-3fb5-4c68-8e78-0997e2e92735", "comment": "Malware payload", "value": "405e131a952914b383ef3f8612b775acb3843b788d45a194685a06d58a86d9eabc3ee41a785adc543c8c934050179f14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765960, "uuid": "3be8c000-e4a9-4ec2-8f91-a8954efa921d", "value": "T17463740ABF610EFBEC1FDD3709A91B05348D641A21A93F367934D928F65A50B49E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765960, "uuid": "afa86815-f1aa-4c44-9574-b680b04149ac", "value": "1536:v/KmB6MM+ofKa6PZ0t3/w2ZHg3QKoMbcoWAUynWaTlblfTd9d4f9JINnHD:v/KmB6MM+ofn6PZ0t3/w2ZHg3DoMbcoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765960, "uuid": "408c62be-5a3a-49bf-a2cc-fc305ceba36b", "value": 68260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765960, "uuid": "98ab8f43-774a-4ef7-bae4-cd666940eedd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765960, "uuid": "d7007b9d-a5cd-432d-bfc6-35f7e5e468aa", "value": "cec2ccc6c33066fbc0ed9bdf6a1b3ad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f832e03-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765944, "uuid": "971398e4-c379-488e-b930-dc68208c1aa4", "comment": "Malware payload (Mirai)", "value": "b703f04cf1eb1cedb332303ffcfd9e50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765944, "uuid": "6c973362-ae58-4eac-a52d-968518298905", "comment": "Malware payload (Mirai)", "value": "31277c0dc0cd84e21b8f9b2202011175eab43d64b0efd8b0fa9c9b5901bf1c2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765944, "uuid": "a438df80-20e2-4b78-a8be-beefdb0a2fdc", "comment": "Malware payload (Mirai)", "value": "2c3d76486b48f754e82c6625096f3da4b713a1d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765944, "uuid": "3bc7e205-d36f-4504-8a41-da12869d271b", "comment": "Malware payload (Mirai)", "value": "e3d509d9e7960c2eba087de625d98cf049ab47884eb66d167fd64ffacda5221fb62d5e6db44b99b6f2d8786de7964ab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765944, "uuid": "a4732834-f411-4644-9009-4512a8390c55", "value": "T1F92339D7B500EDBCF44FE33981434905B232735654522A336BB3BDB7AD321A84876E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765944, "uuid": "a4ac5514-9773-4aa4-8613-a771b7ba3812", "value": "768:qmbXjqWM8ToddalgNpJQ32DlYj+RzXfzPJOc8msB/eCl30LHQs0lBi8G7Ev/FO:qqbfoddycpJS2B1RrzPIc8msBZl30TQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765944, "uuid": "3e87ce23-7f0d-4020-9720-c6fc52c92610", "value": 47264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765944, "uuid": "ca4e14cf-1d9d-4074-92b6-8b8e2065b91e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765944, "uuid": "c991e69e-b85d-4bc5-be7d-e128f6a18e68", "value": "b703f04cf1eb1cedb332303ffcfd9e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1011054b-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710749033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749033, "uuid": "f123bd9b-94de-4c50-9f57-7164a84bba50", "comment": "Malware payload (AgentTesla)", "value": "76caa7f585053c3a3d3403e69ad4aa4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749033, "uuid": "28a03e61-8c00-4679-8121-738e99a4ef8e", "comment": "Malware payload (AgentTesla)", "value": "322a8fbfb5630161686cee31f6508b0005019b81f56a4af95130d7bafaaf328c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749033, "uuid": "fa36ba16-1488-41b1-bcda-0eccb57a7fa6", "comment": "Malware payload (AgentTesla)", "value": "ec2672f4254fc9e55a7c31ce7acb7b92d3bcd5f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749033, "uuid": "3ab69e6b-06f5-45f6-9674-22faf6ee579b", "comment": "Malware payload (AgentTesla)", "value": "d3fb2cb2af06a4f66c0db9199af117e836a7ac1ae4ed18d71373b9f87a16446677cb7a06acfa63e6c3e48ee1c11a1783", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749033, "uuid": "d8d54384-bb1f-4c10-abaa-ed7de5eda3c7", "value": "T14094D022FAC95A12D8A411F768367CCC22A12949DD87F5F52AFC795ECC337D2EE48502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749033, "uuid": "400d9687-2240-46a3-83c3-dc89fc243a49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749033, "uuid": "27b0f3a8-f8e4-46c9-825f-0ae49f2336f6", "value": "12288:qgDOJMHfAkPRsOJTbtZZssNlPuLWggTX:qgaSTRsOJTjFhCWgg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749033, "uuid": "01f0b87a-3aec-4a3f-9fdb-a198d0da9ce0", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749033, "uuid": "ae78c2c4-2df5-4206-90c5-b3a5bc59cdb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749033, "uuid": "000d31a7-9ae7-49dc-aac9-d289daebc8b1", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedd1a02-e52b-11ee-a120-42010a9c002e", "comment": "Malware payload (Quakbot)", "timestamp": 1710768708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768708, "uuid": "8a7a532c-3b0c-4800-bc68-73f66675439b", "comment": "Malware payload (Quakbot)", "value": "93e23d5018b32f09f808f8b17616628a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768708, "uuid": "ae5b0f70-302e-4dfc-b24b-729396a03f33", "comment": "Malware payload (Quakbot)", "value": "325e69a3da53c1afdf6fd56ea9e1ffc274415162fecdbd1f96deeace890a90ef", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768708, "uuid": "1bb91e2d-dbac-4759-b2aa-444618a23fe2", "comment": "Malware payload (Quakbot)", "value": "d31e7e6d82c5f28dae708e17b1206bdac36c9750", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768708, "uuid": "3f67b346-cce6-4427-9b71-e71efb98a8c2", "comment": "Malware payload (Quakbot)", "value": "f0a62009575a9197a024f460f8c6c522d71900c68f34a96ab95b3861798aab2cd358170bf2cafe8492fb31b314fd13b5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768708, "uuid": "07ad1835-0556-42ce-897a-995a0d25eff4", "value": "T14421E81917D50B31D3B28A7D1865A3239B32BD0AF963AF2E81A0418C4865110B831F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768708, "uuid": "63e68b9e-b574-4c23-b54a-d3041c601d94", "value": "24:8fansm81/ogEbvm4pyAcPkK4+/4G+nQ65FahavtttGrlcKOdm:8fasm81/rEDmuWJ1GtvilMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710768708, "uuid": "499e71f5-aa2b-433f-9655-59a0bad9ed83", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710768708, "uuid": "1a0e590e-9576-4e0f-9508-c586b160496d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768708, "uuid": "329eb635-4c33-4ede-9d94-6f4d189e762e", "value": "web3Interface.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b041f15-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763225, "uuid": "b2916106-4250-418d-9b03-3051e54943df", "comment": "Malware payload (Gafgyt)", "value": "7023fd945fd43252d9bab0674ce4bf3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763225, "uuid": "a1d23418-4cd1-48e4-9cc8-9d0d4b5428c8", "comment": "Malware payload (Gafgyt)", "value": "329630f19a787f26f887a1aec4494dbf3ce2b2bb1b2b6acd90c18410a07fc671", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763225, "uuid": "44586581-896c-4709-9cc4-0beb31970102", "comment": "Malware payload (Gafgyt)", "value": "b3113d7287550aa511a10382e79601b2cab3a519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763225, "uuid": "7b18bcd0-fc16-4002-ae6b-a365bf999c0c", "comment": "Malware payload (Gafgyt)", "value": "64a091a866c5bbb419b98d497aed3eb7908d57257dbaab7aa9f18abc1372fef4f258d654d22e37c521ea202fc86f4de4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763225, "uuid": "11ec988d-75ee-4712-983c-41f884178608", "value": "T10AC3C737A7D73D13C0D5A83302D30A617976DA6424BD0393E5A0ECB52F2AD643662BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763225, "uuid": "cacb5825-06a6-47c7-af3c-87ff0df516bb", "value": "3072:cS8gp9JON8s/CfHpha0Dr+aqV+KLury0UqTM:cZgpG+Bpha0fqV+KLury0UqTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763225, "uuid": "272c528e-6512-4d4d-8d9b-31ea86b335c0", "value": 129342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763225, "uuid": "5823c598-610a-408f-adc8-777401a73df4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763225, "uuid": "356e9952-cee3-4940-b4a8-05a7d243c711", "value": "7023fd945fd43252d9bab0674ce4bf3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f10b072-e4c0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710722403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722403, "uuid": "dc5f3ea3-5f5b-4d77-a468-ee17e8d56682", "comment": "Malware payload", "value": "20510fb9fdcf0a6657a79805eca2b681", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722403, "uuid": "6f3f0b97-8757-49f3-9038-acb300d6a35d", "comment": "Malware payload", "value": "32af2b4809ac5560874ca1cf635efcc83afa1c33506aa9566e2b426645f224a5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722403, "uuid": "841fafb8-e269-4b33-8395-516683d80efa", "comment": "Malware payload", "value": "4c0163d7e6cdcf50c76aad1be16e08c0625c7d19", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722403, "uuid": "d5d3dfcb-aaac-446d-a132-2f116bae1562", "comment": "Malware payload", "value": "f4dd9c79a007a711b25f5c0f0de3f9fae16a23059af83e16c7525a44623dedd7934466de5f082120aee8a9689def20f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710722403, "uuid": "2d5600d7-ed38-409a-ba4e-cd5daed7635e", "value": "T1D6B60187F75D9A2EC4774172CC6A5232E66E4F118A8397476848332C38775E88F79BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710722403, "uuid": "7ae7431e-efe3-49fd-88a1-746bea3599e8", "value": "196608:1QPrDHA4VPNNtWiYIfNyjRwxySOB4cmFICAZMjL/BrvA6rA3h6v4SkjKCQ7S:1QPP1PRNyt9BcFIC0M26rA3Q1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710722403, "uuid": "2ceb49d1-b7a7-4403-8531-58a04d13318b", "value": 10591485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710722403, "uuid": "9759ee62-c8c9-4919-bc9a-71b2a9fff744", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710722403, "uuid": "02f708a8-1e86-44e4-b280-a274d6e19768", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aceb44d2-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751873, "uuid": "4574f4ab-cfe1-4ab9-b3d8-a21bd61931e9", "comment": "Malware payload (Mirai)", "value": "63b69b65535430f4a2eb59124cd5e3b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751873, "uuid": "b4199e12-1d76-49b4-b302-6424720503db", "comment": "Malware payload (Mirai)", "value": "32bb584e77cab87e6a16339e19819d17747792c5004cb86bf2aa5add80624e7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751873, "uuid": "d8a4b519-ceb4-4b43-ae01-bfb52d108de0", "comment": "Malware payload (Mirai)", "value": "3ae3ab32914970c3f00f73f47d633aefaba95d64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751873, "uuid": "c33e8b80-491b-48db-8f30-1ddcba5fcc91", "comment": "Malware payload (Mirai)", "value": "bd36f5a1b2cded5b3d856b6ba9426e1b23388f4b6f607662f7adae971447ddcbf24040524521afa4799b3a06234fc669", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751873, "uuid": "477fd27e-1ec1-4ddc-82e1-946d21771ba1", "value": "T1F633F1A0C020CE36EF3EAF515C21E741E778DFE753D8ED05B04E8DB8195A6A58924F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751873, "uuid": "3fd08b74-59c8-4540-a575-dd468f5d8921", "value": "1536:Edqj7zIHavhfhir9I8N+sbX7IEPY34u+qgw09g:Edq3C20r9dN+sgqY34u+qgwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751873, "uuid": "034884d8-cc9c-476c-a6aa-2b9305b1a793", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751873, "uuid": "7e7b75db-32bf-4ce2-ae73-59b6993b5063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751873, "uuid": "e72b1e7b-a564-4bd4-9ade-f0b4f1c67f1d", "value": "63b69b65535430f4a2eb59124cd5e3b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab93b8eb-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757455, "uuid": "41bfc936-8edc-40f8-90a1-1117f69a13a9", "comment": "Malware payload (Mirai)", "value": "7f543a561c573c8308669c9d37c04492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757455, "uuid": "523d6066-6d13-452f-814b-fce49c26b417", "comment": "Malware payload (Mirai)", "value": "32e7bf9f286f701bb2fe0543dd423029251dd22fc3eea0c7c6438cd455c21f6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757455, "uuid": "be858b6f-60f7-40ca-a17f-d15b35019844", "comment": "Malware payload (Mirai)", "value": "a26e25560f632f2b40928ffa380083cfea2f8213", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757455, "uuid": "9cc18a0f-0c92-4633-8721-e1b4f8c50132", "comment": "Malware payload (Mirai)", "value": "b59ff653b66abbb16a3ee4851ddbb621fd52a1173297268c86de64772ea2f9efde289916a204e7bacf11ef18d4b866fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757455, "uuid": "c4140804-dc7d-479e-9279-496e480022b2", "value": "T152631985B9829A16C6C0537BFA0E438D772A63DCE2DD3313DD156F113BCA92B0D6B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757455, "uuid": "5eb622ba-3220-456e-8ce5-e967d82b2d94", "value": "1536:IUIcPMPsVJWys4nhhd3XuFIVdGSRrfQD4+a87i+MZzg:ZIcPBVls4nhjX8qf4jik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757455, "uuid": "1b95f51b-4a45-4a0e-9d20-f4ce1a75e95b", "value": 66876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757455, "uuid": "332b791b-41e0-41e7-9258-13bdcc985c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757455, "uuid": "de928d54-fab6-4319-88b9-d512902540f1", "value": "7f543a561c573c8308669c9d37c04492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeed96e1-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752414, "uuid": "1e7bd6be-d4ff-4c54-bb19-49c8210bb493", "comment": "Malware payload (Mirai)", "value": "ad8fa27150df725521fa1522955375a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752414, "uuid": "b95dd648-20ab-425a-9840-2b4dc0d79389", "comment": "Malware payload (Mirai)", "value": "340093481f4404da10cee777b4344441588f97183c7e5789276332ae71b14946", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752414, "uuid": "c27c6f2e-b9df-4329-b9d4-02ee4522aa29", "comment": "Malware payload (Mirai)", "value": "72ff28587e45ea224f7a19eb50da8e55dcb13d6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752414, "uuid": "7eb8e7d5-ad71-4307-a800-6c2a1e79ba5b", "comment": "Malware payload (Mirai)", "value": "19cce62ae8d43d392f33cbb7fdc011445fac08d09e5d6e8d2c0af42630946e6557aa41af3b72934a4505421e380fb553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752414, "uuid": "d0178fe0-61bd-4c51-b321-0417beb84e3d", "value": "T160334B21AD7A2E17C0E1B87A12F74724B2E6574A21E8C72E7D720E4EFF14AC061576B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752414, "uuid": "87b5182f-6321-42e5-8c45-d297626bcbc3", "value": "768:u1o1Vq9mkgAL7AqxFjrW9Sl1FlqbNINQRmO+HdDuOHT/+:u1OVSmkgAPAqxFjrH1FlqKNQRkHd1T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752414, "uuid": "743ef6a3-63d2-4e9a-9c15-2988f3d7ef66", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752414, "uuid": "fa38f113-f896-4e2e-8a0c-1586b8b4945b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752414, "uuid": "46df5697-1801-42ba-85b2-8cb777ff7347", "value": "ad8fa27150df725521fa1522955375a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c67d5e-e533-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771771, "uuid": "37a343f5-e593-4a78-8eef-675c69884a5a", "comment": "Malware payload (Gafgyt)", "value": "58845736e3a7c58157ea8d9b1eaf7e5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771771, "uuid": "77e56c73-7388-41b3-8048-47f74b2b8ec7", "comment": "Malware payload (Gafgyt)", "value": "341eee8396b5710e6860683b9c801cc119f2e2b91becfd9bcbb9197652cd11a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771771, "uuid": "bca7e57f-1782-458f-84b5-45b18f2d9d9d", "comment": "Malware payload (Gafgyt)", "value": "36d43008ff978e16c9923876a6fb483ed41efb71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771771, "uuid": "a2b8a35a-6b55-43d0-870f-d3e892e12560", "comment": "Malware payload (Gafgyt)", "value": "e5b5708c2ec3a1dd85f0408f7a3ce73052d4bf50c54c0cae329044654e55290adbe208d1f4699c7220cea9476421d930", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771771, "uuid": "be6f2510-087c-409c-ad01-4f41727f7967", "value": "T172C32A05E4508B67C2D2277AF79F469D37331BA493DB33215A34ABB42FC27991E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771771, "uuid": "0995b999-620f-4d75-9f29-9ca4b9f35e7b", "value": "3072:awfQa6sUVUPixIvxx02KKDNKDGLJfCZmpQOWsXGoN:pQa6sU+/09KDfCZmpQOWCGoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771771, "uuid": "91026f91-24cc-4bc5-aca0-1a74bb656de5", "value": 127804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771771, "uuid": "f1997157-cecc-462e-941b-818686e594a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771771, "uuid": "8894c6bf-df9a-4850-8458-1cf1e5ce3274", "value": "58845736e3a7c58157ea8d9b1eaf7e5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdbef47-e580-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710805211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710805211, "uuid": "c6c61f24-577d-490e-a7a5-07a6fc2a9e1f", "comment": "Malware payload (RiseProStealer)", "value": "203a40e141cf7982ba671df93cedcd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710805211, "uuid": "9c72e2e1-f87e-4b42-98ee-043f24665a89", "comment": "Malware payload (RiseProStealer)", "value": "3501c754e9a3c9c84475dba26ca0b5237938c13d7780ef107e3f1fbea14acec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710805211, "uuid": "652d8184-62a8-4268-8200-8e1dca8892da", "comment": "Malware payload (RiseProStealer)", "value": "c7712fe91eabe227e7157c085793b78e7b265fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710805211, "uuid": "a8c489b9-ae9a-439e-9254-b07cad930a4b", "comment": "Malware payload (RiseProStealer)", "value": "730befccbdfbe35d8a8fbb477ea3a4bf19a692695f3b335a8a66a980c0c535e43ac050bd794098a55378ffd5ce64cf38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710805211, "uuid": "41262437-dbbe-4401-90cd-f9eca924737b", "value": "T1F19533D24C30ECF6CA38287E0ACDAE1B6E735CA014A68536358F3F99593CF1D26E5549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710805211, "uuid": "3e470c9f-d7d4-4d81-82c5-68f21ec5d1f8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710805211, "uuid": "a46e3357-089c-49a8-bcbf-4fd5856dfa80", "value": "49152:k7x9bpL0QwqubN+RicX6+meawDCUU1/eXy4Mw:szbpLfxKv+mWCUSsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710805211, "uuid": "33453026-40b5-4984-bc85-f8396b460175", "value": 2050048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710805211, "uuid": "9a52f8ca-8e6f-4b57-88e9-64c020d64eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710805211, "uuid": "7ee02c38-c38b-430f-aa1a-7fb2ff9ec5d1", "value": "203a40e141cf7982ba671df93cedcd9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5329068-e4e2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710737392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737392, "uuid": "3a37fd4e-412e-4478-a466-24eff36df941", "comment": "Malware payload (Mirai)", "value": "1538582a549a636433e4deb5d10e3b96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737392, "uuid": "b453b867-b442-4922-bb6c-d15b8ff80c5a", "comment": "Malware payload (Mirai)", "value": "3523c7b3f6b00f1538763bb62c090a5b7ae550b0a0e23fd73eb139f009527bf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737392, "uuid": "794bbe98-2301-4c7f-ba79-f5f200845588", "comment": "Malware payload (Mirai)", "value": "1d95104b727647a650eebb762d9307bdd0c1e0ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737392, "uuid": "8378e7d1-b5e3-4aa1-9239-2790a088d5e8", "comment": "Malware payload (Mirai)", "value": "d775fab6a480b09ef6a2eeec4c037477d8fe8f0f22fe047dad49799c9ccdf519c104ca0134799ef7e3e1b8a9e6b9319a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737392, "uuid": "cdb3dc3a-9e18-4b5b-8a52-1585659e3412", "value": "T1F1E329D7F800DDBAF80AE33748530909B530BBE245925B372257797BED3A1991873E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737392, "uuid": "dd584d8e-4c20-413e-ab73-aaaecefcdff0", "value": "3072:SQsZaBVDirvG/TPPf9jAcMUlqDVrjbiRLyxV2OyiahTtN:JscNHfRAolqwLyxDyiQTtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710737392, "uuid": "13e54d9d-ddb2-477a-a0e3-659227d55894", "value": 150432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710737392, "uuid": "8991a4a1-d3de-4fb8-b93c-436b47f31cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737392, "uuid": "3adff2d6-6b41-4d73-84b1-e79800a0d264", "value": "1538582a549a636433e4deb5d10e3b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0ccd43-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763200, "uuid": "d7ccaa09-996a-4dbb-9d08-3574d374d789", "comment": "Malware payload (Gafgyt)", "value": "d9312be5d955cb03005968656a1f2026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763200, "uuid": "c5b46c87-7def-4b5e-9680-5b2591f7c815", "comment": "Malware payload (Gafgyt)", "value": "3719493f6fee7e91834c8d0cc2469010ec89a87f01dabf977154147f4bd05055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763200, "uuid": "5d155021-1b68-46c7-8d31-12ef39ce85bb", "comment": "Malware payload (Gafgyt)", "value": "d45be7f8a23e5273d52ca24fdeb7cf2915a30c5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763200, "uuid": "4ba21396-be14-466f-8fd6-4d3d6efb8928", "comment": "Malware payload (Gafgyt)", "value": "92abdab18ad3cc59c1e7aebce2cbb59859402668d2fad1ea92dd70fa16146218cf6a44813c3640e6f969116648555f05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763200, "uuid": "eeff785f-979d-432e-92ef-94fea30cd279", "value": "T1AAC31904E8408B27C2D267BBFB9E478E7B3597946BC7331256296DB02F827583E3E550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763200, "uuid": "c057f7fc-f6cb-4c73-acbd-90ea678a456b", "value": "3072:IHr0Ut7q0dEK52L0auDaFUepFgZszO5h5YewWzU82E5QInMqEi/M:UrAUenxzO5h5YewN82E5QInMqEi/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763200, "uuid": "9a7f3e01-fe7d-4795-a571-cf45eef795b8", "value": 124034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763200, "uuid": "ef2f5b88-cee5-426f-ba48-e7977f876f8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763200, "uuid": "b181827f-ddfd-4dcd-bb35-8853e78b0b2c", "value": "d9312be5d955cb03005968656a1f2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af90fbf-e4d9-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710733214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710733214, "uuid": "b3f5482e-c0d2-405d-803f-ca9b0c6d13d9", "comment": "Malware payload (RedLineStealer)", "value": "23f7b187bc115d39b5ef444516aaaddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710733214, "uuid": "35e58ca3-2d0f-46a2-bb52-3c708da887f1", "comment": "Malware payload (RedLineStealer)", "value": "37ec090d6f1b23d37e7b462aa7c63f0d055092902d14753eead1724898c8becc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710733214, "uuid": "29edafae-0299-4b23-b843-0f1f5c369dc1", "comment": "Malware payload (RedLineStealer)", "value": "5be7960c3ac96fd01989dff61fb0a1123e622d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710733214, "uuid": "e2641ac6-b598-4321-a5f7-b9b1c18dfe56", "comment": "Malware payload (RedLineStealer)", "value": "9b3f92ee1f08be5ef8356285adf4d540d0a8921416ef48bb94050d2be4243f5485bc450e41510786798e831fdd46ba35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710733214, "uuid": "2b3698cf-ea9d-450e-be68-6d19735b6255", "value": "T15276330169C7A9F3E0F22D7E117AAB112D3EB93007D2DAC76BA40E1BDA505C5E735638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710733214, "uuid": "f498eebd-7d84-4a34-92cf-712a54ef2618", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710733214, "uuid": "acd7e813-8fde-4b9f-b8ad-cee657079af6", "value": "98304:ci+x7VHgMtwYxIdMePIOfY0+Ak5feTRIgFupV9M0x/JwdZhO+P+QCpnf:h+DAg/8dPzQp5fo1Fu60xROhO+GQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710733214, "uuid": "fd23dff3-ad68-4c8b-98f5-ede647a87260", "value": 7347321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710733214, "uuid": "3cb66bf3-37e8-4ccb-bfca-481a89d59625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710733214, "uuid": "f75949cd-f530-4232-81ff-b7862b9515f1", "value": "23F7B187BC115D39B5EF444516AAADDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c2b9fd-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727400, "uuid": "63fd0bc0-f3b0-4b3b-99fa-263b044d5afc", "comment": "Malware payload (Mirai)", "value": "7364be4818e984ed5233e538dc5c858a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727400, "uuid": "4bd15735-7c80-4367-bd2c-6eb12fc7a250", "comment": "Malware payload (Mirai)", "value": "3880be41a5e9816a0c5528b02c51e3e9eb7a38d85f2c8e2d212ba9e70a2a3481", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727400, "uuid": "2949fc69-4e03-448b-b51f-859502ce3e2d", "comment": "Malware payload (Mirai)", "value": "eed6032a8ddb1feaa005125253848b4c1d751354", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727400, "uuid": "10b7c309-cee9-42d7-a449-1b47cdb9977d", "comment": "Malware payload (Mirai)", "value": "778712dface3c90b3070be2221876d20c524873f577ee202bb0d151855176eb890a6fae1fddd6a0458c934f5922bf0c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727400, "uuid": "065ae482-5bca-4170-9ac4-2eb1c37845d0", "value": "T13304E81AAB550FBBDCAFDD3706E90B1139CC954B22A83B363674D528F50E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727400, "uuid": "1eef8f3b-4d75-4e3d-80f5-477f85e85817", "value": "3072:OeEksFM+wXnJaVB8H3NaMsTD+4pBU9k+r9KH/T:OeEnO+wXsVGdaMKDFpSi+8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727400, "uuid": "cdfc0b07-23df-41c0-bd4c-b06963f91fac", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727400, "uuid": "01ab6afd-b219-4e35-a1b2-ffb14e02b2de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727400, "uuid": "c56c8778-fcdd-4096-acce-d7c576614ede", "value": "bot.mpsl-20240318-0203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fc40b9-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710780151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780151, "uuid": "b186f351-db2f-40db-9580-7b4993c77507", "comment": "Malware payload", "value": "585cc99fbf9df24009231d70d007c236", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780151, "uuid": "16cc9a58-9e15-4a90-a943-7285305f3427", "comment": "Malware payload", "value": "39ccc224c2c6d89d0bce3d9e2c677465cbc7524f2d2aa903f79ad26b340dec3d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780151, "uuid": "23d40b51-84b0-4c1c-801d-b74b538d5303", "comment": "Malware payload", "value": "cd0e58b6a885580d048b4041bad3b92059bad5b9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780151, "uuid": "d792e857-85bf-4445-8ca2-09a4f6c08ab6", "comment": "Malware payload", "value": "7ff0428505d1593f52f189d6a274020dea84a285d0ae21aa89b7af3da0fcbf49f9e40b7e2e73546b69ed890a3da1d6a1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780151, "uuid": "6506d302-a095-44e9-bea7-bde1ef74397d", "value": "T1EDC4E4D156E2CDA5DA0DB67F39C3ED9A4F2E323D00C293945D27DEB90A32254B60BD24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780151, "uuid": "eb41cb6c-b525-4983-bc60-bdd356b22a43", "value": "46702e615a96538f4944f7d15b37d4d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780151, "uuid": "0f03c4d1-194d-4c5d-bce4-b4e1c683174b", "value": "12288:gE50GSHrG6W42JcycysY0V3D9wCV+YnXGwnUP345WRgG3OkGGs/Lwmm:h+GSHrG6W42JcychY0FD9wCV/Hw3yeJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710780151, "uuid": "024b5132-b44f-4ad0-996e-f7b152060e3e", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710780151, "uuid": "3d5f7bbb-6cd5-4126-89a9-e58ac6f3dd29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780151, "uuid": "5b65f63e-8763-497a-b779-2f200bfae901", "value": "585cc99fbf9df24009231d70d007c236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afb00ab-e534-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710772325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772325, "uuid": "57a29213-16ec-4e5f-9b6a-0e5b62855cea", "comment": "Malware payload", "value": "636649089335ebb37514551724606ad0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772325, "uuid": "d4927df9-b2ee-4c17-aae6-5390f488c35f", "comment": "Malware payload", "value": "3a8b93b05973d8c9abe4a0b375354c2764f8e86d182fcd7a588b3cc8dc65eb7e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772325, "uuid": "8f1b4be4-bc26-4855-879e-b0148aa70806", "comment": "Malware payload", "value": "b83e4c2cb93585910a1b040741b5e7f3a85650fc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772325, "uuid": "ebd0c4c2-e810-4aab-8eee-b829c690e1ae", "comment": "Malware payload", "value": "2de76c4971c83ead5c72516a037a5a92cbd539f07899140f2df98e31d7c4dd1e7cff49c91b0a9e7634985fb8058b7f6b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772325, "uuid": "39d2f47f-2bfc-463b-a48b-0b4696c90ae0", "value": "T1FBB6F187F75C9A2EC4774172CC695232E66E4F118A8397876848732D38735E88F79BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772325, "uuid": "1435c6a8-8291-480e-b9a0-aeecbf6b6ced", "value": "196608:9hfq8nMLKV1n7Pcd4g4SuXrTO5QMjL/BrvA8DG6SC0e7wpNPx8J:9hC8MLKzn7G4RbX8QM28DG6QvZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710772325, "uuid": "147b7bed-edf6-4b93-8006-6eb16da78a63", "value": 10506976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710772325, "uuid": "f975e8e3-8a20-4e32-8a04-963bbcf46290", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772325, "uuid": "b689e360-0916-44bd-bdd6-9185f1fc7afa", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcebd0e3-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751900, "uuid": "cd76caf5-c8a6-4e7c-933f-703d4fc34e3b", "comment": "Malware payload (Mirai)", "value": "8891c104e3c4a985fd72c0604ae7626b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751900, "uuid": "502de7b0-cb1d-475e-8120-c537aed38422", "comment": "Malware payload (Mirai)", "value": "3c0623888b007187d26b30dc40e8b0a862864a2ee87c47b648353c356c9802b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751900, "uuid": "c42f3e0a-53d7-4e68-8679-f224cc091f71", "comment": "Malware payload (Mirai)", "value": "860ee5229ea8b4b1fe3a0fe2c739b6389d199520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751900, "uuid": "27b68a05-8402-456c-b09a-a3a3cbc08575", "comment": "Malware payload (Mirai)", "value": "b68f27880f6074d9066f589ac77b4ef298b7ba44f585f3ad97c3bdd58a769158a15b46ec5e085255fad2dcddf5642df1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751900, "uuid": "39718743-03e8-4b89-97ad-d6c6f812013e", "value": "T11EE3AEB4F1B55ED0C25405353A91893C8333F61A60AF2FB6ED818A5FA48FED8B124779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751900, "uuid": "0f837470-00df-4fe7-a63e-71207df838fc", "value": "3072:8HnNCkEhumFUCxsSEbusS70og1uYAFLQs7mIBf7r2jsT4w:8HNYhumdsFqfDPVfvd4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751900, "uuid": "7e5b5f5d-57b1-45b7-80da-17df584600c9", "value": 148920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751900, "uuid": "f9329b97-284d-4580-b274-df208efabb68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751900, "uuid": "72b22c43-0c2d-44e6-8682-ea060bbbe70e", "value": "8891c104e3c4a985fd72c0604ae7626b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b4df60-e54b-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkGate)", "timestamp": 1710782389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782389, "uuid": "420c6b7d-8dad-418e-8c91-ed70f5bca848", "comment": "Malware payload (DarkGate)", "value": "2143d7603258b2801f7ed154b5da3da6", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782389, "uuid": "6ae3eb48-1a37-4cbf-870d-6e9152fcc41f", "comment": "Malware payload (DarkGate)", "value": "3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782389, "uuid": "00fb0bef-a1eb-4afd-8183-458cc685fd34", "comment": "Malware payload (DarkGate)", "value": "5e9c26503ebac94a83b78a03057237ccce365a50", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782389, "uuid": "9a39f20b-dea5-4990-b0dc-c4e0b351c80d", "comment": "Malware payload (DarkGate)", "value": "59358185fff91d68ef3d1342c9482e4e2a15465737aa86730188c6f55720fc7255f0cefa5def2a3cab58e8f77f1f6c9a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782389, "uuid": "a847fc6a-c08e-48fb-b20d-ec8aafda841e", "value": "T11AA47D31F2A1C477D1725E7DDC1BE29D942ABB602D3C65077AE41F4C8E393927D2A282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782389, "uuid": "3874b3d2-62e7-4a09-848c-1023f17f84f7", "value": "2d49f2c55baaa08fbacf203d290249d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782389, "uuid": "68a7739c-5af5-46ef-a7fa-0e796148ac34", "value": "12288:FtkKpKF2q1F3WbaPio/TKvJzghvOXK7BOYV:FtZA1F3WbaPio/OvJ09VUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782389, "uuid": "d8734005-7eec-4e1c-94fb-bb473feaf69e", "value": 464953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782389, "uuid": "f76fd94b-fd19-46f7-b505-a42fa1be9f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782389, "uuid": "e177654b-5cb1-445f-88d8-d2f2b06d2bdc", "value": "ethcgjtr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4b421-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760378, "uuid": "cc11e533-e856-4a12-8b41-fefcb7104491", "comment": "Malware payload (Mirai)", "value": "1e2af8bf26b8ecd2c7b2dfbaca62e20b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760378, "uuid": "abd55d8b-ca7c-4703-b90a-f4a941cd8892", "comment": "Malware payload (Mirai)", "value": "3ca312f8f47b91e454210082dd3a6696ad8eeff3c27d4c18b1359981c7a5c482", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760378, "uuid": "4bb5fee8-f1ff-41f2-a000-b639a60671fc", "comment": "Malware payload (Mirai)", "value": "ffb71c9fbb0e8113af4066dad0b3288915438961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760378, "uuid": "3f0c6cdd-b733-41f5-b46f-5d6c5b5464bc", "comment": "Malware payload (Mirai)", "value": "2126e488434abfef1f8f799287a6924670fcf5114cdd8c0ca2a627e93cecd49ce68fbd21b9d2af820df9e23380869546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760378, "uuid": "e6edfb7f-f800-4efb-b178-f9439161567a", "value": "T1782178A66BD29D57CD640677DE9B5750A322EA88C29FB513F342121A0C6F22A0F12489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760378, "uuid": "1075bd20-b2eb-4d5e-bfd1-eff9490bc04a", "value": "24:FiAtVsvRVCO8DTuJ2pRsDclaGjFcVLFdIdmF5v9R2INdVNfDi:VtVsCO8Da8WAoGjFWLDR2INdVNbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760378, "uuid": "ef1c4e9d-15b4-4b1c-8f18-62f2017562b5", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760378, "uuid": "8868d020-f9dd-416d-912f-3f3c46ca2019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760378, "uuid": "3f219f83-5eab-4c67-b02a-fe6a4062390c", "value": "1e2af8bf26b8ecd2c7b2dfbaca62e20b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682fe085-e526-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710766361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766361, "uuid": "f57e5563-c48f-471f-92e8-3a5977f8537a", "comment": "Malware payload (Mirai)", "value": "22a43f26130b186e9a2e21cf0d38447c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766361, "uuid": "ceb5532a-b0f3-4a7e-8ba1-77b889a17936", "comment": "Malware payload (Mirai)", "value": "3d58fd5c873e41d657d6d6394a81dff8988528259a190bd58bcb2c5561414a94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766361, "uuid": "31355059-a372-48c5-8e86-ed2f49ad40a2", "comment": "Malware payload (Mirai)", "value": "1488a4907d4c412611c654c50d12e2d8ed12d6e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766361, "uuid": "5fbfefb5-b7dd-4249-b5b8-8a856202eedd", "comment": "Malware payload (Mirai)", "value": "a0a878c5da2bfb913cd53ebce3bbe2cc8d3d3b6091d212816fbfd9de55f7a63af6e83fd89abb7dadecb86c6517cf2d99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766361, "uuid": "614dbfab-f0fb-4722-9de6-23e42b66e469", "value": "T139137D63CC752E18E1589A78F4349B7D1B23E916E58B2EB9886283718543EDCF90D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766361, "uuid": "4aa6badf-08ff-4626-a7d4-33287aac1e0c", "value": "768:kwY5xsCbrHoNuh5lXeZ954o094SupYuNowIFCmNJIO4:kL5xsCbro0hPXI9YQmVFCmUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766361, "uuid": "6b910883-64f6-4f7c-9eef-3920fa7c73d1", "value": 42312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766361, "uuid": "e88db254-1c67-48f5-80dc-e6b29ce913e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766361, "uuid": "719dfebd-d45c-41fb-bc3c-385b9a0743f9", "value": "22a43f26130b186e9a2e21cf0d38447c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e89ae6-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757854, "uuid": "25dda265-7b32-4cd2-a41f-0ddfd7a0a083", "comment": "Malware payload (Gafgyt)", "value": "8e20fa944c97dbd3ac8f8d9c4be96697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757854, "uuid": "f70d309e-e1df-424c-858f-3cd881f05c00", "comment": "Malware payload (Gafgyt)", "value": "3d5a1817dfe342aaeb3ee155d8bb7bbe7a5f0fabbd8c6533cb73d33152e171a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757854, "uuid": "c2c39193-539a-46a1-befe-ee91b92bafe9", "comment": "Malware payload (Gafgyt)", "value": "e139cd02a74e2f745b387cb70fbb6b23ba010e9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757854, "uuid": "8e9156b0-2cc5-4ab7-b760-ab3537bb9bd1", "comment": "Malware payload (Gafgyt)", "value": "347bb2f6beea4d873851277c9b0f0cc15d131e2aaa92eecbc2f90a3a722e6ca161bb20d002009b111f6d2b9aa127f7eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757854, "uuid": "bfba0d1d-0839-4e52-b52b-317b0ed09f01", "value": "T10A734C42E742CAB3C8830BF603AB9B655532FD3A5A1B9F49F31C7DB4AB024C87106765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757854, "uuid": "af5f24d0-fedb-4133-960b-1f5f10d09814", "value": "1536:PQxMbTxlxW1MCJf8Z374uHVbr06IugwUHy4r3nGgamLIdsdBq0WKDOk:OMbTxeyCJG4m0egwUbGhmUdsdBjWKDOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757854, "uuid": "8d9f7f0f-431c-4dd5-a8c3-66ccf76c3994", "value": 79681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757854, "uuid": "ddfc8140-724e-48bc-a189-72d761caf627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757854, "uuid": "fd6f9b7b-5bee-40d3-9d77-e610b847b3f4", "value": "8e20fa944c97dbd3ac8f8d9c4be96697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd33c192-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (Mydoom)", "timestamp": 1710767846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767846, "uuid": "4a9d147d-80e2-4e99-a7f5-f61b2738901d", "comment": "Malware payload (Mydoom)", "value": "b1f6a4cc592f3c9f7d4b69c02ac74d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767846, "uuid": "9f3ddbe6-581c-427b-9381-bec335873883", "comment": "Malware payload (Mydoom)", "value": "3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767846, "uuid": "e0783db9-e7a3-4caa-8f2e-b62b1b1f0560", "comment": "Malware payload (Mydoom)", "value": "db2db17c1d3e2c4f3a45aad9215cc77ed455ffcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767846, "uuid": "1355bf06-71eb-4c0b-9af6-76b40737d3a4", "comment": "Malware payload (Mydoom)", "value": "807f762429b6a9b5b80dd98b600fc579f5ed9bc61b5b0ed6ee01393dc712f1176602fa32e7c211d8dca63e5783bce16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767846, "uuid": "35bc845c-7feb-49a1-b172-a9660b83614e", "value": "T18D13E0983E8FBD42D2840C382903EE7ABE52FD444D09268BB5B87B0BBDB1F95455DC46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767846, "uuid": "20b200c0-be83-4638-b63c-c3dd7fd54c6c", "value": "98cd465c2ab2841f9fd90d5e847563f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767846, "uuid": "ae09f238-a02c-419a-9b6d-b29f3b84d715", "value": "768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767846, "uuid": "df2b6c2c-0d83-454c-bf99-da49ab5bbfff", "value": 42966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767846, "uuid": "70710cc6-6334-4a27-9010-f88c0425aff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767846, "uuid": "949476b8-bf2e-4aac-8267-375f1e5c4b94", "value": "instruction.htm .com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630728c7-e4eb-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710741012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741012, "uuid": "e2b1d655-1ba1-45fb-aead-5a04804948b5", "comment": "Malware payload (RiseProStealer)", "value": "b2c6d3a1570830bfa61350cd9e5ea894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741012, "uuid": "0ec1fb08-e174-4c7e-8f0c-935d1b4c429a", "comment": "Malware payload (RiseProStealer)", "value": "3e9fd7c0dbed99f1445b6ce2f1c235e0ec1126dad75c81db29c7b0de8c311bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741012, "uuid": "dab8bb35-011e-4a28-bdcb-b3625fa24d81", "comment": "Malware payload (RiseProStealer)", "value": "5c3da17b59822b1fa12d462936678615a34d349e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741012, "uuid": "b043a3d5-d1ef-4ac4-ac42-5d077e954b15", "comment": "Malware payload (RiseProStealer)", "value": "d67c841f107d6e802c1bc6c2066ebee0c0080787351d81abfeb8043b539928625edc5fa3a28a54ed0fd62ae8d10bc285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741012, "uuid": "fd1ca19f-c125-4871-bb7f-03b3e1fad140", "value": "T126E56B92B50671CFC58B23B49427CE465D9E43B9471049D3BCACB47BBDA3CCA16B2C29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741012, "uuid": "ba66b9a3-2af2-40af-8532-91dcfb1b3089", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741012, "uuid": "43eb7c33-4dd0-4150-91d5-0e820747eecf", "value": "98304:JNzmWqKsRJlncjC0gD5WHg8z7RVo4fI2:JNzmWqLtkgsrfI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741012, "uuid": "967e04ec-1e0a-4c30-b4a8-85b0ba407abf", "value": 3187200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741012, "uuid": "e7898a38-9da9-417a-8078-68c564671f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741012, "uuid": "092a9776-6175-4c7f-9bbb-48844f77c7d0", "value": "b2c6d3a1570830bfa61350cd9e5ea894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d0d758-e4e9-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710740341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740341, "uuid": "673cd724-5f98-4a72-b0dd-fd5ef64d0e79", "comment": "Malware payload (RedLineStealer)", "value": "541265de5e9bbbdbd0a8105716fc6ef8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740341, "uuid": "f38d74a2-6e90-4902-a498-1937766d6ee7", "comment": "Malware payload (RedLineStealer)", "value": "3ed565443e0c49b991d90cd32c4c060db6fe2af30b3a24586379024e0adc2e02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740341, "uuid": "d08fc137-78eb-42d7-9811-5ca77ca24508", "comment": "Malware payload (RedLineStealer)", "value": "1c4a44cd380e87a1d53db9ae6ceac5f4e8166837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740341, "uuid": "2f0f3413-65cf-4b33-8964-61a35b82abae", "comment": "Malware payload (RedLineStealer)", "value": "d18f8a1d89bd2bfa500b4b75d939a1ca90fb7eae8dba5822708b392ea8dcb914a0bdf01beefc4d1fb98f7bcb03d79179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740341, "uuid": "223e6b23-ea15-4bab-af8f-dbb3bb80925d", "value": "T1A8C4CF57BB598F31D2580733F0C74900B3FA6996B117EB09788523D40D473AAEA4B7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740341, "uuid": "53c1ed92-6ada-4956-aba8-ba9f6a111fa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740341, "uuid": "27d8e5b3-fed6-4981-9b14-696949cc03c7", "value": "12288:xB/p8smtRpl73V7SxNWM/MOt/9fSLtZ8I6:xB6NV7SxNWMU2/MLfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710740341, "uuid": "f357d8c7-cbfa-4b6b-b571-342d787dac0b", "value": 562824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710740341, "uuid": "1b77a083-245a-40fc-af25-859710404848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740341, "uuid": "6e1c7764-0a3d-4839-b322-0bf0ac7ce8ce", "value": "541265de5e9bbbdbd0a8105716fc6ef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371718d3-e540-11ee-a120-42010a9c002e", "comment": "Malware payload (Meterpreter)", "timestamp": 1710777445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777445, "uuid": "857d76fd-a0c0-45d6-bf93-1d742694ad5b", "comment": "Malware payload (Meterpreter)", "value": "251fe74b98fd24196d19d10291b46722", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777445, "uuid": "cd5d3036-ecd7-410f-a059-343a97582351", "comment": "Malware payload (Meterpreter)", "value": "40ac244c833f2f77e440be9d3385f8fedad9e2ff4eee2b44a8f222c7046e5209", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777445, "uuid": "e2ff8161-184b-433d-84ff-5d520e70fa8c", "comment": "Malware payload (Meterpreter)", "value": "ab6f4a8765d91f675c869e98488caafde8456ff7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777445, "uuid": "9bd9d387-f059-4896-9de7-d088efaa92d3", "comment": "Malware payload (Meterpreter)", "value": "d35593e8f9622a9e0379967b779309dd5dd0ed9cbc93f5631cca6a5d80c0addf2f3f9bf9690828a9f877105d9a9bedea", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777445, "uuid": "1b37ee26-856c-4b54-a825-e4b3b993da00", "value": "T1DDE1B51337180EB6D8BC057D06E3FD7760984E293B3B83728E180317392222478F4E08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777445, "uuid": "5ff1bf4a-878e-411b-a067-a77f8b83d7d6", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777445, "uuid": "af5168e8-e8a4-4a8b-a7ee-fa0bae8a9d6d", "value": "24:eFGStrJ9u0/6dYPnZdkBQAVAWk+gqlKZqgeNDMSCvOXpmB:is0kYrkBQv+3lSSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710777445, "uuid": "8166a514-1edb-4c64-bc1e-ff5cff92ab49", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710777445, "uuid": "11d09449-4d47-4f1b-8285-6bcd98b81b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777445, "uuid": "7b047017-64bf-4330-b94c-4847e2d4dc5c", "value": "251fe74b98fd24196d19d10291b46722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02635388-e533-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710771774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771774, "uuid": "8140d138-db19-4af0-b465-940d9b6584d1", "comment": "Malware payload (GuLoader)", "value": "19c940567f87b9d01e02fe6902e32136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771774, "uuid": "08e98469-953d-4ac6-b1ea-11da6b6e4121", "comment": "Malware payload (GuLoader)", "value": "410a705cffb3c89d4832772e153cea4c7084f16d8aba0f5879084d86fde77af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771774, "uuid": "f4a42133-c9a2-4c9f-b455-4c56d2e0590b", "comment": "Malware payload (GuLoader)", "value": "b0eda36fd4a8ce568ec377e6bc8117e595489cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771774, "uuid": "879f0543-bd15-4880-9a74-d3e57a45ad17", "comment": "Malware payload (GuLoader)", "value": "6f9c77c1af1992d07b3c16d647f92267ec0f725dce329eefaa8517228aa9b41dfd11fb4cb1d33e187fce6f6ef84a3068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771774, "uuid": "5a92e519-8f92-4f23-ab69-d31b99461de8", "value": "T165E4230893FDCCA2D013DA7668B17EF7E47AA9147527164B43642F893E717829CDC2E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771774, "uuid": "8491af2b-5abe-40f9-a721-d61b409e56e5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771774, "uuid": "813c8e6d-7580-4698-90fc-c7671948a782", "value": "12288:rq3wSq2Kn2V4e7z5f3PeoXP8QhH1CRjU0u3FZWTzgkA:cwSRV4e7zd/eGDVCq0cszgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771774, "uuid": "0ac559e2-7e09-4bb4-9378-408ff330038c", "value": 671064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771774, "uuid": "eb7a49c6-31aa-4181-bdd5-f6c82b48c4c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771774, "uuid": "53964440-99eb-4283-815a-cf3c1d344462", "value": "Bagskrmes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f98f49-e538-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1710774013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710774013, "uuid": "1d51865f-7afd-47c3-a213-091061a6f0c7", "comment": "Malware payload (CoinMiner)", "value": "99fefc78f54dc27321dd31d51e841bb2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710774013, "uuid": "b6212577-e3cb-4e49-bdc9-d4e0c7fedc84", "comment": "Malware payload (CoinMiner)", "value": "41a8b4bbde769dd1d866ea6bfb8912d092234cc6f80c37893b3797e2b7f4f612", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710774013, "uuid": "b843d83d-6c48-451b-8170-23ad433489d2", "comment": "Malware payload (CoinMiner)", "value": "1e7b4bc92d75322b3c73df9f5f5b4f2f08cb314d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710774013, "uuid": "d51614e8-97b2-4b9a-9c77-0e9bb26150f0", "comment": "Malware payload (CoinMiner)", "value": "1d434b18a1ebf0b99e70d2a4485a26aa1a6c021bf1bce82aaabeb16063105785469d064cf2a0b0da635c4b04a5c642ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710774013, "uuid": "5e2a2053-3237-4f0a-b6bf-7c0ce87f7680", "value": "T10F763355EE0048C2D8952631CDBB5F1BBBF7D2C1D38D1A4289FA1578DCC2B909E9EC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710774013, "uuid": "051d2e9f-bba2-49ad-adb9-f14c9010e552", "value": "196608:XcigPpk6YzSiTm2/ZAaSBr6sQuqgWu0k/2RxkL9dyAE8KZgx:XExpY7S2aqgWKqxUby18KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710774013, "uuid": "78fee460-6d1a-4177-97be-4b2c9005a33e", "value": 7734693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710774013, "uuid": "5095dec2-94ab-4309-b4e1-35b5334ff3f2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710774013, "uuid": "8f21b95d-5262-4ebd-99b1-52c63f81b37c", "value": "er5thygfd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df082664-e535-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710773003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773003, "uuid": "3b1c52b3-fdf1-47aa-8ddb-f9fa09e0c173", "comment": "Malware payload (RiseProStealer)", "value": "2b4535b47ed41b03dee2d89cc99daded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773003, "uuid": "7cdd6c45-ce59-4c06-a0d5-6633064a02d6", "comment": "Malware payload (RiseProStealer)", "value": "420066f943311aad3b2b06485fedc78b2f63c2c7a756e28a11e8841ab0895750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773003, "uuid": "2c1100aa-f77b-4c4e-b469-dbd9b9e6463c", "comment": "Malware payload (RiseProStealer)", "value": "97f06956398a10e6298f0c183172e79785b62e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773003, "uuid": "d9a2486d-b2cb-42df-a0e1-ca8a97c27754", "comment": "Malware payload (RiseProStealer)", "value": "6a00dba1cae9c4bafc5664c26710140fb34c5e95bdbe4098ca187b1c9e7f488fd9f9b99f2abb664c14cc144567cfaf35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773003, "uuid": "c9029ae2-d456-4148-b78a-2194230cf28a", "value": "T11F56AE4BBE45CD21D15A6B33C5BAB92953B05FE2A307E60F35C137AD1A5733B088A187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773003, "uuid": "14c08c00-9358-4749-9ced-3f9cd7f6fe6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773003, "uuid": "ebef1700-d931-4a30-910a-1751a26b2330", "value": "98304:WfR3BbqgVSu8nPsA9KYlEMgT3C1sWBzhsZTrj3lLSXheuAOP6wITFjDe:WfPKKFMiS1dBWZTr9SX8OywKFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773003, "uuid": "450e1a0e-f6f0-43f6-9830-362fc34b5a5d", "value": 6441520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773003, "uuid": "58018323-8b21-41e7-807b-573822967338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773003, "uuid": "81f57650-036e-4684-9220-eff6ecd02378", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf3bf47-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767819, "uuid": "794ad158-0c0c-4d25-baa4-34c5a9b34821", "comment": "Malware payload", "value": "e36b02efc9aac5118567904d98f69b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767819, "uuid": "e2b6b9c5-a6e3-4f1e-a0a4-ff2a4fe951c8", "comment": "Malware payload", "value": "42569f8758cdeb2e9cbca8fd456e8e7482feef33f9c2ebbd854a8b65ba6a39a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767819, "uuid": "1bfd19dd-5041-4f3e-9919-6daf01116f6e", "comment": "Malware payload", "value": "26b4c20107595fec89d4aef36f720ed2927c2b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767819, "uuid": "205f172e-0fd6-45c1-9d92-01d867356968", "comment": "Malware payload", "value": "6ff2b5692b911e91860e87c4d1e621f61a7f2b65d3fd3c0b5c8c0b4ba85d5edf65327047cc48c818356e364d9e4f72d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767819, "uuid": "2caf7b8f-1389-40b9-ba1b-cb102b4b96ab", "value": "T14D356D43B154907DCE958330010AEF746B1DBD6E4B57EBC7E2C2FEE6A4705ACA124B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767819, "uuid": "71880406-636f-4a23-aeb6-f7b187c4911e", "value": "12288:Niyus/ZLMmvB1yLRRHS2nG/lLCED6uJgLQgbRtUoAmyCIh6b:Niyus/eXncLvqMg1KAi6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767819, "uuid": "72b84c93-76f6-416a-b0a4-98d00b090cea", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767819, "uuid": "2bbd9c7e-808f-4e29-bed4-667d5e0d35c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767819, "uuid": "9e65b498-c7a3-457a-8101-a54286c30021", "value": "42569f8758cdeb2e9cbca8fd456e8e7482feef33f9c2ebbd854a8b65ba6a39a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf2b8c2-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763629, "uuid": "3b1330f6-5afc-4630-9b4a-66bda239e361", "comment": "Malware payload (Gafgyt)", "value": "b4b7c32d4785e175e26c3548a705279e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763629, "uuid": "7043d43a-d48f-476f-bcfa-5b44d209d9b5", "comment": "Malware payload (Gafgyt)", "value": "42e620c3a3b916a7e4a365bf78975795f3d5a8a68d732d387326e6bcb8ae1aa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763629, "uuid": "f84c80e6-4515-415b-8405-5dc70c097fbc", "comment": "Malware payload (Gafgyt)", "value": "4c8887a42fa0090f27c1701fda87ab00e33d3cde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763629, "uuid": "8958f4b6-f4f3-4e90-8630-08de2d657540", "comment": "Malware payload (Gafgyt)", "value": "48d6c66e2b8f5b814bebb7577e28cb6e404834e60816c5bcc2ddf7896767a48aced5d8eab12119ab8e48967a8db8821b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763629, "uuid": "4eba031e-586d-404b-8953-fa014224e4fa", "value": "T155A3180798625E77D005597136BB59202B32B9611F4F4ACA6D6CA6B047CB8CFF01FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763629, "uuid": "2a3dfa30-dae7-44e7-a446-61fc34cd53c8", "value": "3072:5BpNzUmFA6Tm3SO1YOEFtrC5h5CVUzfnK7uGiSUKfM:5RzUmFAs0SO1TmrC5h5CVEfnK7uGiSU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763629, "uuid": "e2c066e8-3c94-42e3-8f66-4924000abc5d", "value": 103387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763629, "uuid": "6b78de90-ca4e-4d10-ae94-675fe7b313ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763629, "uuid": "3cc06070-f1c3-476a-b1ba-15447348f21a", "value": "b4b7c32d4785e175e26c3548a705279e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb28eff-e4fd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710748895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748895, "uuid": "b61b4c4f-34c4-4ee3-907c-465c1cd76661", "comment": "Malware payload (Mirai)", "value": "f386a8d2b21cfe1bd679801b47a459cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748895, "uuid": "deb7102a-7a72-404b-98ff-c9a0619865f8", "comment": "Malware payload (Mirai)", "value": "43423cb075ed5d1ba139b6624c2a1353506b9e6408933b3fbbb0d1163d7b4570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748895, "uuid": "b547b587-6596-486b-88d0-96dba912b621", "comment": "Malware payload (Mirai)", "value": "b40c6457ebe6d8b9dc9338bb950414a74fdc7cab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748895, "uuid": "b1136aee-a456-4bd4-9776-286a115d6d47", "comment": "Malware payload (Mirai)", "value": "3a2081adc002c1f52e54d3d7c6f9c0e91b9a7674eacc83c769ce77a3d5db7b0028995b265e558387f9b6309d906199e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748895, "uuid": "4ee4bd61-8fe8-4bca-a464-e57aa7876621", "value": "T14D133BC4E903DEF8ED5611B111B3F7768B72F03E216DD94BC399D662E8C2601E94628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748895, "uuid": "d0708b03-0b61-4ae0-b731-b1a179d0eaf7", "value": "768:es5GP1LttGOZHMb1ItMklHlo/WDbmvQP+u1uYSKcByF+sgb:l5GPFttGOZHM6hl6/8mv4Zu9fByFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710748895, "uuid": "bd9cf3d9-8cac-4594-8205-0db6336ed012", "value": 43152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710748895, "uuid": "926c004b-d706-4bf8-aef5-1619a88c94b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748895, "uuid": "b8da2614-7ab3-4092-92fc-f1cdcc746b4e", "value": "f386a8d2b21cfe1bd679801b47a459cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4509d27-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751939, "uuid": "25ed130a-1940-4651-9de2-b5269929117c", "comment": "Malware payload (Mirai)", "value": "a4370f0b6491e858058669e929d6a856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751939, "uuid": "555cef9a-80cc-4a34-a479-28d18659eb23", "comment": "Malware payload (Mirai)", "value": "43e92f806df0055acd45a7f70fae2d12d517021dc8fee6c9b8055221313fd6db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751939, "uuid": "9e02aed4-3e6a-4aa4-b7d2-9cffee29a808", "comment": "Malware payload (Mirai)", "value": "38df80847ad06e1073e1e2c8f4d6ef78de001037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751939, "uuid": "1e79111a-a86e-4c74-b754-837ed93a55f1", "comment": "Malware payload (Mirai)", "value": "1da99685d7e89aeafa79ca75eb8be93535ca6f82ab5285e55d2367902d352a7a54b8c789ef93fb9fe251ada1edbabb70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751939, "uuid": "2935b3b6-8a94-4f93-a067-56670dfad25e", "value": "T134533CDAB801AD3CFC5BE6FE80160A19F931366065A30F179697FCE36C321B65D1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751939, "uuid": "a9004bff-46de-4dde-8d14-2d530880ff08", "value": "768:HeBaz0tMQaaZ261DmbgiWJNS5LhZFGGBkdZnCI7PLzTaT+9uQ8yhh5Cu7VqntyP6:HUfi5Lh7GGBmNtH2T+MQ8yheu5q4PG3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751939, "uuid": "5509234e-8609-4743-9000-275d438c024a", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751939, "uuid": "ea2acc6a-39ff-4ea4-b2a3-78c8c58ee082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751939, "uuid": "1d619668-f6a5-4c5e-8c54-b129a561d0ad", "value": "a4370f0b6491e858058669e929d6a856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916c5ff8-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757840, "uuid": "c8b369fa-5159-40c7-8dca-65c872576273", "comment": "Malware payload (Gafgyt)", "value": "9679286328833224e13550fe3c2d7da9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757840, "uuid": "a5fb3268-ea1e-4221-8de5-634262ee77f5", "comment": "Malware payload (Gafgyt)", "value": "44597306569f21feb04ec48729a33879eb6e1efa4d64b52dea67f2f4b3be9c5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757840, "uuid": "6a07e127-b5cc-48ed-9851-0ae7b9ba4ea0", "comment": "Malware payload (Gafgyt)", "value": "0965ba8edc19574617016c5f6b0942e0aceba542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757840, "uuid": "8c61b24e-84de-4a60-b241-9bbc03a85e30", "comment": "Malware payload (Gafgyt)", "value": "2b630a17b32c984b879ea3d3058f2e6e4aa0f1c47ddb562276517813bc18010a45ea6d26007253b44a88c5f88086fe9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757840, "uuid": "82e790c9-5db0-40f8-9508-f1587ce21259", "value": "T122A31A41F9408B27C2D327BBE7DF439D37356A68A7D733116A346DB42BC57982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757840, "uuid": "04e209d2-8b32-48cd-97c2-73e7bf19938d", "value": "3072:nsG9Ozc4g+fqR+11W2dbQTmRfjQvyZVy8Ve:N9Ozc3ASk1WNmRfjQvyZVy8Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757840, "uuid": "f9183487-0225-4f97-aaa3-9686bb16e084", "value": 98897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757840, "uuid": "1dcb1866-3219-41e0-8c09-1bdde90a0a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757840, "uuid": "df841e0e-f12b-4464-9498-92fbe271606e", "value": "9679286328833224e13550fe3c2d7da9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ed0654-e546-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1710780156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780156, "uuid": "d3a6401a-7089-40a6-8214-2d80f1677bd4", "comment": "Malware payload (CoinMiner)", "value": "b03c2d7df7eabc44f36397cb66ac3e77", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780156, "uuid": "9019e764-544b-48d7-90b6-c11046e773fa", "comment": "Malware payload (CoinMiner)", "value": "4489ff33e7a91c7485a1c1dd8a6102868e385f74fd8b5dbdbf4b505bbe9193b3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780156, "uuid": "4f84b3a7-ddf7-456d-a3e7-6ee25aa9abd9", "comment": "Malware payload (CoinMiner)", "value": "486f521d16d96878a74ff9212cf2da5b184e0430", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780156, "uuid": "b7bec646-77c0-44d7-b000-b3b28cbba374", "comment": "Malware payload (CoinMiner)", "value": "579c6317518123b23d9e34ad9b850355d1fbc6418d808b8a0aad151bd187a0aeeea3f6cc8c2060e2de10a7984faf2493", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780156, "uuid": "b8cd9d57-0c4e-4046-9eaa-1e711f4794a9", "value": "T1803633982FA0C7ECC68D04B482536A555330F4E165A0EF4CE9168D8E4D527FDE3ABBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780156, "uuid": "ef831760-a4dd-49f6-8913-8f02ab3685e8", "value": "98304:22gWGh4M2YYF05TqTcAJ5ubzxFAvJWJkC0dLM658jmpMJAxmEjmiFDzQbTMo7KlJ:22gWGh4M2nF0pqTcA/gFonCu0SmEDFD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710780156, "uuid": "7e725aa5-2d68-45ca-8466-d0835d18dda2", "value": 5227008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710780156, "uuid": "996170bd-368c-4889-b753-6af2ec1f1ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780156, "uuid": "7387a16f-ed69-4101-95cf-4b3ef80bdce2", "value": "b03c2d7df7eabc44f36397cb66ac3e77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25fd3d4-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749332, "uuid": "ea27e9a1-cd39-4beb-87dc-6249299863ab", "comment": "Malware payload (Mirai)", "value": "063b13b043ce2989b93c8549d68f9142", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749332, "uuid": "63d1815f-c497-4df5-8c5f-46f59e589a58", "comment": "Malware payload (Mirai)", "value": "451fe6c277b998232608bf17da1440098e585bcac61b7941cce7c138fb7612ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749332, "uuid": "89240879-da80-4db6-9f67-97fbecc1ec8a", "comment": "Malware payload (Mirai)", "value": "a6283e430f8f0ca06def2d53c36c2f7f06dd701e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749332, "uuid": "71907131-9651-4771-8137-a154b6b4b5b8", "comment": "Malware payload (Mirai)", "value": "626d23b5779b7e1974adf290f62c79e5e4370bd9a12921d841b5e4d0d79655ccd9ec9fdad5dc672750933c307f319256", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749332, "uuid": "2f112f4c-d62c-4f30-981a-b2f750d360b9", "value": "T13D434AC1DA83E8F9F81A01715176F3378B36E03A126EDA47C768EA72E842641F61735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749332, "uuid": "d073035a-527a-40b7-b3cc-4d47836f89a2", "value": "1536:r4X2uZmBFyF7M/yBFT9mxF9s5b1WOgjflb6cJxS:kXV+FyFQqThmxF985h6p6mxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749332, "uuid": "dce2bf18-7af0-44fb-93e6-294477628b2c", "value": 55408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749332, "uuid": "ab388d3a-9c17-4fc8-aa75-6557b7dd671f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749332, "uuid": "4031fe8d-ec26-4d55-9d39-a2f737e5e31c", "value": "063b13b043ce2989b93c8549d68f9142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0c3a04-e547-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710780781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780781, "uuid": "c076f256-ed7d-4b22-96d4-0b8e1c6da658", "comment": "Malware payload", "value": "268007760567310e9a6abfa2edbce02e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780781, "uuid": "7421d6c7-2df8-4614-9bf7-96d41e983762", "comment": "Malware payload", "value": "45386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780781, "uuid": "ea71716b-4865-405a-9b95-7446d463336d", "comment": "Malware payload", "value": "3417776a79553cf0136e8f890b789806272badf4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710780781, "uuid": "cd111cc1-c50c-4e04-a476-2a75cc32cb19", "comment": "Malware payload", "value": "911efbd0fa78ab3de5e08fa725f305bd78d3b9b780fa4e9a208bb3bfd76bae64b49ddc90b5886b2f61f25901ea886dcf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780781, "uuid": "e1a669ad-2add-4ff7-875d-86e80007d3ec", "value": "T10A43D048E78BCCE1C660A576444F17797735A180CBC0FE4E8A78EC720BC67A52F5A8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780781, "uuid": "1409b122-76e9-4c35-9996-fd7b2c8e7f76", "value": "768:bnaZ932qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD13zegYN1T/wRI:gJ2u4OPKIxoEuDKNzexToRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710780781, "uuid": "f8638403-ff34-4bc7-8c0f-805ea48139c7", "value": 58894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710780781, "uuid": "ee067344-fdcc-4788-b43b-d5c0e5403e00", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710780781, "uuid": "192a595f-0ad6-4282-8281-7f1fe39f2546", "value": "attach#6081-18-03-2024.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61e72b3-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751996, "uuid": "d309ffd1-1022-46fe-af98-1f5a88144623", "comment": "Malware payload (Mirai)", "value": "791bfe5c18fab34df6320307aecae26a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751996, "uuid": "137c3ca1-0257-4cac-92ce-4ffd993ec4fe", "comment": "Malware payload (Mirai)", "value": "45408133342b4cf4a0a75da0d8fe32bc2239a84fa9fe8968c44ef49f0df6ba86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751996, "uuid": "3526e2e6-ebcf-41e3-8d0a-470050a897d2", "comment": "Malware payload (Mirai)", "value": "aaffe89f6e35dba9b0af9e1d05b737fbba9192fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751996, "uuid": "dd68ba1a-3652-4ad0-96eb-f85e4e2dfaf9", "comment": "Malware payload (Mirai)", "value": "7e8eab0a2b6f6711795e2badfb021ccdb6ecbca943cc931073719ad8ca12ec20b54d1f255620854befbf4a7a15f889ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751996, "uuid": "919569f2-9d5d-4c9b-9523-e99b70c51b72", "value": "T15F142ADA9F5A7DC3D7D40334D98E8A30A12C71F8581A929B69680278CDE7A49FD143CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751996, "uuid": "e3974583-9fce-4566-9803-89ef905c4e8c", "value": "3072:vVDwdqs06VNrw4iqS17QEgkksL65YvYsL65YmgHjsL65YzIWcZ50HvC6EuXlLgft:XfMENJeMXyq0zGjnjw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751996, "uuid": "a544dfa6-2e7c-4bf2-9b7b-c3bc8533c51b", "value": 199040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751996, "uuid": "54affcd3-752a-4b84-84ae-d3f6c12f44d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751996, "uuid": "4b3bd0cc-7f10-4bd0-8bdd-499539715a60", "value": "791bfe5c18fab34df6320307aecae26a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab5371a-e52c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710768808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768808, "uuid": "34685d72-70e8-4872-a45b-ddea9e109eb4", "comment": "Malware payload", "value": "b5f0ed87c2bf4b9c7581dbbf3378391f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768808, "uuid": "4b969f2e-7f52-4411-a162-0dc6dc3310d5", "comment": "Malware payload", "value": "459a487f878041e1c2968d416ebe4fcf021a754c5538f979999294c998902a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768808, "uuid": "092a4570-93a7-47d2-af1a-a70a35f11065", "comment": "Malware payload", "value": "d28e1cbc90a683ff4c45c97df8a51a8a2e664c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768808, "uuid": "00aa453d-2de7-4802-8fbf-d39160f4f24a", "comment": "Malware payload", "value": "6a050ddd854b85d6fb0ecce894600b788b447059af829710ce28a696193c47497b6a296cd0b84efd2201e4bb8a64b790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768808, "uuid": "b226d6b3-651d-4578-8551-272435aec55e", "value": "T15E05232052A4D43BC5E7497369AA053B8DF576387B548C8B6790E134BE807D3EB6B30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768808, "uuid": "14c3c728-0a9d-4d62-a000-79a83a08b3c6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768808, "uuid": "b288e51b-6150-4548-a10a-5c34ba7a63fc", "value": "24576:wNyEZMPlCqpblEMtLrKr3orESk42vyBSokMCId6:Qu9C+4r33S6yBKCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710768808, "uuid": "8b1cc736-c198-4505-8a7c-e856778ac864", "value": 864206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710768808, "uuid": "be7e93f0-0b3e-4a72-9a30-3217c1121f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768808, "uuid": "219b0b0e-2f8e-48e3-b30d-ccc4e20c1b0d", "value": "FailureFlooring.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e13278-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751907, "uuid": "2562add7-fec5-4be0-8e7f-a871926cf7e7", "comment": "Malware payload (Mirai)", "value": "73496469574981b829c9f6c82bdae481", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751907, "uuid": "0d98b72b-b627-41cb-9563-902feb83b6a0", "comment": "Malware payload (Mirai)", "value": "45f4b0519d8ccbf8bf52513e8bb5aaf9d489a985bed832b5e92b8e0327de46ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751907, "uuid": "46737a34-9d0f-4a0a-be3f-f66a2d4f5e28", "comment": "Malware payload (Mirai)", "value": "56e0bd8512d6c261f188498dfc623c53e0ab09d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751907, "uuid": "6551d559-5b46-43ea-9257-30254dc85a5d", "comment": "Malware payload (Mirai)", "value": "7e166a500865dddabed6b648a65dfeb0848f1b60c98cff2269368bf2442e14f1869990c61722a8abe952417ddf6800b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751907, "uuid": "bae13940-8aa8-4092-9787-0b68e94a805e", "value": "T1B153F856F8918E11C5D412BAFE2E118D331757A8E3DF7212DD206F247B8A86F0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751907, "uuid": "a115b30d-41c8-4574-96d5-2ec1df7500b2", "value": "1536:Isn3I1ywIMwShSdj7gF5OTz/Icsi0mM/1z3:gMwISgj7gFPmM/1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751907, "uuid": "6ce85ea8-7f15-42c4-8515-61f96226a7ee", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751907, "uuid": "625f6fa4-d83b-41e0-8e77-3de415fb4f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751907, "uuid": "51cd6d28-1924-4ce3-9bc3-c7a1d048f0d4", "value": "73496469574981b829c9f6c82bdae481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2778a7-e4c2-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710723311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723311, "uuid": "7e303005-2016-41b4-bd73-a10f324abd16", "comment": "Malware payload (RiseProStealer)", "value": "54a37beeee075e99a575bf4dea382355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723311, "uuid": "295595f0-3af6-4f85-85b2-44cfd2f659bf", "comment": "Malware payload (RiseProStealer)", "value": "475aad5c306abea31ff132421b367371bf5719724e273398dcf65cbf550b5f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723311, "uuid": "71b7f28d-2428-4c69-96c5-f9a2a6158ef9", "comment": "Malware payload (RiseProStealer)", "value": "90150ec7d2feaa1e0d27901d1c4724a1b03d35c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723311, "uuid": "18eef49c-5902-4015-a600-c8249c03531f", "comment": "Malware payload (RiseProStealer)", "value": "71cab2f710670494b30ec6221f3debd145a89acfe6c52e409ac7120ecbcaa8549bd2da604065e704ded1fcb6dd5f481e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723311, "uuid": "d07e38e5-1ae1-438b-8efb-578d6d57eae2", "value": "T16DE53972B44EB1CBD48E22788467CD839D7D42BA472148C7A8687EBE7D73DC116B6C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723311, "uuid": "3ee1c1d5-59d8-4edf-9d8a-1bec0bd5ecdc", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723311, "uuid": "94da384e-45a8-42f6-9eaf-2e89c23fa5f8", "value": "49152:zCApvcoXZqAeb3n+KBYmz0w0iXU6Szuc9qDJCL:zCJoXs9nlBtIw0ik69cUcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710723311, "uuid": "d85f123f-e451-4a9a-82ee-94f3a2adde54", "value": 3269120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710723311, "uuid": "b12c1f0d-4ef8-49fd-bcc3-fb8baeb461cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723311, "uuid": "f19ad895-82cc-47a2-a676-9daeca650382", "value": "54a37beeee075e99a575bf4dea382355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa08c2d7-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710751869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751869, "uuid": "54ab1fb7-4f30-4719-acab-fb550478d658", "comment": "Malware payload (Gafgyt)", "value": "2cfcc298fa73857997427813de0b0782", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751869, "uuid": "748c44a7-1cad-4c8a-9491-cce672c86487", "comment": "Malware payload (Gafgyt)", "value": "48bc8ae0c6c6c3fdf04c92686c3ae206ac20342e8178bdebeb9c26f587380efc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751869, "uuid": "4d00d927-2049-4121-86c1-3c7fbba6ab2c", "comment": "Malware payload (Gafgyt)", "value": "5b1a53c473be0a68324211e7c3a5a651a63b2b2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751869, "uuid": "270c97db-ad83-4840-9162-e643e8064a63", "comment": "Malware payload (Gafgyt)", "value": "4cbfcc30feb952930331bbd962ce4bb6d8c41f3b3bd6f8b732f11e6494c807e14401b919ed3f5e82f41574ca5dda4057", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751869, "uuid": "049f8d98-ca21-4d4e-bae3-4901d6bdda86", "value": "T1AD3329A7B404ED7CF82DE77F4467040EB131B36054C20A6573A6A997AD7B2990C6EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751869, "uuid": "f678495a-a818-4cfa-90cd-ff4b6e201983", "value": "1536:30t3EAtEw0EwsEAqEAeJEwsiW/Kd5j8S+wZNsoTtnfaarso75Z:Et3EAtEw0EwsEAqEAeJEwsiF5n+loRfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751869, "uuid": "b2f0c60f-bcfc-4ba2-ab16-2cb8c7d5b366", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751869, "uuid": "ecae633f-b7df-4289-bdd9-af1655154f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751869, "uuid": "eabde121-7fb8-4d99-a695-8d45ce106c5c", "value": "2cfcc298fa73857997427813de0b0782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63dcddb-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710761875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761875, "uuid": "241a6aaa-5f34-4dc1-8795-1b4c41f7cd8b", "comment": "Malware payload", "value": "62343ca7fa437f07c64f2f0159381c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761875, "uuid": "5c1ef456-d510-40a4-81ea-2d849e9bb1e8", "comment": "Malware payload", "value": "49e780189a89008f2de497964819bf361b58cb7fd6a9a19ee8c78e063e78e7e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761875, "uuid": "9b1684fc-27e5-475c-ba37-22c0a155ab6e", "comment": "Malware payload", "value": "249499dd2d0ac8284582347f978db1384e65c4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761875, "uuid": "6ca65bbf-2cca-46f4-8de6-914c282d2537", "comment": "Malware payload", "value": "5425763ba74c16b623bf8d1dc698275469dfead177696aa97874d63be73569392a82ca974c076896f567dae02e244b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761875, "uuid": "7e2c547a-e386-41a2-8f4e-fd486c29293f", "value": "T144B4E0343AEA901AF173EEB69BE4B4D6ED6FF7733A06A85D1090038A0613A41DDD153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761875, "uuid": "9446ceaf-5040-4556-bf0c-de51df6844d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761875, "uuid": "4878cf62-ab42-455f-b298-bdced86212ac", "value": "12288:u5dpUvt4snXViwOByWYdJNp4mIAYgM8JoRlRFOQ3TkP:u5dOlLXTs6JNjhYgnoRljOaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761875, "uuid": "ce21320d-1882-4413-9488-95d1a7260b8b", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761875, "uuid": "2475097e-79fc-4248-b856-79677ac99d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761875, "uuid": "56cda90f-92d8-4c90-8c89-ce5919ff510d", "value": "SecuriteInfo.com.FileRepMalware.27597.4045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfb998e-e537-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710773912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773912, "uuid": "99a99107-e4c6-4fef-a515-97edaee67231", "comment": "Malware payload (RiseProStealer)", "value": "0f09286d0564589399c7b59fa150ec51", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773912, "uuid": "2c71118b-74e4-409d-89e8-d7d5dd8b36b9", "comment": "Malware payload (RiseProStealer)", "value": "4a009d7516245a7af1dbc74beacd149316212a8cbd045132e7f95118bfafcece", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773912, "uuid": "4b43fe58-9e62-4522-8851-5be4c9fe795c", "comment": "Malware payload (RiseProStealer)", "value": "3c675f2710f3fb7b4793de2a10ed76c2646ffd82", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773912, "uuid": "d75d8c03-9c00-4af9-8bc2-ea9b88b0c09d", "comment": "Malware payload (RiseProStealer)", "value": "f29722a86c92b45f68157fa9ffa2f4334d6fd8e3485466f24ad78e5fac68f88ae54d8945432033e560c50577242d0abc", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773912, "uuid": "11dd6b92-ff84-4630-b5d5-984ad77f5442", "value": "T1DF362325EE12C9C7C0996B75DDA78E197372C0DB9348935682BD05BACDC23180CEF6A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773912, "uuid": "2a4f4dca-b1c3-4236-9e71-8ea012390017", "value": "98304:9uEr9EEDARts9w9IT+Lgd3zYYjtB+kB4fLSgeZW9gNvjz:4EhWRtsS4/+YjC6427M9kvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773912, "uuid": "0a7a3a97-e1e2-4b5f-9596-251033e31d58", "value": 5099805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773912, "uuid": "9f459c54-2c6f-421f-a9ec-d3fd0579f9bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773912, "uuid": "5d7ae3f3-4f9a-4340-8756-977e2d2094ef", "value": "Uemlxaw.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebae8a72-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1710745536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745536, "uuid": "6659593b-26e0-411b-b147-32278c9ccb2f", "comment": "Malware payload (XWorm)", "value": "6a4b0912077f377219d24d4ed0fc4c9f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745536, "uuid": "fc07cff5-3cf0-4553-9046-9b4c25ac8879", "comment": "Malware payload (XWorm)", "value": "4a3ec6f4f6b79baeabd7d0c4a9f4e043693fa72062573e252d53b70ce3d929a4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745536, "uuid": "7e8c170c-eff5-439c-98b6-e91175d91686", "comment": "Malware payload (XWorm)", "value": "0639c2441a7a77c94cbbc1fe5865cb03d5d6f6ed", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745536, "uuid": "bc04b9a3-578a-465c-b68f-e431a13c66ca", "comment": "Malware payload (XWorm)", "value": "a41610993829ab90ea15936000d08daa0994f1ae02eb3b2d01586be86564990cdee6050c7fe155a47da9eb5261793c55", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745536, "uuid": "a8bc8887-9ec3-4428-a89a-0677d23e3a01", "value": "T1E5716E922BFA1504B7B3AB04A93437794B377E5A547CC68C49B00D9D1EF2F00981ABB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745536, "uuid": "008ae713-dd49-4bb7-bc07-c73cb3372fd9", "value": "96:480AZHQ9WIJKNMLR24MzYYCQjinVf8fauw:jw9WIJOM1TfYCSEUiuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745536, "uuid": "4cee02ad-fc34-4827-9931-dcd28de502d1", "value": 3698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745536, "uuid": "f6518eba-1599-4cc0-8085-0e4d939ee866", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745536, "uuid": "42ab01fd-81f1-47a2-8c7d-c0b09f562399", "value": "invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d957f49-e52b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710768491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768491, "uuid": "27b8c53d-3326-4d71-8769-6ee58efd3624", "comment": "Malware payload (AgentTesla)", "value": "999fd16b07495cfaf344e58fb35307e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768491, "uuid": "b7520f02-aed3-4a9a-be13-dd2b92b4e136", "comment": "Malware payload (AgentTesla)", "value": "4a5703d771554661fa318e46b5a16ce25f53c82544d974bdf38f440dbc7ba3dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768491, "uuid": "b2a375bc-aad4-4437-9613-042bf519a772", "comment": "Malware payload (AgentTesla)", "value": "a4134a8e130938faa1213691318243b036a9f771", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768491, "uuid": "76044836-d691-4503-820d-bc08a9c7e1c5", "comment": "Malware payload (AgentTesla)", "value": "b0a10b3447c41f44bb536fbb8905217c7010163f16520d648652ff2a1466e3614120efc22ce1818a484ad401ca677da7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768491, "uuid": "4dee0a76-bb68-44e0-b7a7-4b209b302ac0", "value": "T138D4E02067FC922AE6FB4B7AF47188604771FD12B921E64E2DC43A9F20B37958153727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768491, "uuid": "2ddaedd4-6050-44cb-ab18-c4fa0eb0337d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768491, "uuid": "37f0f89a-dd7b-4771-81bf-73cdb2ee7420", "value": "12288:m9V0tAlesYzgNYTVhS2QP0M2+7FkzEDeoIxf:7A4sYzgNYTVhS2QP0M26FkQDef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710768491, "uuid": "4104fdaa-b72f-4152-b495-9274959c632f", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710768491, "uuid": "194c4806-65fd-46c0-99d5-5997448e7198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768491, "uuid": "68457227-3539-49d3-8cf0-8abc3cc2032d", "value": "emozx.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b0a3cf-e536-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710773338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773338, "uuid": "eefd9142-c031-4be7-bd4e-5801ad07ea8d", "comment": "Malware payload", "value": "0693515c29a762cbbd31e85f92e53340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773338, "uuid": "b43004d5-a20b-45d2-9093-32fe1ae5f404", "comment": "Malware payload", "value": "4a90ecbed95c8c2539aa9b5b0f888337dde206b60cb3a03e2a1d7025ba928153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773338, "uuid": "7f32c266-2367-4d5a-80e8-87f8839c17ae", "comment": "Malware payload", "value": "45d09330bb7d418113ab392e9e91eaedf02d9242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773338, "uuid": "8323ec6b-761a-441b-b835-7727ea7a8b66", "comment": "Malware payload", "value": "cca1f09c922c31ccbae8a204fb81ab5c95bc5b247d0054abcbcdb8a5a8abdf914bf1c487f181a6a1b92049b50c4a49b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773338, "uuid": "75d13ce5-6923-49ae-9706-da4cfb9d1604", "value": "T17876236639459D84C96C04308A5AECFE32753D768C808EA371F97F9F9DB21E4793B206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773338, "uuid": "ae3c291a-c0c9-4b76-a8e8-74fb033a432e", "value": "ba4ce0cbe832b3560bbc7a0c6d1fe182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773338, "uuid": "7cf15b3f-9a6f-4883-8c9d-fd82ee0a52d0", "value": "98304:18LUmJdYqUXScfTVSj9wI+IKhEJmlznz2ZeBPaI8fjxHzKvCpA01d0Jmc4aThyuR:f7XSq3IpReb90fjxyC7YCmh3UMGV7ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773338, "uuid": "15f839f1-1ad9-48e6-8b66-cbafb3770da3", "value": 7236096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773338, "uuid": "af0587a8-61fb-4fba-90a1-b3df2f59fc97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773338, "uuid": "01551f4d-1615-4a52-9505-fa76b0b354b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add002f3-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749298, "uuid": "fda78b3f-60f7-4dc1-9b5e-26cf211135af", "comment": "Malware payload (Mirai)", "value": "32566edd1f577a6c2e542ecccc047891", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749298, "uuid": "a8e68733-265c-46fe-9723-5a7672c1ce0a", "comment": "Malware payload (Mirai)", "value": "4abfccc92a769ae03067212acf86a72b9700e69d0a1cd6fe78eef85ce09d29fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749298, "uuid": "ca8907ab-74e5-4777-85a4-93bdd78ec845", "comment": "Malware payload (Mirai)", "value": "11db2c199dd240025b137d68b82b6aa188ade3a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749298, "uuid": "0821df59-64a6-4d10-a7fc-9248a709ac39", "comment": "Malware payload (Mirai)", "value": "dd29c37af385b5e66d1429fb505f9825c4d2cc6e65ef210c6991d86b46b53d0e8d06d3570e030db570bf7db73c8ba46b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749298, "uuid": "072a5f63-9a36-4859-9fc1-6bf9407cf247", "value": "T1EE232AC0FA4B84F6C55B493050A3F23FDB32E86951B0966DEF8A9F71DF67641921228C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749298, "uuid": "4eb21d54-42a0-4506-a8c7-b449c1187112", "value": "768:7em8xB0XQfqswUIzv8FfDNf5tH3Rm/qoaxrjR5HKO6OqWKpYK1fsrI:oxB0AxIzUZN5tXkOBRRKO6OCpxis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749298, "uuid": "4b245c60-b6b7-4a7d-9783-449a0fc68785", "value": 47888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749298, "uuid": "3cbae40a-b254-48ad-b235-d60515829bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749298, "uuid": "08b1ce6d-482e-41a6-96f1-c3949ebf15ac", "value": "32566edd1f577a6c2e542ecccc047891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96e321e-e54b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710782362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782362, "uuid": "32b5a76d-5514-4235-9fd9-1ef32b311fd9", "comment": "Malware payload", "value": "3656ebbfc2cc7443efe6d4a33149d9d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782362, "uuid": "0ef054e3-aa31-4720-ab2a-2c3604d11e68", "comment": "Malware payload", "value": "4d25de54209bb650ba88a8a5a12efa6300d487782105478cf4061bfa0fdbc3f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782362, "uuid": "bef93089-d088-472c-ab1c-b1b7e6bd25d4", "comment": "Malware payload", "value": "8bc59244d31194c2b610d9d7a81c6fd82d63aa3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782362, "uuid": "5ed0d3f7-e995-40b0-8e79-d36cb65ad628", "comment": "Malware payload", "value": "16eb75f7dd80f1c4a0f86168fcc18da8700fd85dd704a7dc51ebf21a7b438236139775132e98ff48532ec1f4f8ef1a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782362, "uuid": "392f6c09-ac5d-4f62-a8fb-086b390324dd", "value": "T1EC767C07F89565A8C5E9D230C6758252BB71BC880B3037D32B61F7B92A73BD4AE79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782362, "uuid": "f43f1ebf-2413-4138-bc4f-02289ebd40e7", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782362, "uuid": "2096b5fd-55a9-4fb0-b12e-c63a2f9b3fc8", "value": "98304:O3yv9hNTwKzgUERoCCIOwTUcUB0LXp5wMU3aB0:GK3zWuChUh0Z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782362, "uuid": "e5415cbe-c1ca-44a6-aadc-cce833eca6a4", "value": 7142400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782362, "uuid": "36320c2c-d7b5-492c-a65d-f59111246a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782362, "uuid": "08a0b7cf-5f1c-4bf9-9664-38d2706961fb", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b3c480-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757816, "uuid": "ff735d16-d82a-48ff-9046-8f101b2ad4c8", "comment": "Malware payload (Mirai)", "value": "b20e3ac00d9dfbd41ec00fa5ecc5d4ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757816, "uuid": "4dfe3e35-fa7e-4e57-afda-8eb0e33d54ce", "comment": "Malware payload (Mirai)", "value": "4dda17018b0a3ce312b50db7d9c45aa692e41cae4b259bf03fd41fb9d8974c42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757816, "uuid": "03a5bc18-679a-4ada-843a-0b88fb1d76cd", "comment": "Malware payload (Mirai)", "value": "567cc6f61354fc5c11ba632c68aa3c7e09d001d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757816, "uuid": "b224bb24-9d49-43ad-bcc3-e0705e6236c4", "comment": "Malware payload (Mirai)", "value": "6162da0eec8dff7cfb488c00de1be65b3cd941f9517386891634be51e8e3fa3b27ac7996602e358fe77961f023150a12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757816, "uuid": "047b1624-c234-46ff-9f7c-1a68c3be1fc2", "value": "T1E5634BA3BC00EC7DFC4BE7BA80630906B631F3554A521B376757BC67AC321A48966F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757816, "uuid": "3ded2801-09b7-40c0-85b4-35d333553877", "value": "1536:6FD+gz38F5BjM8Whg6s7d2itE85OXGqt+bHmRrmDS/KsNEVpLf:6VkjFjg3s7Qitet8H4rQvPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757816, "uuid": "555b4ce7-491a-4fe0-ac8a-15d3e5bd5337", "value": 69100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757816, "uuid": "d25f68d1-3979-494a-beaa-e1c8c29659fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757816, "uuid": "97d26266-0703-47d9-832b-fc5c6e21372f", "value": "b20e3ac00d9dfbd41ec00fa5ecc5d4ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7085542-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757903, "uuid": "29f1268d-2dda-439b-b0c4-77df495c2d84", "comment": "Malware payload (Gafgyt)", "value": "1b90701ededa91f0c022fbe0f737931f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757903, "uuid": "d4a0d679-4a9b-4b0d-b66c-3c637f5f0ad2", "comment": "Malware payload (Gafgyt)", "value": "4df268c7ff254ac9c8760d70183f6f80ad1f4ee7654244eec6aec7ec233cb62c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757903, "uuid": "d5fd021d-a61f-476b-b6fa-90283cadb36f", "comment": "Malware payload (Gafgyt)", "value": "da0c28d7e44c7c56fb6964fd9b246c9ba1a940ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757903, "uuid": "c2c7e463-53c1-4ff1-b9d8-dad2e5075883", "comment": "Malware payload (Gafgyt)", "value": "e61763276c6ebdd6847a81acab05fbefc6a081bf29bdb2fda3cea0a39e077884a6783e0cd6794beefbde6d2439c38354", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757903, "uuid": "7da7fff1-4419-48a8-beb2-5d762c881374", "value": "T172833987A9619FB7C08A6AF529E749300713F8515F5F1B89B139AAF4030F9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757903, "uuid": "2b26572e-d614-4490-beea-62038e50b90b", "value": "1536:rFkWkvEz+dvYOOPAKHUxlTOH4uCxVbhjqNVg2p0zymjqs91UlOK4fe:RZklOPHHAOH4ucqNVEOmjqs91UOK4fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757903, "uuid": "2fd233af-7390-40e6-a95b-fd3de3418111", "value": 84210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757903, "uuid": "46fb180f-2761-4a09-aaf0-cf70564cde18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757903, "uuid": "9f7a385f-2e8e-4c0e-9b60-b9c247875f7e", "value": "1b90701ededa91f0c022fbe0f737931f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf4f7fe-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727394, "uuid": "7d5bf6cb-b393-4643-b75f-c84a8d8b63ed", "comment": "Malware payload (Mirai)", "value": "d8e73b66dd29c961a01f32d6d07209ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727394, "uuid": "4788eeb4-ebef-4205-8ab6-768fb9cb34e5", "comment": "Malware payload (Mirai)", "value": "4e5394f7297014a819279a99523eda9e4ae499c5dee6b92112a7ec9285d2c9c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727394, "uuid": "3bc046a8-fb56-4734-b073-2a1a8686ee4c", "comment": "Malware payload (Mirai)", "value": "02916f93200200256733b2b16dfebce37cd56c37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727394, "uuid": "8df09e76-02a4-46de-8a88-0cdbd1632ee4", "comment": "Malware payload (Mirai)", "value": "0f99d8faa73c2fafe872b10308ffad9e838ea700d92c5de1c5fae9f5739986321afc30291fca0db7e49f2c648e3535a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727394, "uuid": "2eab62e8-9f0b-460a-9980-230101fb70ec", "value": "T1F4D34A17B5C180FDC4DAC1B44F9EF536DD32B1AD1238B16B2BD4AA221E8AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727394, "uuid": "2a96b55d-d4b8-4125-99de-9bd0808d127d", "value": "3072:tGtwnNiaOnUTfFqPT9OSQb8xOaogjV2i5lY2CXR3AhuPdL:tGtwnNiaOnUTBSDLOuhuPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727394, "uuid": "58a75084-188f-4f3c-a189-08165366f3bc", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727394, "uuid": "9974aca5-1466-420b-9a3d-b3eab560431d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727394, "uuid": "641d7d9b-2258-4d85-88a5-c3734790bead", "value": "bot.x86_64-20240318-0203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2bc3fa-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710745299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745299, "uuid": "754e8065-849a-4c82-9e86-7022031a3d10", "comment": "Malware payload (GuLoader)", "value": "768a57a9a99239795a105eb3074c1d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745299, "uuid": "cbfb8692-17f5-4b07-80c4-c8f2fb4f6653", "comment": "Malware payload (GuLoader)", "value": "4eb1875bd3667d194c62770523cf6436fe5ec1f69734d73759f6b910abcb0cab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745299, "uuid": "1fdf90d3-41fd-4915-972f-e3f34034df45", "comment": "Malware payload (GuLoader)", "value": "1382af2bf44d0e7fa9c2cb449208845d70654cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745299, "uuid": "ddab0c52-698f-42ec-ac0b-1cc00b48aef2", "comment": "Malware payload (GuLoader)", "value": "54ca002dd9cb4737119f6f9130dec17b9b4134539ca0dd2f3fa8ec8e0117c7138d1b5eedddf3d3d63293e35ca6edf413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745299, "uuid": "1320cbbc-8664-496d-a8f8-c3696352c7a5", "value": "T1E6D4239438D25463F0E716B1CD7BDBAEF36A601F07241E4B4B567FED2C3858389846A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745299, "uuid": "22a85f44-4147-4bd9-b824-ff65edabea82", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745299, "uuid": "fa3e2c58-1241-4e34-a14c-f5536fe92dda", "value": "12288:hR2VviPrROKeuBGUchS4IH0Svol1pWQ2fKnFLKVsRxBIu:aVvXtujl2oQ2pVkku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745299, "uuid": "785f667c-a857-4f81-8f9d-72c051d27963", "value": 631184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745299, "uuid": "98aafb24-66dc-481f-8d10-0df432f1eccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745299, "uuid": "60b28da2-968b-4562-b1ae-a83dea66474e", "value": "AHL STEEL REQUIREMENTS - Ref No 240318-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21daad0-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710745520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745520, "uuid": "c7d50fca-d51f-49d4-b979-653cdbea1ca1", "comment": "Malware payload (Formbook)", "value": "3af21360adbb6bece7bda51390736e8e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745520, "uuid": "2d5656fa-f686-4a95-8872-63274723077c", "comment": "Malware payload (Formbook)", "value": "4fdd79b1b60575e0e10c37a7203f6c07ed57f17bbba740c2c592e2aa668963b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745520, "uuid": "89b93c90-6bc6-45c6-87b8-af713a3e5201", "comment": "Malware payload (Formbook)", "value": "71249ac1ab3ea2703c4f8d652ba6026e396481ae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745520, "uuid": "145efa95-41c4-4d5c-9954-e765957d30a2", "comment": "Malware payload (Formbook)", "value": "a85de5b1fae3141443a44dcb5b98d5fb1920cc2c52939ca9ac0313a8a492e8a1f2dbd050a515ce553d1268545cd25bd6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745520, "uuid": "9acf221a-4ea0-4ee2-9b87-c557d0faee34", "value": "T19AA423B92DA9BDD7433AFCAF702A09531F04178F9A5AAD3D3184189312F2344EEBD519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745520, "uuid": "aaa43a92-dd41-4525-9118-469913f425df", "value": "6144:xaKcKwvmmu4I3j0Bcz26Y6YAD0RX4ObivYiVrW60WKpVK2wo0QxnlZWzhAbsJrhI:Zw7uLcAYDX4ObinW60zItQ7ZqhAYzhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745520, "uuid": "fad43c84-e135-4a5b-8af8-e76b5c4dcc42", "value": 453764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745520, "uuid": "b0d6e2a6-5871-4163-a835-ecdeb4914ee0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745520, "uuid": "f130b344-a1c5-41af-8f43-606b5dc5e46e", "value": "55,000 receipt 18-03-2024 _PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe41690-e525-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710765971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765971, "uuid": "a61f3c69-555c-42ad-a080-d861476bdda6", "comment": "Malware payload", "value": "f2a29d3104b163de12337fc7a83d4bdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765971, "uuid": "be4eac3d-8a00-44cf-a9c8-8e495c79b6ae", "comment": "Malware payload", "value": "501ab305c1a04e2b0704b73a720ef4eca4a713932dfffa0f199fa99c940fa921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765971, "uuid": "c09d0cdc-9e56-4b2a-b6e1-c44c6c2cea87", "comment": "Malware payload", "value": "46658b4d53558f481569a8fd4146823c3d714fc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765971, "uuid": "8c28b745-c294-4b96-93ad-c908474435c6", "comment": "Malware payload", "value": "a93a4c2e0e671cbadb6168625787fbf5b8d99d29d432edc7f856c7770d4d93529fd56197710c1b5c1d46c80521f9d2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765971, "uuid": "4ec4f7b9-e1d5-450b-b8cc-0271768330a1", "value": "T1A1234BE2B500ED7CF81FE33980074904B135739AA5522B376BB3B9779D371980876E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765971, "uuid": "24803a7b-cb0e-43a8-973c-a13c2e74a2d9", "value": "768:es4tE9yb3dgKdnA4vMbr1oOspFS0Oy8qna8dRJldZsUHG3N0v7EvEul:esqEy3dgCnA4uojS9y8qnakJzZ/HS3v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765971, "uuid": "ee6480a4-fc17-459e-a105-29f3f04afb0d", "value": 45788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765971, "uuid": "d39f2ffa-894a-4480-afb3-f69541572de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765971, "uuid": "518160cb-bcb8-432f-a59f-ef1bbfec276d", "value": "f2a29d3104b163de12337fc7a83d4bdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f19e85-e544-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779422, "uuid": "cb95156a-cd70-4bae-b2dd-5b631c6956bc", "comment": "Malware payload", "value": "0516f5400f226df3ac36769ed8273ac8", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779422, "uuid": "c39edc1c-8757-4e95-9d6b-5dde2300bb2d", "comment": "Malware payload", "value": "50cdd2397836d33a8dc285ed421d9b7cc69e38ba0421638235206fd466299dab", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779422, "uuid": "371174fb-2b6a-4daf-be6d-9fe774ed3174", "comment": "Malware payload", "value": "8117dc7922e2ef95efca381316a7267b4a9f4791", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779422, "uuid": "863f957e-894e-4a33-97d5-2d4028a925ab", "comment": "Malware payload", "value": "32b863beaa3a3e6fa7f76a86a0b8f4e9c9c04c1aabc92cd6340bce39d4a017da393396bd85eee6622a7dbe1536c17e5c", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779422, "uuid": "efac9ef6-2dc5-43e0-9c5b-a4e848c94aac", "value": "T100845D24F6A400B5D067927AC6B3CA86F2F13A990B3187CF42A446AD5F77EE7453DE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779422, "uuid": "544569e1-750a-43c3-8d91-3abf5b484ae9", "value": "dd827f37d7a4bd48ae5842c7bc39998e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779422, "uuid": "1560e4db-289d-4fb6-bf5a-838b45cf33be", "value": "6144:Q6kqrRtI+0qbUsGSttxGAOwDza6t3I9TNTescIBLTyQJz0X84I7z9MH:X0qIEza6YrIs4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779422, "uuid": "7c63c549-3b1e-4643-8287-b2ceac0fd1ce", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779422, "uuid": "e4c0d8e1-3cbc-4ab0-a2d0-12beb98fa220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779422, "uuid": "a24db39a-5467-4f3c-b54c-e993b0b76125", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664c1c7a-e506-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710752614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752614, "uuid": "6ca86af1-7d04-4abf-969c-f04bd414cf5f", "comment": "Malware payload", "value": "f208b1f4cbc701d9517030763ea40c42", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752614, "uuid": "a658256f-f489-4772-8cfc-dbbf8f8cd11b", "comment": "Malware payload", "value": "51cc209a832665364ac62dd8f29364feb3971cb04cb32d36d26f0129de70b9fc", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752614, "uuid": "cfa3bd03-cb3a-42ff-8943-84d8dadd94c6", "comment": "Malware payload", "value": "f960dbb8173f0f6766373e0591507082f1adca0d", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752614, "uuid": "a8f706d9-4b6b-41f5-a0f1-990d853a25e5", "comment": "Malware payload", "value": "2a712ff058619d2df254e66c399ed91e7a893a145660a03509b80bfec41cf85c57ba96a0a68f4e375949bd5acf56597a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752614, "uuid": "76f05bb6-21fb-42b1-a4bd-bf1f50ab9a6a", "value": "T1B123F139F3292940C8F4983C126D17937996148C8643FA676AC8B90D5186EFB33AFD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752614, "uuid": "0718d4d8-222b-492f-a050-717bb1288aff", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/Q:tLq94YV7JMxXyd4x+gzexT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752614, "uuid": "f5fa5f20-4e0f-4cf8-ad5d-1ace0ced21cd", "value": 49375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752614, "uuid": "757bda8a-4be0-4258-9ad5-50e3a9d55f8b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752614, "uuid": "2aad7b9e-444e-4f6b-b2cc-c50532d5605e", "value": "ACH-8528-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadfc1c5-e4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710743387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743387, "uuid": "1b04d6c0-8c83-4f03-9050-9b41e420c2ba", "comment": "Malware payload (Gafgyt)", "value": "99e4a67da8de66f61b83e3e28044d273", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743387, "uuid": "64a1b109-1a5e-43b3-a632-d58c5e953c54", "comment": "Malware payload (Gafgyt)", "value": "51f4742c340bf12b0c2a5bdb22d0754fbee91ec71023470fe5558a84a5c9521f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743387, "uuid": "a241f57f-6487-414b-9d99-0d3f4ad61903", "comment": "Malware payload (Gafgyt)", "value": "280583ff64658aa37e12dbe9416b6c3f418ac0fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743387, "uuid": "da16f343-1d26-4308-a3cc-80494c2f169d", "comment": "Malware payload (Gafgyt)", "value": "e6b9729119ac59caae3f0377d17d7650669d33b3e51a6116add63289d5f824514ddd7c698cacb54d812322ef0b3dfa25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743387, "uuid": "56948a90-412b-4b67-872b-13cc8fa0ca6d", "value": "T1FA933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33A781523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743387, "uuid": "c86a981d-fd5c-4418-b7fc-468dd3b92354", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5K5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/W5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710743387, "uuid": "7971c1cc-8db6-48ba-ab59-72d36e6b04d1", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710743387, "uuid": "082cd521-541c-402c-8bde-48767986cd29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743387, "uuid": "9e3f1970-b217-4f5a-81f9-c5657c32d2a0", "value": "99e4a67da8de66f61b83e3e28044d273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5fe378-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710745782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745782, "uuid": "7622300d-e1e4-4a5c-9cec-e3531a38445f", "comment": "Malware payload (RemcosRAT)", "value": "fef0c51aa0af0361b8dec099ed5bafa1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745782, "uuid": "9db9b483-61a8-4488-8408-6889724fa3ce", "comment": "Malware payload (RemcosRAT)", "value": "52b32ac1009f5633f0dee6a2305af7ccdf99c726c4757fa2bca6a0ea212d720f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745782, "uuid": "ef734f35-2826-4e5f-8a22-fa2ea3b69878", "comment": "Malware payload (RemcosRAT)", "value": "94ca3c3802f4d2c28f9ef911821efae63d1d9d33", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745782, "uuid": "f0d4164b-a5ca-4cc4-8737-4dbb81cc53d2", "comment": "Malware payload (RemcosRAT)", "value": "be2e7d1d7489a3cf51b9ffedede1a5c7950c4e4f6f7f0f4e7a5b20379f7dfd3202e5629ad550de444d3a5dac3bef4217", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745782, "uuid": "798f64db-2e89-4ca3-9439-8a2a81f851c0", "value": "T17B33D1063365C064E493A5B58DD9F1CF1722BCA19F42870B7580771F683A7C2962BB6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745782, "uuid": "0ec8dccc-62a4-4482-af36-d3c941d3c20f", "value": "768:yXyBP0/kns9iP95hIlMURQIksJW9TUCV96sIbGLRtdN+/fIFagZHTB6p:yX68/ks9iP9TILWIhJWmFCVjWfIIqTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745782, "uuid": "0829cf64-4d84-4c6d-9b57-3403e2c99fa4", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745782, "uuid": "6c90313e-e241-462d-bda1-1a9df8a2520d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745782, "uuid": "30af47af-6f78-40aa-8d22-8b318e3227cb", "value": "Order_specifications.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d709d259-e4e9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710740348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740348, "uuid": "79de3253-0b36-4086-86b6-385d13be5e4f", "comment": "Malware payload", "value": "60ee968291e60900894fc9d914a48a80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740348, "uuid": "ad61d2bd-43a1-4a40-b1ce-3007fdec3725", "comment": "Malware payload", "value": "52d5d347126a7a686f2da37c2e8868f4bcec2e5affabd850ad45f2b81b21b664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740348, "uuid": "249e4ab9-002f-4bc1-8c24-dc8440323dea", "comment": "Malware payload", "value": "2c26edf35ac813a2f83148f62676e30b45f171a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740348, "uuid": "b766058e-563a-4e60-a09a-bb6e5ae66f2e", "comment": "Malware payload", "value": "a08f13917d91833d5087446b326e38672cbab9eebe088d3cd6ce12d4d4704c5e6d6ba133b9c1b70817e4d8985008ee8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740348, "uuid": "ed3ca9de-b4c5-4a4c-b301-00cd15b0b016", "value": "T138E46BB827449E4BD1AD0BB751B58B4462F0CF5DA50AD3BB68523DEF29BF702B801247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740348, "uuid": "0b1cfe40-89e6-4c97-a005-5aececb17df6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740348, "uuid": "49488841-84c6-4fa6-ac04-c9d7c4c2ac69", "value": "12288:LXLLqgMdJEmW0VgCYRr3P8mN5Rkt2ukbtYR:LbdCYRr3P8m/Rkt2ukbtYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710740348, "uuid": "ed56b85c-22fa-4c82-9403-32d28b261295", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710740348, "uuid": "61fab711-65c3-4d8e-9184-06b3b175a255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740348, "uuid": "3719ada2-7c63-41f4-b96c-b4e7e0dc0657", "value": "60ee968291e60900894fc9d914a48a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e2ebe1-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710761879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761879, "uuid": "84a041e7-05ec-47d7-ac19-6d01224c22d4", "comment": "Malware payload (Mirai)", "value": "0222f2e69d679defd7e0aebe14c5859d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761879, "uuid": "721c03f3-6af9-45b3-b49c-4b528becb72b", "comment": "Malware payload (Mirai)", "value": "52de7e81decc538bd0c7a272317c283a2c8346d2a21e407e408ad2e1c0c26f21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761879, "uuid": "f6abf77d-68d3-42fb-b40f-97eaff0322b1", "comment": "Malware payload (Mirai)", "value": "3d1c7a040c9516992e25b1995769c2aa2b782719", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761879, "uuid": "6b26547d-e618-4b74-a4a2-54e084118936", "comment": "Malware payload (Mirai)", "value": "ac30fd75d32080e9b40b78cf13623333b9355c335ec420977e4a91590911afeb81e1dda7e3d9ac5ad9547bd651064c61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761879, "uuid": "92c9c468-7f6c-45de-8d4a-089d3cf57b8a", "value": "T1C231C29D5F729EE5F594E5394B370F35679E524842C04349E1ACDA101EC034D84DFBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761879, "uuid": "4090ecea-ec87-48b1-ade9-0eb184214924", "value": "24:3eNP2Mw8AmslIu8AmygTKdXlOWB4uEaYdz3N9l5zBkEp7i6AYfLTAfrXcLs5iBl:uNeMZ4ihuhY/9LuEprfVrBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761879, "uuid": "e7ac2f70-0973-4d19-9e28-db83d6b70118", "value": 1872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761879, "uuid": "e9532e86-0a8d-4fce-95a8-4c82feb57776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761879, "uuid": "dfa09b3f-8fe4-4f42-8100-040e10f919ce", "value": "SecuriteInfo.com.Linux.DownLoader.598.27499.10304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ff7846-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757823, "uuid": "8ff82bc3-7c2a-4b18-b883-0da37ff99be0", "comment": "Malware payload (Mirai)", "value": "57a8c9f6650952ddcc9ec2dfdea5bd48", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757823, "uuid": "f174d1b0-b047-4458-9587-8106aad2f54d", "comment": "Malware payload (Mirai)", "value": "52f290f49e038cf41bac2a4552e482f2d5825b7302cf6e97d91fdcbf607e1598", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757823, "uuid": "53db6f7a-836f-48fe-b8a5-7fd127fc91f9", "comment": "Malware payload (Mirai)", "value": "943956a5107bf99e66ac5b4572fdc9f30f60f964", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757823, "uuid": "7a80aa32-55e2-4112-8e6c-65f4f4eefa85", "comment": "Malware payload (Mirai)", "value": "ac4d096ce1b57569e74be894614178883e6f76c1fd1dfe8e35481b632d42af40010f4032b0e81114a70388e9ec7f2740", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757823, "uuid": "c263e75a-57a9-49e6-8be9-4740b90f4fa8", "value": "T1F9535B136580C1FDC859C1B45B7F962BDA33F17D1235B64E33E8BE226E1AE201F2A549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757823, "uuid": "2037c430-69a2-466b-b6cd-5c925b9390db", "value": "1536:VE016D8RRLK/m7kM77+70pYqSCKgw4/H0DfIq2Kguy:VEVQRREm7k0w0pWCKt4/iQq2Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757823, "uuid": "0f2f779b-bad4-4301-bd53-b00c936a932e", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757823, "uuid": "ada2563c-81c9-4354-b371-9ee0174d3cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757823, "uuid": "5771b02d-d297-4d7a-bbf4-1c4949ef35ba", "value": "57a8c9f6650952ddcc9ec2dfdea5bd48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf34856-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771763, "uuid": "8a28fa5c-d1a7-4377-91a7-3967145ed835", "comment": "Malware payload (Gafgyt)", "value": "87fc01fbea4822da842f9d8b60344ddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771763, "uuid": "b4b9b3c5-5991-4897-b7e0-f59841d74ff7", "comment": "Malware payload (Gafgyt)", "value": "54196f369135bcd12fe654d35df4c61af57b48141eb2baa545a56e5ca0a1ca84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771763, "uuid": "23e94042-5a28-4d86-bfb2-5e5ac91e4644", "comment": "Malware payload (Gafgyt)", "value": "26472d09b402a55ae2811436a96e7e82c95933eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771763, "uuid": "769bbb51-c1ee-40b0-85e7-7a7f39cbe666", "comment": "Malware payload (Gafgyt)", "value": "71c6e45ec8dd5c12b51e1122139f059daf7e593d3b2de3b1d5a18b4d4192e52f37dbce3de6902326d943c60816e157c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771763, "uuid": "00ef81f4-39b2-4a47-947c-940100b85719", "value": "T187B32A41F9018767C2D327B6E79F479D3B3516A4A7D733116A38BEB42BC17882E3A520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771763, "uuid": "899fa630-eb76-4d39-833e-72573e65eea3", "value": "1536:z4S5qrOnglRDpwqrFoo88VDEZmSvXP004OjCivDN7P0E9pjOG9B5lmunVrQAFW9d:ZHngmyoaEP06DN7JO6BmoVrQAFi1hbSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771763, "uuid": "ad7971b3-412c-4d87-9522-6dd156a5b4bb", "value": 112932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771763, "uuid": "7777e1ba-6e5f-48c5-9d94-cd8708d8a6b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771763, "uuid": "5807c26b-3a56-4b68-9010-e3a9f1c2d35a", "value": "87fc01fbea4822da842f9d8b60344ddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd68bf-e500-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710750021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750021, "uuid": "6cfbe364-b801-4611-8592-ccd43fe061ce", "comment": "Malware payload (AgentTesla)", "value": "980ad1c10f2dfe7362b5dacdf5ff4699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750021, "uuid": "18586d45-4eac-4eb2-8c4c-2d95d4b3b2fb", "comment": "Malware payload (AgentTesla)", "value": "5447dfde5a896b364c6781ce4f86847a8966126ab7e2069b6fddd07fe1fce64c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750021, "uuid": "7339b8d4-7980-4651-b8d0-6a76f660ea50", "comment": "Malware payload (AgentTesla)", "value": "0ba17863d3437d10cdbc6141f3b585aeee6b1e72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750021, "uuid": "05ba4122-b9ee-4729-b7f3-0e47b75d11c0", "comment": "Malware payload (AgentTesla)", "value": "d2d3cb3af29c11105f7780fef7adb030be264f06196262efe0e5e6a6e380d6e3fe6259b640aa83f399d15f0e9929b3c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750021, "uuid": "2247a854-6e44-48f6-b64d-30159d4fe5fb", "value": "T1AB92B45579411BAD0D2797F3497C2F21A62C8FAE41314C24EDDBB1A4F8107CCED2A5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750021, "uuid": "cd76e434-a1e8-4b6f-81d5-ff86a52b060d", "value": "384:GK+FazJdUJJbQFxivI3jza/OStxVMxJUUjARgG+U8z:iFaz6bQFQ/OuMkUjARg1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710750021, "uuid": "5c1a9bd1-8cb7-4eb8-8c5e-123fd98e0383", "value": 20929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710750021, "uuid": "65256772-f0ec-4fb8-8984-d68286eb1dc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750021, "uuid": "16f129ee-22bb-4499-90c8-bc1b992dcebf", "value": "reundertake.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f65388-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751922, "uuid": "e30d8976-63de-4262-826f-7805c15dde5d", "comment": "Malware payload (Mirai)", "value": "e4349e1ae388d8894020f02f8c308474", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751922, "uuid": "3426e008-855f-45da-9603-be351a764679", "comment": "Malware payload (Mirai)", "value": "555adf500ebcfcb3ff9a94c19ec54b398d66a5e7093dbb1ae096497747ec3292", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751922, "uuid": "4c634521-3e51-4b21-be68-79e3fb598e53", "comment": "Malware payload (Mirai)", "value": "fa0202058c2c94d6cdec8158fe321e07529854bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751922, "uuid": "6a4c3f69-a0ef-4daf-a67d-67e88a8c9892", "comment": "Malware payload (Mirai)", "value": "db3bd563e30064cf3a6a895ff9520379f555a81a8e8c0af2cf9f129c92d9b286a6e86303bebb973589706a0291cc3030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751922, "uuid": "5c7c29de-1653-420f-b7bb-e0223baf66fa", "value": "T1A653F58178819A17C5E422BBF96E018D373563F8D1DF3216CD226F6476CA82F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751922, "uuid": "8cff6551-0a69-4294-a629-46f328dc71f6", "value": "1536:jPcNNq4i/J+EoMvMgGsSAP1XlG9WkHYDd8Ud42+:jP6a75P1VG9bHud8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751922, "uuid": "353f44e4-e2ff-44d3-81da-7242546db961", "value": 64380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751922, "uuid": "7dec3174-f457-41cc-996f-6a162fc4b914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751922, "uuid": "e19f56e2-d667-49d9-b5a8-b5606f3528fe", "value": "e4349e1ae388d8894020f02f8c308474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59bf083-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749338, "uuid": "c59051cb-9bc4-4f0f-9722-738dd025b158", "comment": "Malware payload (Mirai)", "value": "b4c6d43edb1eb6b779cedf7daa5dc8ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749338, "uuid": "fd98c67b-f458-4fce-ac05-43083991b8a9", "comment": "Malware payload (Mirai)", "value": "55a8f453252dd7d8ccc84e1c5d67310f529f9aeb2f49554bb8bceff750924664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749338, "uuid": "7840a1b2-fd66-4289-af80-c9f348be7b75", "comment": "Malware payload (Mirai)", "value": "ed3da82a90288342541d02b959e742b46b71f8cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749338, "uuid": "4eb22a10-0478-4a85-8879-e8f2263160b6", "comment": "Malware payload (Mirai)", "value": "75efcd018ed6fa99fc39b742a26915e106267a75c3f021cde6a66b41daf7cd134beaed046356d48f592f3088a13471a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749338, "uuid": "996131f4-2f3d-4ca3-b11a-8e29240b9309", "value": "T1F7731956B9815B16D5C512BAFA2E018E3313177CE3DF72229D106F2077CBA6B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749338, "uuid": "ae788362-8594-454e-8aaa-3e88184e7cab", "value": "1536:C2nSqRHIyiUVN8WrF8/haIvZomeMZiEy0QnD4LX55pY1/:dRIEv+aK9y0QnD4Lpbs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749338, "uuid": "d00f25c6-0cb1-4270-a97f-b99f554c4dc2", "value": 76540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749338, "uuid": "f85f170f-f754-4751-861c-4a2f669fb331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749338, "uuid": "c49c2a85-d561-4ce5-a31d-c95c2709e672", "value": "b4c6d43edb1eb6b779cedf7daa5dc8ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aff3f91-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1710745696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745696, "uuid": "920511e9-fcea-45db-a23d-92238c2007d1", "comment": "Malware payload (zgRAT)", "value": "27d1adae3cf7eadd1b8b2d1c1215ce42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745696, "uuid": "e53124ba-c94e-452d-b63a-401507d9e5f6", "comment": "Malware payload (zgRAT)", "value": "5624c15510660129013a84cfc08b2beff5671353c88374b478fe0605623b9c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745696, "uuid": "5f09e644-6952-43f6-95f6-eeda0aedd32b", "comment": "Malware payload (zgRAT)", "value": "470f5cfb9b66e6c0656e5571f6dc916f566a292b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745696, "uuid": "b443479c-67cb-42f0-aa23-80aaa3c15266", "comment": "Malware payload (zgRAT)", "value": "a9fd9ba72172718c841990dc074cf7181ee9aa8a0731c250faf5c4bf18bf6e760c77b8eab1e30a7053bc84a4721cf2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745696, "uuid": "11a8fa66-1b0c-4e07-a3d5-65c3cf4b9bbe", "value": "T14BE5E0646FF91A45F2FBBB31D8F5A1524A75FC739B35DA0E0084251E8832B829C91B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745696, "uuid": "d143a714-8689-4fa6-8f62-83e70950213c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745696, "uuid": "b6c2ef23-0796-481b-85a5-6dd3f9178ec4", "value": "49152:lNmZOVwLsDfEjLhBRds9kSCfc5DG99mdLJzZ8vvTpFsCJqZSgLlynDj0U2z7/BEH:lKT6Z8fpXgLlynDg5EKtwbYPU8FaOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745696, "uuid": "7ba28994-4694-40e3-bdff-a0b1349236a5", "value": 3182832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745696, "uuid": "da4afc3d-f25b-40d8-b994-bd4a94ba0f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745696, "uuid": "c23e219f-ae16-4828-b4cd-828979138ce0", "value": "QUOTATION_MARQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eae3782-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710769432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769432, "uuid": "976386f3-0502-47ec-a99f-a51fc6096ba4", "comment": "Malware payload", "value": "a83e2efd3b2142c6cd61a2e2f4187835", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769432, "uuid": "f786705e-ac73-493c-9ee6-cbc19003199f", "comment": "Malware payload", "value": "5792de0fb4021d49905021475f803fb6d0d3976ab18d7ad3139a2c496dfff50f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769432, "uuid": "64aa6550-8c5a-4fef-ba02-e010b3c0b6fc", "comment": "Malware payload", "value": "1615c32cc4ceca8210dea84fccac4ac043fd2a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769432, "uuid": "714cf2fe-775b-4ba3-9616-816b6452a237", "comment": "Malware payload", "value": "a5ded40e222bfa2ec59cb78debbe48f7007d52f0a68eb36ba54dcdd99379297e7539513cfb8db53b82da5e3f38e0a03d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769432, "uuid": "f4720ffb-8651-4437-9ec9-70cc599a3e59", "value": "T1D7E2E163F1E15893FAF49B3682FF549BF131B5434DF6C781AB8C0249E06AD41386798A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769432, "uuid": "97fca55a-74bd-4d37-9a7f-5a558a680f6c", "value": "768:IaWTlWwkHfj4t2bw0hX7RnrXxCxbPXeOxYM8e6zqQqA+:ldwk77w0hX9nrX4PVYM8e6zqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769432, "uuid": "480aff76-6f3b-4c70-8705-921ad3ed9734", "value": 32600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769432, "uuid": "7f66d601-99ed-4961-8f43-04f554e5178a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769432, "uuid": "bb5c5e70-a2bd-4a57-9f07-2c624d120557", "value": "SecuriteInfo.com.Gen.Variant.Application.Linux.LogCleaner.1.32032.23881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a0d030-e52c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710768778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768778, "uuid": "fe86dcbf-ccdb-42fe-846a-d9bc3384575a", "comment": "Malware payload", "value": "a384fa95196f94e14b4ec5bba3effd42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768778, "uuid": "23509235-2c6d-4f0e-821e-7fdc378a53a4", "comment": "Malware payload", "value": "57b519e74d9726c8d2459bea68ce8d9b10f13689f37f45e5be3010d3f2b9d82b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768778, "uuid": "21c6ffc2-2780-49f9-b230-a9978efbded4", "comment": "Malware payload", "value": "378e489d27a9c883ff8fa5b0c64137156297ea2d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768778, "uuid": "765cbba0-9af6-405f-b525-304dde86b703", "comment": "Malware payload", "value": "599dea73ce7af358fe2d0b582622b4bb253c76ddca061581130fab8e4c4f6de451aaae9414dcea7b994605be15dc3b7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768778, "uuid": "b1ef6a6d-4c47-48ea-90f2-0891b68a4d10", "value": "T1597347166E470E44D94C01B92E8E6BF0B5595EA435CB7DBE20DF7422DAF0C9A8D84ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768778, "uuid": "7567b9f0-9f38-45bf-90c3-1be62404b785", "value": "1536:7gag8sEWUJrTK4vvVOEq6Aneq6nu+P3/h/b6JgvpktDti5Oz:I8sEWUJrTK4vvVOEq6Aneq6nu+P3/h/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710768778, "uuid": "1ce9d469-5b5e-420e-b484-90a1cbeb9921", "value": 73601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710768778, "uuid": "2eb13b6e-349d-47ac-9521-a49f706d6565", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768778, "uuid": "513f6a82-7871-49a6-87bd-7893eddceb7a", "value": "failure.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebed8335-e503-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710751550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751550, "uuid": "d495f4c8-5eb3-45ba-9ea5-2059fef82845", "comment": "Malware payload (AgentTesla)", "value": "1efb862e809d5865e3dd2af17433fb4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751550, "uuid": "6d7c870e-9288-415e-adde-479ef40d7095", "comment": "Malware payload (AgentTesla)", "value": "57caa02177bb322e5b6e91c1453f20705e402631920332ae53a566dbe0d15a29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751550, "uuid": "de20a643-f06c-4dae-be06-ddc466418155", "comment": "Malware payload (AgentTesla)", "value": "e6e9e04d9634fb4e2bdfb056f7d133223103ea7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751550, "uuid": "2374b8b7-e958-4b78-8062-f5a801cc5db4", "comment": "Malware payload (AgentTesla)", "value": "02539e99505a863ab8dc3fd7a2c681db529b2ac1c5dac1f188c27b4b33dc220b1cc5e943c12482cbfda91c5555ed809c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751550, "uuid": "c7908666-d89b-4c5a-bd20-85dfe9377951", "value": "T1AAD4337E4BD4E03D197B2F55199FFD1EA8C22A5414B4833FA397BA84D298160F83A42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751550, "uuid": "dbe00505-79d5-4a59-89cd-751c13933c96", "value": "12288:Ub9J9eDSazKfWjGcwrJ4s87NvXZb7Uzt7KXrF/IQDtY2UBi8YEF0:U/paWfWjCob7atmFHrUBiMF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751550, "uuid": "cdfca156-b6da-4461-aeb5-2ffe41db3d64", "value": 629456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751550, "uuid": "17fdc2d5-ddbc-44ab-80bf-25f27ce68451", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751550, "uuid": "fc21cc45-72ca-4263-b648-c6c6a29e7d82", "value": "DHL Receipt_ AWB#62600719881.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31b5a0a-e558-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710787935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710787935, "uuid": "13875a5c-1fa2-4c5a-9cf6-c2901a65a4d9", "comment": "Malware payload", "value": "9c925d397390f2192ef6f17b5f4f64ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710787935, "uuid": "d9a17782-b299-47bf-b907-bed2f587b19c", "comment": "Malware payload", "value": "57d30685f030d2eda5ee0707a7a705091280feac0621c96df0fc724d2293348d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710787935, "uuid": "01665719-8d80-48f6-826e-11ae245bce3d", "comment": "Malware payload", "value": "4f8cbb2f61b4725a13e4bdc4ca9b999a815a94a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710787935, "uuid": "7bdaf078-81ec-4aba-a114-8461868fb012", "comment": "Malware payload", "value": "d347ced9e0ebfe85158d79d90a5999565e21df9c7bdc41d3c27467f7a48853fb7f22c0d7b9c0949dd8de24daeaea9cae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710787935, "uuid": "d83dbc06-979a-45fb-84fd-926d169f247d", "value": "T121260213F281583BC06617391C7B9364997F7A102AA66C4B3EF43D7E4F396412D3E6A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710787935, "uuid": "a3fb0043-7799-4cb7-b4d0-4c8c3b6279f3", "value": "bdc9eac43b4d388112614df185184cb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710787935, "uuid": "a5e1e5a3-01e1-4dbd-a909-61226b3d4db2", "value": "98304:X4U30xsjKlntN04eiLoCTsNI8WjTVrZECAmWSubSzqon:XgsctNOiLVTs28yV3DiZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710787935, "uuid": "160d3d88-889b-4e41-a5be-117ab9c541d7", "value": 4714496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710787935, "uuid": "3828bd3c-5d86-446d-b117-e8b589bc1fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710787935, "uuid": "c2da89f4-803b-4d19-9ec1-d4e2eeb633db", "value": "SecuriteInfo.com.BScope.Trojan.MSIL.Agent.30891.7353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45afe7e-e544-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779400, "uuid": "f3d5d9e9-fbca-47b2-a192-a2ce5966865b", "comment": "Malware payload", "value": "a7c2e87e9f947afdfe9e6a18f5e7c17b", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779400, "uuid": "e5ab3d33-50f1-4410-8420-408bca8314a4", "comment": "Malware payload", "value": "57f64f170dfeaa1150493ed3f63ea6f1df3ca71ad1722e12ac0f77744fb1a829", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779400, "uuid": "9980a8c4-7372-4b01-8439-1cb73d2a91bc", "comment": "Malware payload", "value": "aad782a5fe3d99a52970b1978874b232c54baa5b", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779400, "uuid": "1f0f2fbf-5d0c-4485-816a-c5d6385c1c7b", "comment": "Malware payload", "value": "c31bb4be261c69e1f7fe65db3592d4a77a62a32556e370df487ae5f83c8b09f177cd78357da5e02b3eff057ce7572288", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779400, "uuid": "145acf15-f2b1-4b33-a381-9590b517ccc8", "value": "T19C844E24F6B800B5D152927AC7B3CA86F2F13A890B3587CF826549AD1F77EE7453DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779400, "uuid": "b774e3a5-d925-4079-a55a-78a90a7cd67e", "value": "4c34f628c708b4f1d498e2c50ee07d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779400, "uuid": "41a9d8cc-69ac-49a2-8201-1728dd999733", "value": "6144:CLeDtkdGtg+GQHYNnZou+dS+SgtMRDDyHSJxXzJl0TZDFihfQR7rmkzniAudl:6erkouCS+SIsyYrQkkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779400, "uuid": "0208e8d7-5a55-461d-9fda-4fa266002b7c", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779400, "uuid": "8a43f438-5406-48b5-a82f-b5014f8243b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779400, "uuid": "61824c94-ce7a-4ea5-8092-3f5706a993bc", "value": "1_.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af45363-e503-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710751199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751199, "uuid": "aac48ac3-133d-4555-b9f4-f470332381ca", "comment": "Malware payload (Formbook)", "value": "7d3a8168361119a2d8d0287a7324881a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751199, "uuid": "25760da6-44a6-4432-8425-910ccd64c937", "comment": "Malware payload (Formbook)", "value": "59070005d24a756467114c300abe2ef425f552c2bba36253d66ab79bf86a7b0b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751199, "uuid": "3ea8f5d6-9216-485e-991e-133a6557fea7", "comment": "Malware payload (Formbook)", "value": "8ed85df71a3382ed21ba4515a1b2a92f1fe4490f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751199, "uuid": "b2ec4b9d-152d-48b1-83eb-6a80eb6fe089", "comment": "Malware payload (Formbook)", "value": "1e99ef6a9f669085eb6844f8d44da2dd2dd91501458c51a1d69b71499c58f945dda1daffea002a6a6ddd7f9de68f45a2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751199, "uuid": "3923294e-fe23-475e-8fd3-bcf4e263b040", "value": "T1F0F42372C2E656C108363FA6CDB71ADBD9715FED02B6DEE8488E9384958C324770059E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751199, "uuid": "f49acb6e-700c-4c7c-85c6-10fb8db0b4f9", "value": "12288:/Ls6F5PImqTHq0wuQGB1vx98YN9TDexeabDz2sQlYwKIEROtWzTX2B9thIespfNG:Dt/IdTK0wzG7v8YTCbDKsQBEkt+CRhIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751199, "uuid": "8505b4df-dc0b-499d-a386-8f43e4e31e6c", "value": 741453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751199, "uuid": "3a9d2466-0f0d-4a22-9f9b-fac8341c4a1a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751199, "uuid": "471de20f-57c8-49e0-916d-8b22fe818309", "value": "Conferma rapida 140324.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded34f1-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767874, "uuid": "30513b66-b19c-4cd9-869d-2a1d7d77f49d", "comment": "Malware payload (AgentTesla)", "value": "6315d0b579eabe4b5e9ccfe1e4b5bfa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767874, "uuid": "12be4e10-0281-48ca-8be8-7d1bd40813a1", "comment": "Malware payload (AgentTesla)", "value": "590f27260d772e044dd8819c937658e02ab15050b3bf6cc3dd054c808ed3c201", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767874, "uuid": "6691fcfb-2448-4693-961e-ac8ad0a37ff2", "comment": "Malware payload (AgentTesla)", "value": "060e69c204dee28cfe8bc3d2a06fccb2f1b728d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767874, "uuid": "4998bff1-0bac-4499-b23a-9ed52717292b", "comment": "Malware payload (AgentTesla)", "value": "1696d31b68539073d5e745d1ae8032fa63c989cdb72523093e6a5f198488ea45fcf4341fa5d090348212a315ef87cfa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767874, "uuid": "2fe6e526-bfc4-4d11-9f70-a5787ff2e91c", "value": "T1F2D4230221589F1BC42B73F9C4A036192AF5AD605DB1CB18AD5BADD62C3D78227C1FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767874, "uuid": "80639a1b-e58b-42c3-a2dc-7a5b0a962899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767874, "uuid": "43d8f48b-9f57-40c6-93bd-897664283dba", "value": "12288:GEX/pL5qi3PqBbnZOPl3XaN+sWCmSBFAEApj:3XrFcol3+VVBKEAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767874, "uuid": "47ad9a68-4424-4c9b-989c-e5e5a338cc8a", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767874, "uuid": "571f5b0f-9162-4980-a811-2bbb9e268f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767874, "uuid": "6480f412-1845-4859-bdf7-c4c3578e51fb", "value": "teklif_ZP026114__TS210 TRTRP2 % Vat DIP No2561 PB 34870 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e076f2d-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710769431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769431, "uuid": "53f5a1ee-195d-4f08-a1bf-e456d47369b9", "comment": "Malware payload", "value": "92d3047bda9d14ec30250e4c2c24d3ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769431, "uuid": "f2d86418-9eb2-441f-83c8-0e680a5e7728", "comment": "Malware payload", "value": "5bf54c41b07e341b8754ccf72b9dbd55135b3ed7fcc53816a580f5c0a79d104a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769431, "uuid": "ed02ca61-2156-42d9-82f1-5b48dc715fe5", "comment": "Malware payload", "value": "f6abdb7737f6aea1d7aaf554a751914de5e2f255", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769431, "uuid": "211cab54-eb60-45af-b0d5-3bccf41ef315", "comment": "Malware payload", "value": "37dbe87606487b262f10b0b71ec0d05a223767c0aae52c837b86e5e1e419457dd9d6c363fa833eff4c97880d02b353b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769431, "uuid": "b6c1a82a-e0ed-47da-92f9-d6d9be618d75", "value": "T14A845D19F6B15419C5824074A39B4332A634F0ECA6487DAF4B68FE341E55CA6FB0E27F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769431, "uuid": "20a2125b-e78e-4860-bbd0-cfcff2d2b112", "value": "6144:8wuV9m6BNiWlU38cLPkJgpK05o3Zx6EK8qHOAI2xKoPhF2:89iuUA05eSCqHOAIohhF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769431, "uuid": "633fa7fc-7ddc-4183-a335-eb63363a38da", "value": 401000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769431, "uuid": "2423ff48-6735-41fe-a585-883b06b12eac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769431, "uuid": "29658de4-26ca-45c7-9cdf-02f7b4c4cb5c", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24827.29032.22738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785f1b08-e4f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710744913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744913, "uuid": "8fdde41e-2b98-4882-8ee4-ead16a271983", "comment": "Malware payload (RiseProStealer)", "value": "77e80c1befad5ca5d8f69b34669fd38d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744913, "uuid": "fd37ff70-562a-41f9-a3a0-095e8f7b2b0a", "comment": "Malware payload (RiseProStealer)", "value": "5c72dfa6dbd349d1da3396e84cf128fa5fc52eac3031bb83343be2e96671dfbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744913, "uuid": "3281164d-a1e5-48dc-b787-b7dd59b7e9fa", "comment": "Malware payload (RiseProStealer)", "value": "0d46974020dfef6bc78d3ae66661c9a22b4bd377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744913, "uuid": "dfc1ce28-cc94-4f76-8c99-693fb20fe6cc", "comment": "Malware payload (RiseProStealer)", "value": "1165d88216ed6ff5f430408dc64e003463918418f1da86c7b6d644d775081876ca419dc04a37fb10d3dd4d8d9363b977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744913, "uuid": "2e394809-b7d7-47ed-abe1-96a5f941d21e", "value": "T121E55B63B40971CFD48F1779D527CE86685E82B9071048C3A96D64BBFD63DC922FAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744913, "uuid": "76189829-f7e8-40fe-96ec-7bbfdecca304", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744913, "uuid": "1a405405-ee59-432f-9084-41819a440d4c", "value": "49152:7LzPbPVlJKTOAVjtPc9IS3vd79p5PSdei4eANsVow1YKNQ47BV:jPbrvAVjtPc33p9p5z1eANsVow1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710744913, "uuid": "a9b978c2-5b76-4fe7-b4c9-a7e599dad06b", "value": 3211264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710744913, "uuid": "0f3337d7-9022-4891-b50e-39f7bc188fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744913, "uuid": "9946b50d-446d-4b68-8556-beb2b2f6b00a", "value": "77e80c1befad5ca5d8f69b34669fd38d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e53d63-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752420, "uuid": "cb4a8765-76e6-495d-ab8c-81bbd7600fb8", "comment": "Malware payload (Mirai)", "value": "3260e84c62409f9981a8be15e727ec08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752420, "uuid": "9295e2b9-f0e8-45f7-ae27-c31325aa51b9", "comment": "Malware payload (Mirai)", "value": "5c77a7348abb5b1cbe8b1d4251162f0c7e617793977f2e3bf2761be4bcae405e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752420, "uuid": "080bb7ce-e5b7-49f9-899a-c7cf44a40ec2", "comment": "Malware payload (Mirai)", "value": "e5c2b1bb11bbad7d520db8d9f48edb1201489048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752420, "uuid": "586fbeda-d28f-4ec1-acfe-eda3f9e71173", "comment": "Malware payload (Mirai)", "value": "d81e8f84b3917ba5420b5c6d9058e81d338fa2684bde4371436b96b74a4949044e7cdfe555b73be5141bd02610f79645", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752420, "uuid": "6f8b92e1-b4a1-42b0-8c3f-dc01ff9e7e6b", "value": "T1FD53C95E6E618FECF7ACC33447B799216359338633E09689D29CD6105F6024D681FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752420, "uuid": "2bbde22d-671a-46a3-ac4a-eac7b94b6dc1", "value": "1536:lq5RThRNhRhR/RuhRF25t0OQ0oaeHkncHnK:0t1Q0ouncq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752420, "uuid": "6f48f0bb-1273-4614-a594-c54bcff9a7ab", "value": 61292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752420, "uuid": "57a516b3-d62f-4ae7-b84e-6379e2b5cc9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752420, "uuid": "e8d5b9cf-a7e8-4045-a882-9e0edbe278d9", "value": "3260e84c62409f9981a8be15e727ec08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d6a92c-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767855, "uuid": "565d4de2-1000-4d29-bef9-5a4bd3bd458b", "comment": "Malware payload (AgentTesla)", "value": "1ed78424905206c4549ac51b97b5120b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767855, "uuid": "e996c5e5-f30d-4c33-aa9a-d1d78bef957d", "comment": "Malware payload (AgentTesla)", "value": "5ca87353c4d37e66f76875a46235208796dd620ad3cb7cebc6b5e66be55b2913", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767855, "uuid": "03cb64cf-416b-4a33-aff5-e9577a65bb89", "comment": "Malware payload (AgentTesla)", "value": "bd106b43a6cad1fc21d8b71cb70c86295a9439b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767855, "uuid": "d36389ab-1159-4b4a-a50c-cae3f2f90625", "comment": "Malware payload (AgentTesla)", "value": "45c8eb94a8b0031dc5ac74f8b01e2291bd38dcfbdcaa60ad254cf277e520d90508f267ca1a3c578d943a11dc155513f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767855, "uuid": "92792c8d-0137-4a0f-acf6-fa2eaae7a9a5", "value": "T1D3D4010327E8AA1EF47FA7F424611114137A7A17BA73D74D4FE8E1CB1A21B054E62B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767855, "uuid": "26e0b54e-a54a-4ec0-bb20-685ea020eba3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767855, "uuid": "fc77afb0-dfbd-4348-bce0-03eb2a724d8f", "value": "12288:S2ShC3RLZiWsXk3qNIvomdlP27H/MNThSlOeFsd/hE:VSUJZdbdCH/shSlOVZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767855, "uuid": "35b7b0c7-6b95-4b81-8489-f0e8e2f565e3", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767855, "uuid": "c774d043-2172-458e-a507-11abd8e5a04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767855, "uuid": "0a68a661-4a81-4020-a555-60604e3e9f0f", "value": "PO234400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fec7a1-e50a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710754216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754216, "uuid": "f4b76de0-e3d9-459d-b11f-0451ccf0040e", "comment": "Malware payload (AgentTesla)", "value": "cc2ca4e8c0371b7c7807ad43c8834344", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754216, "uuid": "0820827d-3c4e-4d7e-917d-af1542f8973d", "comment": "Malware payload (AgentTesla)", "value": "5d7b1224c77b4413e49156de8a050fdcfbfc5cc75b3d73c13abd67475ddabd3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754216, "uuid": "9f28e945-824f-4451-a750-2ec13b99643c", "comment": "Malware payload (AgentTesla)", "value": "dd6a5966404852d6618f6a53670bf891b03fc8f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754216, "uuid": "48bb1528-1521-4412-acd5-de2d9f92fc99", "comment": "Malware payload (AgentTesla)", "value": "0057a41f8874cf3694449551095e618d0fba6d4807d652cf1458ca4532f83226d208992513d8a27a528ca8f9681a8fa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754216, "uuid": "3e0c106b-9104-4a57-b73c-171e62ea24c4", "value": "T1CED4231C7B846A20CD923EF656D7C8A32731A603E429F1FE385DD0CDA9657E0E182677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754216, "uuid": "cb28a451-b729-43e8-b748-5f0bcebba030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754216, "uuid": "34ec037f-1e5f-482c-9eff-5b2735673d09", "value": "12288:GfmNWl0JbO1sihcla5EvFtz7qckGijGEZ8tE8YEnksvS3R1rADkgRh5kR:p0l05O1sEcZHDkGijDZ8tE8YEnz6brAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710754216, "uuid": "2b163b77-e128-4fee-9299-4234ad1a7c81", "value": 637448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710754216, "uuid": "4a8d84bd-d1f9-4763-9cb0-9f46b0761731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754216, "uuid": "2ad4fed5-9999-43d1-b53c-a1352565de85", "value": "PO No.109480 Dt.18Mar2024 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3981c074-e540-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710777450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777450, "uuid": "782f09c9-546b-4b43-bb31-086c447b042a", "comment": "Malware payload", "value": "d443608749f4f61a08f6c8351016c486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777450, "uuid": "32af8901-ef08-4a54-815d-9f90c143ccc5", "comment": "Malware payload", "value": "5dffcf0920f79b3ddb9623167db653dba6f51e0257f68fb32b4626ea95f4f2ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777450, "uuid": "3dd3b7c7-965e-4f64-956e-973aba4c4ccd", "comment": "Malware payload", "value": "7a9a3b73a0b67ac584f3363fc68403150cc6bb25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777450, "uuid": "dc1fb3f9-4f34-447a-8848-cccca27c2ad4", "comment": "Malware payload", "value": "19d48cfedb90e8a6353e68f320ab9458be8aa651c8fb9c97462f0a142be6e3a1ad2c02bfeb679e9798e8033a3d9c0049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777450, "uuid": "3781b443-ee02-44e0-9083-f6246f3e2e1c", "value": "T1447623623D048D84C99E0430895BC8BE36753E76849349E3B6B97FAE9DF1D60BB37148", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777450, "uuid": "9d06eab9-cb4f-4821-85df-4d826cd4c939", "value": "ba4ce0cbe832b3560bbc7a0c6d1fe182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777450, "uuid": "76d15eda-d3d5-47b3-95ca-5d471016b329", "value": "196608:gEG+hWQPPYfkxV3gKaJVXcurDaUH3dTcMGV7E:gEGKWDkx1gKa8uvDHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710777450, "uuid": "bf110c28-ba73-4482-9c97-be0329316886", "value": 7152640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710777450, "uuid": "e48a5760-8012-424f-9968-c17560869d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777450, "uuid": "f8de1b42-337a-4053-adc5-cb77a609dbc5", "value": "d443608749f4f61a08f6c8351016c486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cc145f-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1710745951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745951, "uuid": "26833a96-ffc4-44fb-87ee-976925713003", "comment": "Malware payload (Amadey)", "value": "b9c3c735a3d1eae297ca362bee3393ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745951, "uuid": "b9a7fcc7-e584-4cd9-9d3b-4fd55c3e4c71", "comment": "Malware payload (Amadey)", "value": "5edf686e646728c40a9107c1fabd527e5c6c2bf1ac6ec7326fe77fcb19e35ab7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745951, "uuid": "071e7643-5480-4310-97c2-cf8e46f1b15c", "comment": "Malware payload (Amadey)", "value": "4011c6ad06cf1be487e9f1bf293a278e480920fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745951, "uuid": "76e4c11e-df19-4654-aa87-02bb7af4092f", "comment": "Malware payload (Amadey)", "value": "ee86ad3e70101ebd7ac176502305941637855b71b97ebfb398f0c0bd425f98be6ac0cde5b13df14952685090e9718aa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745951, "uuid": "e6c3a21e-fda1-4a51-aba1-3b2ec47bf3f9", "value": "T140E5D02857E85A06F6FBBB7A99F9A0518EB6FC77FA35E74D1080151E4432B428C80737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745951, "uuid": "a4cbbcca-e383-4113-8b1a-c79c7db339a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745951, "uuid": "3adaa9ef-52d9-48c7-98d8-73d2c688d0de", "value": "49152:ORG+vntX/MnSttuawC44f/q+XTXqV7FCDuC7wEMw5wozXnlni8RYaJ5fJ4DYXZdN:275h5Lbndfyanx4EpuoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745951, "uuid": "60eedbce-5365-4aa1-915a-988f6ac61cd8", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745951, "uuid": "e8782146-c51f-4a50-a794-ef852b322fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745951, "uuid": "5f60cb08-cd0a-4a5b-953b-90300223748b", "value": "b9c3c735a3d1eae297ca362bee3393ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8ca306-e525-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710765966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765966, "uuid": "3a75e598-fee6-4cdc-af3f-740672a12e48", "comment": "Malware payload", "value": "0d393a851f47539578a622b09dffa9c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765966, "uuid": "1c281eda-d9ac-427a-a0b0-45c91574612f", "comment": "Malware payload", "value": "5efc40eefbf8884fe7775868d5964f309123f1da90b9ace60065f4a2a046c91e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765966, "uuid": "d9135116-6df8-40b8-8122-a369f642041f", "comment": "Malware payload", "value": "c75d853fc8ac17fdd96c38d4b6a62c19170de5c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765966, "uuid": "9eba58e6-67ad-4d9a-830a-4302103a5c95", "comment": "Malware payload", "value": "7c6daa645e0db17892c96c432954edf8cf1f5643ab441197f882e7229ddc74d3ceb8b5b115d1f1838fd2372b5464b1e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765966, "uuid": "c68d8617-bd6d-4f34-b2a7-655f890cccb8", "value": "T1FD332935B935292BC4D8A97A25F74368F1F8064A34ECCA1A7C720E4DBF6495061273F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765966, "uuid": "81a6784c-d527-437a-83d2-a809520c9fca", "value": "768:U75d0PZWMX9nqRXWC9lfyMqEVn23KzRcDfk+nZCO+lXTpfZZum:m4xftnKr9lfyMqT3Ke7pZglVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765966, "uuid": "6937455d-8785-46fc-9de9-e66e6ffdd552", "value": 54756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765966, "uuid": "0f5e9f78-0a68-4f2d-af52-b36480e1a3b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765966, "uuid": "c1eb6ace-452a-4d00-b440-6b18780b92c1", "value": "0d393a851f47539578a622b09dffa9c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85097b57-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760396, "uuid": "be5175cb-2107-4fa5-b438-45482fb83dcc", "comment": "Malware payload (Mirai)", "value": "ddc88ea197ae35117f8a20a0902a8ba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760396, "uuid": "7128d889-5800-4946-b13d-01472217d913", "comment": "Malware payload (Mirai)", "value": "5fcdd3ba5b2ea270072a178c273f66edccbfb6b3af9000d03a8cc9ec03a89ca7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760396, "uuid": "148d41ef-87d7-4b8e-8a81-d5bb87b74ad4", "comment": "Malware payload (Mirai)", "value": "2bd9f1962493fd3ea65004a04160f49dda2cc40f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760396, "uuid": "2421a591-8d6d-4496-959b-7d78d4499cff", "comment": "Malware payload (Mirai)", "value": "6a79625d5f6b65623b6d63298d3cdecdc3178d5f427fb76728963044ccace8220a28d5ed72ea4256f80ea70558540c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760396, "uuid": "09054f84-8af6-46d3-8dc5-c8b37831d2b8", "value": "T1DD219EA667D2AD57CC640377DD9B5750A362EAC4828FF113F312122A0C6F2191F22445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760396, "uuid": "4ff778d4-c7ff-4b3a-90a4-694f8baf3aa5", "value": "24:FYolMlvRVCO8DTuJ2pRsDclaGjFcVLFdIdmF5DHH2IMOVNfDA7:yolMFCO8Da8WAoGjFWLB2IMOVNbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760396, "uuid": "4a617ea1-7ef3-4487-a886-3c0de6566650", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760396, "uuid": "325ec985-37f8-4f3a-a0ae-970bce5f39ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760396, "uuid": "02dfc02c-54d8-40d8-890b-adcfc8949cc6", "value": "ddc88ea197ae35117f8a20a0902a8ba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a84edf-e512-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710757693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757693, "uuid": "449df9bd-aba1-4203-ba21-6a21c6eb9d9b", "comment": "Malware payload", "value": "84a041270bc505b691bb60d61b6142ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757693, "uuid": "0d9d4b85-6d84-4c6c-85e0-8d4611aa07fd", "comment": "Malware payload", "value": "60e881ea8402bfe98bd069c79c43ef35a52edf283af03db1bc22a0d51f1f4596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757693, "uuid": "6108f336-2e32-4510-9443-349af5466743", "comment": "Malware payload", "value": "1086771529ee58820d8c579ccb5b5521fbe85d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757693, "uuid": "922345a2-2582-49ee-a8e3-513df2839a3e", "comment": "Malware payload", "value": "54504989ca2fb7247b8e5d0a9aa888280c44e628f897f8967edeef58c339433e2410bfafc944aecf144ae7cba6db493d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757693, "uuid": "02e1d28c-fd3e-4dfe-bacd-914da798ccbc", "value": "T134C5334F22C4A959C910DC79AAF9997B51AAB0945FA55AC31BC78348BCF08CF4530F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757693, "uuid": "fac2ea66-f1cd-473d-bd91-344947f19c88", "value": "d5ee67a5d17ebe4b53d6509020438cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757693, "uuid": "f281332e-ba79-4760-bd63-ead56d99236a", "value": "49152:MSO6omd5a/HBvm9Exm0uuAL3tGTbFdXvLXN61xIPpkjKYQbkTu:MPmi/hvC2HurZGTbFhvE1xIP6j7hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757693, "uuid": "5b679095-587d-4ff9-a334-9ac2b0bd6645", "value": 2674456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757693, "uuid": "f92341d3-b272-4631-ad32-369447c2fad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757693, "uuid": "ea98ee30-2eb6-4b82-b7cb-d8bd10a48c42", "value": "SecuriteInfo.com.Win64.Evo-gen.15114.27759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733ed1f3-e50c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710755213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755213, "uuid": "4c261299-17e0-486b-9df1-a3c982845c74", "comment": "Malware payload (Gafgyt)", "value": "e5ecf475271c0db7ffbc381042a45142", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755213, "uuid": "09cc3d67-2323-476e-8efb-1fe067a18d24", "comment": "Malware payload (Gafgyt)", "value": "611de455879066ee70a86a8316e3331a5ed27b7a0ad9a7304c4165bd8ac38b06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755213, "uuid": "6d5d64a3-f1aa-47b8-bf78-c71a39aa86d1", "comment": "Malware payload (Gafgyt)", "value": "2fae6093c7746fe649133ad3085997dd86ca5bc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755213, "uuid": "e3204108-d99a-4287-ae1f-70f4199a89af", "comment": "Malware payload (Gafgyt)", "value": "98ed5ca90713eeca63dc5ab381402410071850876e697206e393a9adac6b10fe557d8d16139a7eca9e9fa01407162977", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755213, "uuid": "351b8844-c5ab-485f-b843-5428fe64e2cc", "value": "T1ECD3396BA61C0793C45789B12DB733E097AAEFB304D621C5E41EBE805B729752236FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755213, "uuid": "13c50963-4ae1-4ac7-93a9-3f00768d23fe", "value": "3072:StI1Y6soOGTQVvdfetJ8add9QzhsOWIkF6PZ6bqKQibhgBik:SteY65O+QV1fetJ8addQnWfuZ6bqKQia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710755213, "uuid": "7d835d9b-9d2e-4e59-b804-f04c2626314b", "value": 137952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710755213, "uuid": "14797753-ac8c-435a-b2de-fc2b2041096e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755213, "uuid": "57ee7e6e-b91b-4d5b-afaf-893d7bf5d56e", "value": "e5ecf475271c0db7ffbc381042a45142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b1b4c8-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745734, "uuid": "eda414f4-eb9c-48a1-8905-708f90a90da9", "comment": "Malware payload (AgentTesla)", "value": "13665d02d5431b753bf97613b1c4330e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745734, "uuid": "50261cb9-b163-40ec-a98d-718271fecc43", "comment": "Malware payload (AgentTesla)", "value": "61ee3d529ac5458175e10f0205a0e209d3ace85dc6185652053ddc92c05945eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745734, "uuid": "2e622ab6-eceb-4151-8dbf-aedacda59f5f", "comment": "Malware payload (AgentTesla)", "value": "40338c2a8e38780b31f0cedcaecb5d7d91d515ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745734, "uuid": "20f67a8f-2d6f-4e79-bba7-9eb8ced28c8f", "comment": "Malware payload (AgentTesla)", "value": "b5bc8c23f78ece1be6c8e504f1b06acc6196be48d570f21e64510e0a711be7cfdd65e36be838808bc26322c1c6cba876", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745734, "uuid": "8e2e6822-a0b0-46c0-9db3-3aa4c4b76194", "value": "T120D4231DA3185D73D3249FB12EF2AC82EB72D7334551D2B599E8798C9CC93E8136910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745734, "uuid": "241c4197-e7a5-49c9-95b4-15cb58531dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745734, "uuid": "42fa56c7-d246-4273-bad0-5fa58de931da", "value": "12288:RgRhkiL2nCDOa8FcXF8tCs7AmI23L01gceaA4lvHH+GGPb2lyOjH/QMO8kR:SwiLkCDr88a77AmxI1gJqZZialyOjfWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745734, "uuid": "b782aa1a-6596-46e4-8025-66bb9ce4750d", "value": 654856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745734, "uuid": "afa40a69-96f9-47f2-89b5-c861bfa0d4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745734, "uuid": "4566aa9d-4858-43d0-975b-cbd4f1b59220", "value": "DHL Receipt_ AWB#62600719881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd442e2-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710761891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761891, "uuid": "5f734505-eead-46d2-abc0-6b59b7d5a548", "comment": "Malware payload (Mirai)", "value": "1b2db09b8089637c127788576f116719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761891, "uuid": "8c75adf4-ead6-440d-b43e-e4c834cec3cd", "comment": "Malware payload (Mirai)", "value": "624e4e9554b086d743d8c7a343cf808abcbfe1b7d3b7e5e0eb7edcf6e42ccc78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761891, "uuid": "725af3f6-8486-4d2d-895b-9f052634e970", "comment": "Malware payload (Mirai)", "value": "3003d9d94d6c00304fb3b5eeb665e0376cc53e12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761891, "uuid": "db0ce025-f17e-42f7-8499-60da1b4de25e", "comment": "Malware payload (Mirai)", "value": "0b677a94f6720f4dfc8ef69dbea96b7a3d22db7156acf0c52f6b5cc3daf8bb83daa953951e9752687b247bc747b00e50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761891, "uuid": "7ae03526-e319-4101-9f13-f7610a4b6d68", "value": "T19021DD9097E01DACC9E4527FED5B03147326BF50F0C67226474CAB29BC1AD7D9D2B449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761891, "uuid": "5fc7cac5-01a9-4772-8f09-8ee9b2ca68a4", "value": "24:79dKGZKrtOPbbzl9n6sArgskvRuAe7+BBuLl7U9gTV0y9:pdKGZKr8PbbzoK5Bu20V0y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761891, "uuid": "1de75ee4-1168-431a-a662-e776ee6be966", "value": 1404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761891, "uuid": "2ab371fb-638b-4beb-8dd7-f7307d37b91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761891, "uuid": "55794361-d3fd-423a-ba15-5d147afbf4d3", "value": "SecuriteInfo.com.Linux.DownLoader.523.1806.5303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb182928-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767869, "uuid": "855e9d93-c0c2-4ee7-a0fc-7a60deb8d436", "comment": "Malware payload (AgentTesla)", "value": "9be04916374d9f23759ac1f9d2235482", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767869, "uuid": "660c8f38-f17a-416e-9018-50734b8b190c", "comment": "Malware payload (AgentTesla)", "value": "62a92402de03b7d2fcf9b3993a3d3dc67ee8e41e2ed9ac6ac087b941548722ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767869, "uuid": "1c4a157e-0ec9-476e-be30-a4ae8a9a2ba0", "comment": "Malware payload (AgentTesla)", "value": "64d5fb314316dd3920291fff6e3a17ba19ad3e2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767869, "uuid": "021b9c51-6dc3-4ab1-9992-359b8e2f41d1", "comment": "Malware payload (AgentTesla)", "value": "0413b35ac67e8de0b187e487ebf59931ed4611293c4644d6ad6981a97f2f715adf9d4b226037ca33d5aaba2e06e1840a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767869, "uuid": "cc21d89b-19c5-4782-ba50-23899c7dae18", "value": "T158D423FEF64E7B02C8B74B3284E0639427B65119F871C93652D1CB9372A3BDA3321695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767869, "uuid": "bcd0a177-8c1e-4e7c-8bb1-b3a5167d90f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767869, "uuid": "50c4b793-e766-46ae-9ac9-3126470644a1", "value": "12288:GipIHJzGdcraXJ8smGuCuEWPp+WdvGsi/+08X54XQbjw8e9iGyPAba:GiyJzm8fr+W8LQ54OwpYBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767869, "uuid": "cb26b7fb-4c50-4939-835a-b41a78a25f3e", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767869, "uuid": "280b3e22-9dc7-4160-b2b0-e6f4dab2e628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767869, "uuid": "23ab0f64-8559-40af-9c44-d233638dacc6", "value": "SOA FEB 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499b004b-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783060, "uuid": "dc5aa65f-e8ac-43e2-b84b-9a0fbb3edbe2", "comment": "Malware payload", "value": "f1cf940f9e64edbd21f30249926c7e03", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783060, "uuid": "18dc4b31-b6db-4c9a-b887-fd035c3ce7a5", "comment": "Malware payload", "value": "6302acdfce30cec5e9167ff7905800a6220c7dda495c0aae1f4594c7263a29b2", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783060, "uuid": "49ef2fcd-443d-4786-a75f-a69ecee0fd3a", "comment": "Malware payload", "value": "8f6840d7b6b43d37293fc37c1636132b5934876b", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783060, "uuid": "9d23f449-1966-49db-aac6-834705b9b9b1", "comment": "Malware payload", "value": "462efbaa5e5baca55222055723d67e7413d4fd794f853d2f1fb2a5b201392931146739bbe1ce5f18ceeab49be0788a9e", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783060, "uuid": "b7d10212-dcdd-4c44-a470-a1b9590c4711", "value": "T15654E757F6F914ADC48EC4B002CE1639C5A0B41489A57FAB2284FAF11AF2FA06F55B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783060, "uuid": "42c0cfcf-9756-4118-b8e5-a83e2d204fda", "value": "6144:CGPHyDt8mAYoXF6Msmvvvami695EsEVI3dKnn5Fd+YROv:CEstnAb6MG695JNKnn5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783060, "uuid": "b8d422a2-871a-406c-b52a-aa1cfa02bfff", "value": 302480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783060, "uuid": "556338fc-6038-40d2-893e-e1ecfcae9b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783060, "uuid": "406f074c-206d-40eb-9cc0-a545327196bf", "value": "ntfsys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f53dc0-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765955, "uuid": "1b6b1cc1-12cd-4e7d-88bc-c4e00f02516d", "comment": "Malware payload (Mirai)", "value": "ad7584635c5e7617723c5851fe459911", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765955, "uuid": "51098342-e0a5-4772-a2e3-700bb579eee0", "comment": "Malware payload (Mirai)", "value": "632647ed11d4a5a6d97bc1dc3534614c706c66749edb33161c6079b56a46228e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765955, "uuid": "e6e8e277-bf3d-4ea7-9cc3-6b2d0cf1aa7f", "comment": "Malware payload (Mirai)", "value": "fa9e8ef1222eb24877d082e18426e9fc7a64c15a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765955, "uuid": "89eb9dba-7aed-4761-bcb5-04629c0145e4", "comment": "Malware payload (Mirai)", "value": "90fafbd753e16ce6d06947efe1bc5f57f2aefae448c17c7b843da12686080d38295d1ecfcd5c4300b0ff8e84c79a2000", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765955, "uuid": "8c950dc6-5bf0-4523-8e12-6b29451626f0", "value": "T158231995B981AA06C6D543B7FE0F42CD3726239CF2EE3213DD252F513BDA92B096B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765955, "uuid": "72059dc5-ad2f-4ce1-a4cc-dbf07abb739d", "value": "768:JlvAz5gYFdzVpj7/H8e18VJDCtAlDT5UW2aN2w6oSbV18h63lcflVjrtD6tOqnJ9:bYvdxpjbcd2tAlhUU6oSV18hElGVdTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765955, "uuid": "878924c5-131b-48bb-9935-fb135e41ec2b", "value": 47524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765955, "uuid": "388a13f8-d1e5-4e62-8425-6493cc400a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765955, "uuid": "3f6f3a03-49e3-4c67-9227-db677b75c291", "value": "ad7584635c5e7617723c5851fe459911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dd1ef1-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749358, "uuid": "dfe5dfaf-4185-4ce5-9487-b6c37e4cb565", "comment": "Malware payload (Mirai)", "value": "55c7c379ce15084636c0cb1312471948", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749358, "uuid": "4ff87295-438e-4e87-9cd4-babf31273e9d", "comment": "Malware payload (Mirai)", "value": "6459ade84342a250118e5b1e47970e317ef8f6aaaab6f1e7e728fa339d47ab9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749358, "uuid": "fcb0e42f-954d-4a5f-bef5-328774daf3c1", "comment": "Malware payload (Mirai)", "value": "3b45d6f503a1675615fb70bf649fe8075a30051b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749358, "uuid": "4111953d-a8cb-4bd8-8c25-efb8356426aa", "comment": "Malware payload (Mirai)", "value": "87ada11ab2f81a9e3a0e6890c8b2cf985bb441f6633f35229bc3757195008553c636468e6971a7feafe48babf6bd52e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749358, "uuid": "f66a8dd4-089f-4579-9e81-3418d2b34e07", "value": "T18AE33B46EA804B13C4D61779BAEF424533239B6493DB73065928BFF43F8679E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749358, "uuid": "54cbb836-b87f-4857-bab7-34760c256a88", "value": "3072:CvM5pE3arrs9Xb+RUz1jpu6NDSZmO7co2XrWM/9lIp/U:CvM83arrs9Xb+41s+emO7co2bWM/9lIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749358, "uuid": "2587d955-3126-4bc6-b8d2-e47f44dbbb4e", "value": 148909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749358, "uuid": "1ca18687-6992-4659-8b5a-2b311041675c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749358, "uuid": "59a4008a-04f1-4def-a45e-b7afc0eab707", "value": "55c7c379ce15084636c0cb1312471948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaacb8a-e50c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710755198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755198, "uuid": "e109e451-ccf6-4007-b86b-c7d9b70cba91", "comment": "Malware payload (Mirai)", "value": "bb3dfa2a9342833bc9071e7928da86a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755198, "uuid": "dc562846-26f5-4d61-9546-9c45afb2abae", "comment": "Malware payload (Mirai)", "value": "6474f4d480f47b95ca6e0a29831450156fc1c29735f9361c0ae5f3d24168bb46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755198, "uuid": "e27e2218-d6af-4447-b33a-f642844c536f", "comment": "Malware payload (Mirai)", "value": "dfa9f36dce75f67610bf5830cdbc97e818683ea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755198, "uuid": "a71c0947-ecf4-48f2-b41b-95e247f78187", "comment": "Malware payload (Mirai)", "value": "6f03cdc7c16c8e459ba01360c3f196d8a53bbd8fb7c86709ca3b6ec6a3f4056a76a622459ce463856e792a669ab8e65a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755198, "uuid": "bb81aa9e-433a-49c1-80e4-c437df8ee66e", "value": "T104E31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279E1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755198, "uuid": "00cdd3e2-dfb6-4c38-ab66-943e3dfe1871", "value": "3072:Z41HOuaGVV3NfHUOjqylKqCw3jkmhxQwoVZUNu:Ze3aGVVdqylKq1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710755198, "uuid": "26a324ea-fcf8-4dc2-8520-9af63b2f4ea0", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710755198, "uuid": "9c3ab142-89d7-424f-92e5-a709393df31b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755198, "uuid": "d18848da-ea9b-4bdc-81d0-7df52c1bee06", "value": "bb3dfa2a9342833bc9071e7928da86a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79de219f-e54c-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1710782711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782711, "uuid": "5bdfaef2-d4fe-4722-a277-802fa1e00c37", "comment": "Malware payload (STRRAT)", "value": "0f0274c22f9479969a5c7991a81d7233", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782711, "uuid": "871259d1-b4ad-4904-8ab5-a6003b282008", "comment": "Malware payload (STRRAT)", "value": "64e8cb522a3a4664791c27512d94a911bc2fbcbae09b625976ff8ac6809819d3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782711, "uuid": "5cf2cbb3-29dc-4e1c-bef1-e18fec323255", "comment": "Malware payload (STRRAT)", "value": "4eda9e68ffc9158532fe53d7939c45db671192cc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782711, "uuid": "8e195a65-d996-43f8-8361-65db8d188b6d", "comment": "Malware payload (STRRAT)", "value": "84036dc6a6ce7086650ca543cc4bffbfc8b6245d4533b2f7d2b3f74db3202d77a3b1ac29599686b45df5cad3cd985c99", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782711, "uuid": "7fc76d8e-7cfc-4485-aa0a-c4e16e29c34d", "value": "T13D04016B2D9DC8F9D483847B185882FBB6AC02E8D649D21F14FC94585C32D8D6B42ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782711, "uuid": "80155877-83d4-4f34-911e-f469f561e1bf", "value": "3072:/+ySyCvkYdkYAdyztiaKSr4ppewn4Z1SnYikytLdnipAUGGepviEY+pNjcMWBd:/+t7kxddQtad4Z1GYik3cAF+gMW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782711, "uuid": "d95295db-d9cd-4c77-b980-e974714b6338", "value": 182714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782711, "uuid": "980a3f5a-b52c-4b7b-91a5-eeaef4c85773", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782711, "uuid": "434b5a77-b22b-4dd4-a646-8152b045fd0a", "value": "SOA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f874bc3-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757810, "uuid": "b8785a0d-095f-4a19-b006-a6f83a86416a", "comment": "Malware payload (Mirai)", "value": "59ba580cb4bd4d2b6e379160804ccbf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757810, "uuid": "c00703a4-b368-437f-9d32-bd8c62fd0492", "comment": "Malware payload (Mirai)", "value": "651e139ca27a13fa1471290936b8ddc4157828094e2b87ec2948f95f171d3f3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757810, "uuid": "879346b0-87e8-40a6-8ed9-799ff6b5ba29", "comment": "Malware payload (Mirai)", "value": "47593e43b644464f1b6279d3da98a61d5144c918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757810, "uuid": "414062d6-46a7-417c-af1e-7c5f3d482a90", "comment": "Malware payload (Mirai)", "value": "12e407861cab316e84ebbae5b70428ab13b89f968725b6d73a74336dee350e5ee0e0c70a8d18c0a82b72e21d19dd1dae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757810, "uuid": "181c2328-5768-4719-9c9e-f6789a92a6c7", "value": "T17FD3C549E9549B29C7E332FEFA5A12CE332B0B9CF3EA71119E304B513BC8B565935121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757810, "uuid": "7a674abe-9622-414e-b403-9c0032664053", "value": "3072:PaqqVpFoTdp6YAGPqqF/axwLdbrN90Gc3ol3ORS:PwC/AK1/axwLdbrr0SNORS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757810, "uuid": "4325a606-4140-4fe2-95e4-0c6fb926f776", "value": 130360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757810, "uuid": "52c1d0da-4e75-4396-97d1-2fb2672e52c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757810, "uuid": "f37bdf20-770f-4e7c-ade9-274e7f641f17", "value": "59ba580cb4bd4d2b6e379160804ccbf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d85f5d-e4e4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710738012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738012, "uuid": "43de706b-d107-440f-bbab-6c4a463c01c0", "comment": "Malware payload (RiseProStealer)", "value": "f0fc13434575e90b52002274fe7f3e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738012, "uuid": "a81e7fbe-d4f9-41b0-bae8-2c3330cca707", "comment": "Malware payload (RiseProStealer)", "value": "6538f315e68894f84b9f0c3c47042267b580574a4b58690bc327b1dfeef92d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738012, "uuid": "3dc0e9f4-8248-477c-b85e-3dc9c1fc1d7e", "comment": "Malware payload (RiseProStealer)", "value": "01491af3dc92c4a6c2c00cb2ae0c6679b6599826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710738012, "uuid": "15701187-c5ce-4fdd-ad4b-35d7438d3510", "comment": "Malware payload (RiseProStealer)", "value": "1597ff46e88223ce936fa9543f78b8a1f5d150edcd7609a98025c8adfb7b6eb115fac444ab33caa77f9b5782491d3c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738012, "uuid": "61c6a076-1eb7-4176-a9b3-6fdf34031c15", "value": "T1F6E55CA2B50571CBD48F17B89527DD82695D03BD4B210CD3E86C64BEBE63CC125BAC2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738012, "uuid": "b4769ed4-d82f-4e3d-8235-2258b86b61c8", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738012, "uuid": "f9b50995-2317-41e3-9742-896e1ab6e2ec", "value": "98304:i/FJzK8m6YJpydAPpvRIenP2tZ8OQkr6:i/FFK85t6OQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710738012, "uuid": "f9f8476d-c26f-44bf-9b47-558fc130b753", "value": 3217920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710738012, "uuid": "b36fc404-592f-4cd4-8288-c3bbc2de514d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710738012, "uuid": "74642f9a-6af3-4033-b052-0aa2aed98ea8", "value": "f0fc13434575e90b52002274fe7f3e31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75904a41-e4c8-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710726011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710726011, "uuid": "92121487-3131-4622-bd91-aa76ad1a5bbf", "comment": "Malware payload (RiseProStealer)", "value": "a17b40f937ccdc605571a09ccd78b4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710726011, "uuid": "1480355e-c114-44ad-be44-e145f1cf313f", "comment": "Malware payload (RiseProStealer)", "value": "65df43e0b78a68723d7321a0d383c393f2aef9c9558177834db59e383e716a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710726011, "uuid": "5d08b460-790e-48fa-896a-677d5a241200", "comment": "Malware payload (RiseProStealer)", "value": "f2157753957042b456a42d50377ea327eda73ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710726011, "uuid": "91e575ff-0308-4ecc-933b-6012179c79ac", "comment": "Malware payload (RiseProStealer)", "value": "a18c72eee1b047b927f24f34b315bd3e1d2de2d36c47bdb5e916eda0a3cde74a80e15e04e65fd43b7d78338d836c87d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710726011, "uuid": "7343de04-5503-45cc-ac5d-2a3b9f21392e", "value": "T186E56B56F84472CBD48E1BB4B52BCEC2591D03B9472149D7A958A4BABF73CC036F6C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710726011, "uuid": "df978581-8814-4dc3-baeb-2887f9a6952c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710726011, "uuid": "30bf9df6-3485-4c01-863d-e64f44ac63d9", "value": "49152:dVLkmODCxtKMOfv8lwD/qgM+fxd/xEnEdAn60:TcDCSMOH8lS/qixd5En8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710726011, "uuid": "259e8673-6438-40cc-9da6-2bfc131a35d2", "value": 3212800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710726011, "uuid": "f8ef7792-553a-4e83-b38f-0bdab84c06ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710726011, "uuid": "1d32214a-a3a7-411b-9655-3ba544828357", "value": "a17b40f937ccdc605571a09ccd78b4bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa2e00f-e4d1-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710729912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729912, "uuid": "59e332f9-a56c-4323-864b-ab0b0cbd949f", "comment": "Malware payload (RiseProStealer)", "value": "e9d43a78892830904085a2afd0805e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729912, "uuid": "60baf693-cf33-483b-b50e-20e93a355745", "comment": "Malware payload (RiseProStealer)", "value": "66dd9075127d96aa95f47e7b136f65794b8edf842a515a2c8faa5719395c490e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729912, "uuid": "94f483cd-d04e-4554-b41b-416210b7c87e", "comment": "Malware payload (RiseProStealer)", "value": "805708aaa48e5e0edd0464c96a695666f2386e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710729912, "uuid": "673ebfd1-3730-49b7-9658-46d3774e0004", "comment": "Malware payload (RiseProStealer)", "value": "8b9cf31a5de43c0587196f63b1ae0c914c7922433675ff6f232625705378e40c59a6a1f54536c748552517a3cd1f7af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729912, "uuid": "42b5b458-20a6-4cba-9bdd-9d249f360887", "value": "T13AE54AA2B40472CBD49E2B78D5A7CD82596D43F8471049E3A87C74BEBDB7CC426B5C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729912, "uuid": "119aa117-78b3-4205-ac3b-419f3aa12b1a", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729912, "uuid": "9645941a-bda0-4cf0-92e8-f4dc23fc54e0", "value": "49152:bjTWQy80pDRABWs7nMqQRLq7FhBQSj8IQADvKVQVU:aQyxHsrMDdC/+Sj8IQgvKVkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710729912, "uuid": "1a7eb230-a316-4614-885f-1224a73b3e26", "value": 3238912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710729912, "uuid": "1361a256-5acc-46a8-b335-29fe8107c6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710729912, "uuid": "923b4574-4c28-4d0a-a513-3d2993cca3fa", "value": "e9d43a78892830904085a2afd0805e81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8702398c-e4c0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710722604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722604, "uuid": "c7c545ba-e8c2-4b34-9df6-f1be21ba372f", "comment": "Malware payload", "value": "d608b00b3814f1d793df5f8142a38432", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722604, "uuid": "c60960a5-3b6d-4d26-9295-062051faaf0f", "comment": "Malware payload", "value": "671ab754a8016c1a99451056bfbc4ff4b2e069e687579d2512c221bc3be6bcae", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722604, "uuid": "456dda9f-9243-47e4-b7b9-ee1d0611ea2d", "comment": "Malware payload", "value": "00def7836eefea400ee3839697bf7c1fdc231dbf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710722604, "uuid": "9aa2d22d-aae2-4149-87df-f8fe4b32347f", "comment": "Malware payload", "value": "c255e8fb221efe10f4c83f4c56fad31e95d561ff065602dfa28873d5abe5e64fa144a89ee780801eef538aa85c617ed1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710722604, "uuid": "1c1bec06-a069-416a-b3de-a1f7d68f5d69", "value": "T192C50183E755582FC5FB833A46760B2A85474C6A8B83D3974964B33C6CBBAC45F81F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710722604, "uuid": "cef9b601-143c-40bd-ad82-40c403bd06e6", "value": "49152:b7W9j4LH5G+8hAqt20Agh/k456qAptb4PTignlgEQbULJbmyEd:b7jH5G+wAt0ABqstUmgnmULk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710722604, "uuid": "7918f083-5435-4d97-a66e-bc13c1b01e3b", "value": 2709239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710722604, "uuid": "3e2868ea-c306-4c77-83f0-7ee4c9c8ccf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710722604, "uuid": "65539dff-a693-4127-999e-57c749b39a19", "value": "Application.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaeee59-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757914, "uuid": "d483699a-edab-4967-8d85-106fea4deae2", "comment": "Malware payload (Gafgyt)", "value": "14e097ba393e46543a2e79573b18eb45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757914, "uuid": "e1fc2a10-5e41-4151-a125-1f8d4bb4f92d", "comment": "Malware payload (Gafgyt)", "value": "690561978de33f9ac875c9d1f152dded4d2062e15588d6296df11b320f8789c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757914, "uuid": "beb7d9e1-74ee-4729-91e7-df5ee8e6e084", "comment": "Malware payload (Gafgyt)", "value": "dd5dfcbfe94984be3f317821f17f83ef9452f31e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757914, "uuid": "5fd5de40-c57f-421d-9a4e-252ec273e52f", "comment": "Malware payload (Gafgyt)", "value": "0259c43728fe6e77bd17ec57d34f388ed69254684feabc018d10a5e54f778e7773aff382fbb25bc7cfc5a13e8fa9bb2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757914, "uuid": "3d7efe4f-e8f3-4ac9-ab7e-c5e6fe8eb569", "value": "T17FA30893B905EEB7F40AD77704D34B24B230FBA24E531662721B79A6AE321D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757914, "uuid": "2f4b7d0c-74cd-48aa-842f-80924af1feb9", "value": "1536:5I/OWY4H0suIw8rnB1g6GPhteH/otWaXHXDisyAeXQZe9kQ7/mQqs9+qlqK4Se:KQ4H0sFVnI6ih4ynDisyAegZeegmQqs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757914, "uuid": "30ef2eef-df61-43e1-bf21-b4e46377cac1", "value": 98137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757914, "uuid": "6acdbe82-a21e-4d54-910a-dfb9c3f14c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757914, "uuid": "952c2d58-932e-44b8-8f32-b9d6e615e650", "value": "14e097ba393e46543a2e79573b18eb45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be59d07-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727364, "uuid": "9e92fb6e-69e1-4767-b451-7c61d2f9d36c", "comment": "Malware payload (Mirai)", "value": "c30c5f5f7b2c751e0cb21b5d54af54b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727364, "uuid": "220306db-86a0-49dd-8a1e-fea1c333be25", "comment": "Malware payload (Mirai)", "value": "690d46b25393eea588d0f0f8a77f5c7814c4c7a5c0168c14bdf44d51231c8dfc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727364, "uuid": "5f659ce9-f89b-4140-92c5-8b86d42a5c77", "comment": "Malware payload (Mirai)", "value": "a4758bf291de5274f9dfcfdfa9d0efbcd3261622", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727364, "uuid": "985c1e8e-a08e-41b1-8025-03c273eb5350", "comment": "Malware payload (Mirai)", "value": "b3b157329e35112e643c3214c311857f8e80a1de86c2e49ec4ef9b7dd6c650e9684680f02dc89df1c30c14d03416805d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727364, "uuid": "1d9734c7-cc01-4f71-9721-28117e62b95d", "value": "T131C31945F8415B17C6C212B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E37A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727364, "uuid": "647238ba-ed05-4325-b92c-9bb0d51fa10b", "value": "1536:J2DwI4fG50nVg/AKEr9+19jAd424V8G2TTZmVtqLDuZ1budlLul/uwyw6FPRb5Gy:wDwLYhAKo019jc4r2/ZmVtqIbuz2LHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727364, "uuid": "9d688856-b5a9-426e-870d-80ef670ddbcf", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727364, "uuid": "1b30a803-d758-46b6-940f-453a97109f75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727364, "uuid": "49ce0341-7e5e-4520-afa8-59456e263249", "value": "bot.arm5-20240318-0202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f598d245-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710761874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761874, "uuid": "79d00e94-9154-4265-961a-fc74d9811ae2", "comment": "Malware payload", "value": "2da434f7f41e45f2dd7a4d95ec918729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761874, "uuid": "e74e3fb2-27cb-4e88-89b3-cd0daa344fcd", "comment": "Malware payload", "value": "6962bc705794560b682b5d546bb5282ef71db54a8739105f49d231ceff419a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761874, "uuid": "ccda7a4f-4562-482b-9dd9-be872250b0f6", "comment": "Malware payload", "value": "217299e4776e7ac15264fc6311218b8b28bbafcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761874, "uuid": "372860a4-9400-40cd-a4e8-b208e1e66e84", "comment": "Malware payload", "value": "0320a6a883aa37e867f74737edcf6af5bfb5c8ae64c2e48428843fddc551607c67c9f21df1ee868e5f73b56a7efd526b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761874, "uuid": "541f12d0-42d6-4028-a6ee-89c1b269377f", "value": "T143A42376FBA4CD1BECB46CF29671F481BC7BC6AA6844EFCC0A9071D5350B228D2DA454", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761874, "uuid": "14c9e72e-b6e7-43c9-9bf2-c446e1f85a0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761874, "uuid": "12b1c524-81d4-4b9e-9a4d-52aee5e5c770", "value": "12288:N5dpUvt4snXViwOByWYdJNp4mIAYgM8JoRlRFOQLgY:N5dOlLXTs6JNjhYgnoRljON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761874, "uuid": "835b6c9b-3e35-4506-9240-1f7ebd7baf81", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761874, "uuid": "3fbba39c-2d31-409e-9679-f65fb3382d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761874, "uuid": "b784c232-39ac-42e1-883f-c6285d73aeac", "value": "SecuriteInfo.com.FileRepMalware.10109.12696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461b64e9-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767592, "uuid": "c8164a76-1042-41bd-b434-1cead98b617f", "comment": "Malware payload", "value": "1bde1e4ecc8a85cffef1cd4e5379aa44", "object_relation": "md5", "Tag": [ { "name": "AcidRain", "colour": "#9A24A1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767592, "uuid": "f5467b6c-a5c8-434b-9af9-8aa1a83ea817", "comment": "Malware payload", "value": "6a8824048417abe156a16455b8e29170f8347312894fde2aabe644c4995d7728", "object_relation": "sha256", "Tag": [ { "name": "AcidRain", "colour": "#9A24A1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767592, "uuid": "4b02d40b-3e5b-4e07-b14a-fa4bf20413a8", "comment": "Malware payload", "value": "b5de486086eb2579097c141199d13b0838e7b631", "object_relation": "sha1", "Tag": [ { "name": "AcidRain", "colour": "#9A24A1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767592, "uuid": "57d110b1-a094-43a6-93a4-6c49eab553a3", "comment": "Malware payload", "value": "4aba54b0bac09eeacd676e6d19efd3b0b769d3b7dd86a6b72b41cb49c200c83752e9ae38e43774a73a30914eba681158", "object_relation": "sha3-384", "Tag": [ { "name": "AcidRain", "colour": "#9A24A1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767592, "uuid": "fb3a2dc4-9278-41c7-b931-27d4baafc684", "value": "T1ED721A02B643CDF6DE3301F650AF87A69772D83760548DBBE3A04E79A967D0952073C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767592, "uuid": "b842c3a4-5784-4fa0-9774-52c0816ae98d", "value": "192:fNkCDv+GHgGzqhuij3a7nhAC74hHl+jYPgJJdzWR8USh5RfA4fHTay4DkZBB+Gp4:fikbzqhtj3C7y0RHPW0mm+G4xCcQuGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767592, "uuid": "af0e7721-01a7-4278-9744-c4a9143c7bf1", "value": 17388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767592, "uuid": "06670455-0aad-4007-8004-80040d8ce637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767592, "uuid": "d6cdf775-8e30-44c6-a739-6fd5fd8cc9e8", "value": "tmphluyl8zn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bc885d-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710745528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745528, "uuid": "42ae4195-949a-456d-b30c-d65f9739be82", "comment": "Malware payload (GuLoader)", "value": "f37eba6a22be52a53b65f6a8767cd717", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745528, "uuid": "6be819e4-eba5-4a22-86dd-bdbb3214d1bd", "comment": "Malware payload (GuLoader)", "value": "6b0a4c4ed72778444229216272a7305bfd73b05b0326c2f1cfcd39fd525c428b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745528, "uuid": "c6874c8e-6f67-40b9-9cd5-5bb7b2b2d43b", "comment": "Malware payload (GuLoader)", "value": "cc50ed04312363faf89b95b8917a2cdbbbc5a232", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745528, "uuid": "3476db2d-e308-437f-9924-7dcfe9e1c378", "comment": "Malware payload (GuLoader)", "value": "64ce416933a2e6dcfcedd9c1b31dc39c964103bf37cdc8d16de1a75967a68b1d47c48de061d513185fcf0a6138bd3f14", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745528, "uuid": "59a4c1ce-9931-4da6-8846-f9f90bde6252", "value": "T1F77238485E5221E8916356F7A85E793AC43E51F7A8B050763C5CF1308C9AB2D3EAC5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745528, "uuid": "6bf4c6c6-d9d9-4616-be17-12931d215499", "value": "384:WrpVdXCkXZ9FUQF7A3QOQ29nHoZYPjYmtt1:WtVMkXlUQNA3RQ29nhjYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745528, "uuid": "871651ed-5f93-4580-a02a-5af4e334122d", "value": 17563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745528, "uuid": "f32aa7fd-b966-4bcd-a14d-1960698fd9b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745528, "uuid": "dd8805ad-9f2c-49a1-8735-7876d4bd2f85", "value": "awb_shipping_documents_18_03_2024_000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0857bbb6-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779944, "uuid": "81b3f6bf-7d65-4a42-8240-efbda4b68d83", "comment": "Malware payload", "value": "dd35b1eb8664923c14f45aa39eb9376e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779944, "uuid": "55785e47-6167-44dc-8e14-8802e1886f30", "comment": "Malware payload", "value": "6b2ec9d6a9d69aafe7c9a8ada20c7f74b216ac26a9a3d66324e9f653151d48ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779944, "uuid": "c4f353a5-0dbe-4c7f-ba91-d052c3f72405", "comment": "Malware payload", "value": "aac93f6e1777fec5a615d910d9c29c6925e56870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779944, "uuid": "777a9740-7d18-4476-972b-dfed1b5975df", "comment": "Malware payload", "value": "a85e01c51bc32cb7d93d853bc729849cbd1e293ae9ad39601cd3be8f6c9b71d3dce7e7d89bc08850a9ab4416d3dfda5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779944, "uuid": "291df1aa-06cf-4ef8-8b98-3b83a62f5ea0", "value": "T14AF4E04590EC589EEC4939B81E66A6500483CE5463C58DEB65FAB03C19F71E3DCBFA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779944, "uuid": "fd090316-824f-4d88-ab98-3ad5d2002187", "value": "471a01ab19f4b620306ffc03784886d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779944, "uuid": "37c53ce1-d794-4cbb-b2a1-ea55cf6b8c47", "value": "3072:QkwiMaRHUH/kIwMG7pcHEmaSMl5+bZG/LCZjakLjDooZZ3qi:5BMaR0H/kIPGSkoM+AjW5bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779944, "uuid": "6239e63d-86f0-4931-bdce-e50ab83edcd2", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779944, "uuid": "f319d8e4-493b-4b49-aac6-d6d8a90bcfdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779944, "uuid": "d45f1500-bda4-47ed-bb59-42a1d3b0d07f", "value": "SecuriteInfo.com.Win32.Downloader-NVL.17694.17093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e492b3ef-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710783320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783320, "uuid": "e1ae321f-08e8-45a2-ab58-733e6ab60312", "comment": "Malware payload (Gafgyt)", "value": "c33152174571fba489dd4a50b4b347dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783320, "uuid": "dbc8cbbb-e519-48fa-b4c9-c29a8a25869f", "comment": "Malware payload (Gafgyt)", "value": "6b43532368fe3cc23753225695e877cb3069b980cca75443922b67655f8d1e70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783320, "uuid": "87921e49-d856-4629-b480-cef2c973a3a9", "comment": "Malware payload (Gafgyt)", "value": "71f82604cd04428255426ef67426cc73de407100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783320, "uuid": "ea7216f4-2526-4eb3-8e50-ddca65553b34", "comment": "Malware payload (Gafgyt)", "value": "55dfa39e9a2b028b9479c54b3e5c893e5fb59a802e4739b71b73e1ac3d9e1613d55ca7a30f60375df13e0ada88dcccc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783320, "uuid": "e4e70247-2527-4abf-8c24-aeee90bccb4d", "value": "T11B733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F59F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783320, "uuid": "2dc55cd4-16e7-44a3-bcb7-a593654a085f", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMAMmLI2VOCjXUfJRk:45omr0xKFn6J+ODMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783320, "uuid": "b72ebdc9-9738-4907-afdc-656044a66a07", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783320, "uuid": "6a648c4c-926b-499f-b17c-c95576ecc4b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783320, "uuid": "05ebe109-e88c-4657-98bc-808c19ae3e58", "value": "c33152174571fba489dd4a50b4b347dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2542896a-e55b-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710789012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789012, "uuid": "749a988c-86b3-4617-8fc5-9da4d695821a", "comment": "Malware payload (RiseProStealer)", "value": "1c575f28d7b66a908858c33fa945951a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789012, "uuid": "c9d20fe2-af07-46ab-a7c4-750a63d0e22e", "comment": "Malware payload (RiseProStealer)", "value": "6bc9d8e439d32f00214bfb6c7d0ed52292bd38fcc7f19f2bec0a0ed0c73ae0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789012, "uuid": "1156551b-1fe1-4429-be10-608e1fcf85d8", "comment": "Malware payload (RiseProStealer)", "value": "4031d16da74b0e90c9d647d4f9135f14e9f7a12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789012, "uuid": "e174b416-fe03-417d-ab03-477e4878067d", "comment": "Malware payload (RiseProStealer)", "value": "caf45807b5be40fa671a168f3b487cf99e8eb5a764aa3a30cbb33f45c3a77fdc16c12c39602e4881adb6984e981471b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789012, "uuid": "77ffe7da-9d0f-4c7f-9c9c-cf043fb13cdc", "value": "T15AA533C96E708C58E8E914F565BBF3042EFDC8A431C8882B35EF62A55E35D8D36D7A40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789012, "uuid": "6e86a326-0c20-4632-9dbf-cccb24530655", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789012, "uuid": "54f23c44-0267-4772-884e-7448b79fa5e5", "value": "24576:FWqG7809+QZf3RtTdIoITUnXbWiqXpO+BZrGFppUd3ojpo6h+lFRP7IKU9jIVn9s:c7x9bpL0YZOTMppUdojORP7pFn9iio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710789012, "uuid": "94f7a2fe-c95c-4f91-b694-0b87634a4b25", "value": 2064896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710789012, "uuid": "b7f1fe0b-e470-43d5-b984-2680efd342fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789012, "uuid": "286d9f84-d9b1-42dd-a62c-0c3f950479eb", "value": "1c575f28d7b66a908858c33fa945951a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2717a86a-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745636, "uuid": "8f5b680d-ea6a-4965-8d3f-115a6d07cb76", "comment": "Malware payload (AgentTesla)", "value": "0e371f33cae6aedd827bba66718c8219", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745636, "uuid": "3c109321-292f-4693-b549-ea4e557ecc08", "comment": "Malware payload (AgentTesla)", "value": "6c37a2a936f9bbfd57948d3563b2fde3a492cf72904889d85bafcce2e4ca3b9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745636, "uuid": "3ec767b0-eb46-4dd3-a9cf-5b29e8f496c2", "comment": "Malware payload (AgentTesla)", "value": "61a99a8e1554d6e7265ba3f54e67d10ca8691147", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745636, "uuid": "1ed25aa1-c936-490d-ac17-f5314929e390", "comment": "Malware payload (AgentTesla)", "value": "cd287d69fcd768b4ac8b064de27e2b2342d8a6c92485ba43301ee2475b3ef9fba25d4f3a087935839e0774627dfd9d21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745636, "uuid": "7e367a7e-8552-46be-842a-a8578a23c539", "value": "T195D42378330C4BBADB8553375D5F0B03C5AEA2757408E7C4BBB1694C4E10B66A29AF87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745636, "uuid": "e33a6b98-7c34-4f99-854b-f2a83ecc51e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745636, "uuid": "18243157-6292-4c3a-87e9-c066700c7937", "value": "12288:bgRhEXa4IWMFYj3Q4Gcdsf73JIg6GysNphVqP/ty1D8yJqvxaDZk:cQuWMFgdsWHg72/yJ+06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745636, "uuid": "e731edee-bdae-4a5c-b065-2bbc5d174885", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745636, "uuid": "4b1b12a6-9afc-41f0-982d-808ff8519f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745636, "uuid": "c6f1e5e0-8b0f-42dd-8bb3-cd4d97534059", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef79816a-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741677, "uuid": "00bb2248-1c32-4023-bf4f-1bb84254ab23", "comment": "Malware payload (Gafgyt)", "value": "1b63412efed582d42415358ec65da161", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741677, "uuid": "f7780d56-0d8b-43b0-9067-dbd475c1c58f", "comment": "Malware payload (Gafgyt)", "value": "6c94f4c4230b1b8d48752609c053d034e692d566e3cd85259c61e5abd3eb63cf", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741677, "uuid": "57d9cd8c-26d6-4770-ac70-93cd0e1d430e", "comment": "Malware payload (Gafgyt)", "value": "8b6c057a9a3475ba0bc12563a895b91e89e32307", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741677, "uuid": "b181bab1-e119-44b6-97a3-48b652ef4a7e", "comment": "Malware payload (Gafgyt)", "value": "7aa4566ecfc83ada03baa2d9c5827a04aade5120c110ee0085810c93c052bc67ad72d72ffb0822071fcd76972bb42554", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741677, "uuid": "077d3347-99f5-46f4-bcad-379aff0f59b8", "value": "T1ADE33B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741677, "uuid": "9be5fb00-12a7-4bbd-bdd1-be1a6523a1ac", "value": "3072:tdntU2haO5H1XacBoGmh9H5f5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9H55hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741677, "uuid": "cf094cff-3836-4e2b-b4c4-1a75a744e240", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741677, "uuid": "c56adeb2-b5b7-484f-a3ff-6d711e7191bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741677, "uuid": "fb82cc65-d624-4d15-ad8b-99ac3590597c", "value": "fuckjewishpeople.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56213dc4-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710745715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745715, "uuid": "65260570-6d4e-4bf4-a3d6-e76205d1662d", "comment": "Malware payload (GuLoader)", "value": "e97ae63e5c9d0ee980d1812c9266beba", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745715, "uuid": "606f4582-5f31-4ed2-882b-6b2e4483b03e", "comment": "Malware payload (GuLoader)", "value": "6cf311a17be329c440e20a86db84c0d03597e977279411faaf7bf2806a206078", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745715, "uuid": "2beab395-c5f7-4ee3-96a2-7d47f6707397", "comment": "Malware payload (GuLoader)", "value": "22377a4622d30e5b3bf25074cc95f8bd46ed557f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745715, "uuid": "e7871ab5-15ba-495a-8511-45c55f84fba1", "comment": "Malware payload (GuLoader)", "value": "602f9edb2cdf83e69d707ad6aa280c3d45f003af7233358ad112733da5b4fcb6a3b767e77e76b151fa6bbe4973cce30a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745715, "uuid": "d485f4e5-85e5-4067-bb74-b943ade76f09", "value": "T1C4E42348E3D8A85EE6931E727DB2EEF7347DA60011BF024B77146B59BB21383CC64985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745715, "uuid": "c1eb4ad3-df14-4105-9a0d-abedc41a4535", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745715, "uuid": "3d948bfd-9de7-4256-bac4-616900964a64", "value": "12288:Lq3/MIr7NNIcsOkSug516uDNtwMFqaIPMnQhH1CRjU0u3FZWTzgDa:8/MIEcsOt/6uZt7saIPMgVCq0cszgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745715, "uuid": "c2e90c1f-a394-4030-8ebe-35df248efae3", "value": 660112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745715, "uuid": "617647bf-09a5-431f-aef1-bc0275cf00c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745715, "uuid": "6cc1f27f-b11c-47de-84d1-4b0c5dc4c4ae", "value": "DHL Booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41b5edb-e4fd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710748906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748906, "uuid": "1b0a16c3-d9d1-478c-b164-4e516ccf39b8", "comment": "Malware payload (Mirai)", "value": "f32344c1eea9d0787d2c1a8a372c91ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748906, "uuid": "81a5a786-893b-4869-ac63-a74bef488515", "comment": "Malware payload (Mirai)", "value": "6d9838d48056ff91b0aae9ea6e34b1cf0ff0f6dacef4970176cce8c844849817", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748906, "uuid": "3860efa8-f7b0-492e-9f8d-ec957a80fafa", "comment": "Malware payload (Mirai)", "value": "ff1afe051ca7daa0f2173b11991214625082e17f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748906, "uuid": "b814b985-826b-47be-b56f-4064b154a978", "comment": "Malware payload (Mirai)", "value": "bcbb863a3a69177449fae85349be9dae69b36eb90bdb8f2b6f4c54562dc080325b930b0347e2371056ac884f3e0dda43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748906, "uuid": "eccf0489-b330-497d-847e-3002cf2db45b", "value": "T173C32B46EB818A13C0D61779B6AF42453323EB6193DB73069528BFF43F8679E1E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748906, "uuid": "2a004eef-2288-4035-b9ca-6cad03647458", "value": "1536:HTnXK31x8xbB7TIGmsfJUrTTJNla0igfndfdRp1G70I/MkpU4lzw/9iqb1xvUK5w:uFxIIGmsfJUIifn1dRjGj/tM/9iOKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710748906, "uuid": "e9dbfc9b-a49d-477d-809f-8529cd08af0a", "value": 127315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710748906, "uuid": "0440805a-8fa9-459d-9be6-40bb74f1b96a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748906, "uuid": "ac164ced-cdcd-4539-88e9-2645322ee642", "value": "f32344c1eea9d0787d2c1a8a372c91ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f506f63-e4de-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710735315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735315, "uuid": "9420f3dd-057b-4995-831b-ba40b68659aa", "comment": "Malware payload (RemcosRAT)", "value": "2562ad2e3b7633531bafa6737c6c245b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735315, "uuid": "df75c25d-a8c9-4d9e-9204-914acfc7f9a7", "comment": "Malware payload (RemcosRAT)", "value": "6f31f28d716f4d118974c5fd130a02fb742e20f164ea12b2f1e471f58fa5b817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735315, "uuid": "6b08f341-037d-44bd-b211-df943a2156cc", "comment": "Malware payload (RemcosRAT)", "value": "ae4f5f50f98ba3aa77f891ae6a691869e51dc7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735315, "uuid": "aac605dc-a43f-42d5-8a54-bb79977ea318", "comment": "Malware payload (RemcosRAT)", "value": "671c481f0b7555528bf083e23379c2263706622b757db0b2ff13f21da52c2fe4c13e4390567cbacd58e0d0947aeb1313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735315, "uuid": "334e9ace-a9fb-4569-ac97-ed25b9514cb5", "value": "T19FB4128D1656F6B2CDA80DBDDC52409C4F72D067009BF313AAC5DA618F0DEDA22E45BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735315, "uuid": "e2e31a97-5841-4bc4-b1be-ce7334c9b6e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735315, "uuid": "f4caa385-25dd-4b5e-a2a9-11d173eefb93", "value": "12288:bvu8+/mPTjv4dvLLy6gLPTznyl8PzBJZdR2hhTpjKsPLPPPPPPSPPP:K8++PT7EvXy6gLPfu87BGRVPLPPPPPPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710735315, "uuid": "1e9c23e7-b058-4029-b7d5-df7b231c2f73", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710735315, "uuid": "c0a13907-0580-447a-8008-485d537059b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735315, "uuid": "051794ff-aff3-4d41-be55-64816756128e", "value": "2562AD2E3B7633531BAFA6737C6C245B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8511321-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710761878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761878, "uuid": "8231f01c-0628-459a-abaa-0bdbf77ad722", "comment": "Malware payload (Mirai)", "value": "52ff53b81f35cd4dfb2bd4ffa151aba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761878, "uuid": "8168a042-1016-4ead-9779-08bd8802a4e1", "comment": "Malware payload (Mirai)", "value": "6f7320471ae04ca68714f129efe4f71e471254e484446bd4ac052d6a1e67d05e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761878, "uuid": "694c0a7f-3e1f-4bde-bfef-1bfb6c09bb26", "comment": "Malware payload (Mirai)", "value": "1b2503d52b5dca6683ef98596457de24c258fb02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761878, "uuid": "bc96f36a-3e40-4f1b-83fe-2f8d40586e28", "comment": "Malware payload (Mirai)", "value": "1f2563eef43d832aba8acecbc5f046332045418abde47f4188e0e47302238e3012f56f71ca4e82d78d1d3c1e1852c78c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761878, "uuid": "854500f1-5cf8-4ff2-a2ae-1d9bb714f500", "value": "T14921DA9196E02DBCCDE4517EEC5A0311B366AF44E0C3F253561CB329BC2AD7C9D2B54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761878, "uuid": "d25b83b7-fadb-4389-b4b0-0b42eb0de95b", "value": "24:OTtVHKGZKrtOPbbzl9n6sArgskvRuAeHg1bBBuk2lxrR+zHjnkU:O5JKGZKr8PbbzoKNjBu/lxrWHjnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761878, "uuid": "1f5e9076-7b1c-4caa-ac12-450d791d5188", "value": 1360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761878, "uuid": "620b2f14-dfc3-40cc-9161-ee314d31775d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761878, "uuid": "9f504afe-64c1-43da-98a6-e9c093ee3098", "value": "SecuriteInfo.com.Linux.DownLoader.523.11670.9271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fab3ee-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779947, "uuid": "69fa90b1-5266-4a4a-9e48-76cced185e3f", "comment": "Malware payload", "value": "5f026d310f78300e60ef0c73fd305668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779947, "uuid": "57e0222f-d0aa-4600-b2fb-1004cddce2e9", "comment": "Malware payload", "value": "6f89e9470284b6b293dd362c7a868f40643eeea5e313fe8ff3103ce7ba3afea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779947, "uuid": "a521ed0b-ccf3-4775-adaa-ebd9fa07530e", "comment": "Malware payload", "value": "7e1d31c6b7fb206b3d6b9c92572e4b10a2935a75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779947, "uuid": "de4ddd69-9bb8-4c20-abcf-e2b6be6e97e6", "comment": "Malware payload", "value": "a5eeb12067fd042a508efbcdaa472796414903ba5c141b298584cd7ab3590aba3f95f34d78cf24f112acce887db67654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779947, "uuid": "1661d1ed-16fe-41a9-a017-dafe5ceebef9", "value": "T15F921A1F97950872F78A41322A3D6BBDDA3B465823B4BE835798ED6419371C1D02E30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779947, "uuid": "213c8030-a3bc-4549-bf87-e2bf498ce046", "value": "05e816a0da76886146683a47a920a3ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779947, "uuid": "81f1ebba-86d7-4e1f-84d3-4484b3a0fe4b", "value": "192:7CLDVb9R7c6JbpSkHFDGu6vCwBI5CBF0ZpcRoC9Lf69ZpcRoA6RomoQ6DnP1oycm:7W59R/JN/qHycRoncRoA6Rf41+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779947, "uuid": "c7389fba-1f73-41dc-a61f-ef106a39ba60", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779947, "uuid": "bc7f7b8d-dc22-437d-aba6-7926fedade58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779947, "uuid": "c96f6494-15c5-44ec-b6fd-a1f7011bccf4", "value": "SecuriteInfo.com.Trojan.Siggen6.36914.19258.24048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e920170b-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767866, "uuid": "36069f83-4d11-4232-950a-9ccea689a0ee", "comment": "Malware payload", "value": "5f4e84bd9fbb35b556b1469cd6ec4fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767866, "uuid": "7b93f703-ec16-46d9-b5b1-557b322be976", "comment": "Malware payload", "value": "70060d2f81493d076b3865dd1401aec13a95e6ed6c69c97e2346113225f4c21a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767866, "uuid": "0dd75c79-2424-4f0c-a389-fce8adb96ad8", "comment": "Malware payload", "value": "7a1340668725a4305269e7fe571966ee6c995c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767866, "uuid": "7139e3d9-4914-4b39-8672-2f765049b893", "comment": "Malware payload", "value": "ea2c005adb197447b17d905131508fc07c918b1ac631dc0013ca3e1b02ccdb532f81f3b7834cd215c604350810b7ed83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767866, "uuid": "74417476-04c6-4959-93c0-24840535e2a6", "value": "T13A15021468F1939ED6A639F756C2C72429148F47E9EE48A93B71708712B01F3DE21F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767866, "uuid": "ae0d17ef-6f3d-4fda-a97f-d8b66616ebab", "value": "24576:5k+bGuR1jYcOoJFKS2lW6oeanOsw7d3BQ7JPGGw0k:5JFGo3KLyeCM7+GGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767866, "uuid": "259098b3-07d5-49f4-bb44-b5e3725c7b47", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767866, "uuid": "fa37c7ab-fa0b-4a10-b107-50afc25a0a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767866, "uuid": "3b1c1b9f-2709-4e38-89cb-752e1579def2", "value": "REF_RFQ#H4_Y230325003_Nitto_Kohki_Materials_products \u202es\u180ex\u180el\u180ex\u180e..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccbf254-e55b-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1710788998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710788998, "uuid": "905f1239-6e80-49d5-9bb5-aa80981a6413", "comment": "Malware payload (Socks5Systemz)", "value": "1031d64d67918731f76202151190cd4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710788998, "uuid": "a59516dc-2481-4d5e-8897-6a692946767c", "comment": "Malware payload (Socks5Systemz)", "value": "707ed68698d9f19a9373d0f510864df6a96fb8768a9b434a332f1fb809a0a6df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710788998, "uuid": "05ff2a57-99f7-4644-8b8d-6a101bbc026c", "comment": "Malware payload (Socks5Systemz)", "value": "c0d0d60403a16b33b2a42f3cab0258aa8c589668", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710788998, "uuid": "50995617-e224-4dab-ab15-a2672063bac8", "comment": "Malware payload (Socks5Systemz)", "value": "bc3d22297a4646b84c3f1b64cb22553a8dd652e82a731043db1f4b2fffd93f1cc7ae30a3cfce92b2ca08e883231b1448", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710788998, "uuid": "bb14c4c6-4dc4-4342-8465-75406bcf49ca", "value": "T14595330527DB883AD068EC3D0A47818C9B32760218BD8999B29E1D6D1F3F1DAF51667F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710788998, "uuid": "98773d9d-514c-4767-a25f-0e79fedd42cd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710788998, "uuid": "fde02d94-3e57-4423-b37d-287096e56db1", "value": "49152:32LtaGtVIn5KHFRuE+RYUnk1TU8NKccxWJ6BjfnPuBAP8ZC:mLLtVIMHifYv1TZNKcSqCf3P8ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710788998, "uuid": "86f9f8ae-8aa2-4a7a-97d0-ebc37d51603e", "value": 2010163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710788998, "uuid": "96cd12a1-a0fc-4d50-81dc-7b7837d44044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710788998, "uuid": "999067c0-dfa6-4009-ab88-8675fbed769a", "value": "1031d64d67918731f76202151190cd4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9395d5-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710757694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757694, "uuid": "ce070548-7b1c-4473-9434-b99ef6089221", "comment": "Malware payload (Formbook)", "value": "2feedd1ada10c22c1cfcd3f1e1f37b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757694, "uuid": "7c89c160-6847-4937-84f7-2ce156e96ed6", "comment": "Malware payload (Formbook)", "value": "70f27cc87397701a73835625b0ee8caf3ef97b506554f2a7f65c2c08afd264f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757694, "uuid": "70a9440f-976d-4ee3-98e1-bf171b02db30", "comment": "Malware payload (Formbook)", "value": "cf5eb8bc56b021cd08a23114d4234da33a7b3723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757694, "uuid": "40cbf3bd-a5b3-4b91-8218-36992591015a", "comment": "Malware payload (Formbook)", "value": "8612ea9ae476177a2aad6a138f992c6c49762e4509a647043ccfa8b376d8c3a58a4de8347e6592ae64653f7bf651ded0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757694, "uuid": "000f645a-6519-4e7d-aa1b-499274c0cc04", "value": "T110F401987610B2AFC857CD36CAA91C64FA207677530BD243B06716EDAE0DA97DF140E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757694, "uuid": "a9e76f06-d6d5-4f35-9a9b-cf61ec4ce03b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757694, "uuid": "6766126c-9240-4713-a0ab-95c1ea0e7b75", "value": "12288:C3VOvooCwgqx4In/MW39kmlloOhW6uZSn8sycf2fZYTsG8/5ycfRgRh9m9mzmAky:6OvxzgqxtEW3WMl5W6OC8sy42ZYsG6Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757694, "uuid": "fa29b433-7a00-4115-b4a5-353e32e6f248", "value": 724488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757694, "uuid": "0015c5c0-32e6-41a2-829b-acbade43dac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757694, "uuid": "14e483be-96d2-42ea-881c-ed556efb767a", "value": "SecuriteInfo.com.Variant.Lazy.487114.22589.2790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1310cf-e4dc-11ee-a120-42010a9c002e", "comment": "Malware payload (PythonStealer)", "timestamp": 1710734452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710734452, "uuid": "61f258ed-ee5f-4530-8cc8-9879102895cf", "comment": "Malware payload (PythonStealer)", "value": "f42baf224056715224666a1e9689e63b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710734452, "uuid": "010ec5ab-0dcb-4fb1-9936-8e61d80a776e", "comment": "Malware payload (PythonStealer)", "value": "70f56988e66c41598b992831c2fac72ebcd00f339959013bccc5e4a667a54f5e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710734452, "uuid": "fc9a2b7e-6df9-4ae4-89eb-1ef3f63020f3", "comment": "Malware payload (PythonStealer)", "value": "b557257a7b60d52ba9775665b9355962ad0f7983", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710734452, "uuid": "7e54770f-4704-4470-a904-79e69e221148", "comment": "Malware payload (PythonStealer)", "value": "04ad14d92f789f29ea561c6bb8b251c8993812314b889b05727e24158a82abbd3493341756bce989b4c66cb31c274598", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710734452, "uuid": "a8bc891d-e799-448f-b509-93910700c2b3", "value": "T1BAB6336AD62386E4C783E0B489D815E67A367D7E0140D17F8670FAF05E8BFD91388B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710734452, "uuid": "f3fd19d0-95bd-4492-aec1-e3bbea3f6295", "value": "e44f44f1060dd800fd861c4e5ad59e21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710734452, "uuid": "5e15b48f-9e4b-46e1-9b4a-a34d03dfb693", "value": "196608:cVAlP3Zobseq6ERnzem2k7nrEZkDC3qZqIJ/IFftp6WnXPCE7BWPRNi:uCpoSvRnzem2orEZEpqVtpGE7Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710734452, "uuid": "9b96d8c2-01e0-4ba7-9872-831925a62144", "value": 11266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710734452, "uuid": "d488aef5-165c-421c-bf59-f376a5c27b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710734452, "uuid": "ecf1323f-0131-4f0a-9a0e-7f1d8cf87967", "value": "f42baf224056715224666a1e9689e63b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59562de-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751968, "uuid": "2cb0e4fc-f8c5-4d15-a465-717ac4c77528", "comment": "Malware payload (Mirai)", "value": "7b6019731ad7119c12c7f92d6287be36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751968, "uuid": "6a6b63a1-9c04-4b5a-8e5d-01a174a2a157", "comment": "Malware payload (Mirai)", "value": "7187d0bd454e4f5bec3a49e4db1b5c59f9a445ba3944fb89f236db371a8e1dd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751968, "uuid": "a224b037-7681-4369-b0df-2b38672dedb0", "comment": "Malware payload (Mirai)", "value": "10adb18398169577bc50eeed8786910d8f0c7745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751968, "uuid": "c833a60b-6b75-40ae-831d-484125330c82", "comment": "Malware payload (Mirai)", "value": "c21af3c059a3d4e5e64aec9fd11776b2a2ed6931e9613d23eec03d3bc20898bdeda0fe9ca1ad50a75ff39a3d35e7d7c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751968, "uuid": "6045cf55-fe9c-4acd-8150-3fc0034c08cd", "value": "T1BA53D616FF904FEBE85BCD3305AC8701399D685612B87B357A30C969F25E68F12E3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751968, "uuid": "2b2f0291-34fe-4634-8d15-6b57a5d2396c", "value": "1536:ozcXv+9ccTWDlLATjgp3LaODXwZYwVg04BQYs:owXv+9c1bDAEWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751968, "uuid": "fe318f77-f508-4e37-adf2-02f84d6fa983", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751968, "uuid": "85625793-6c35-485b-b9a0-700ac4fb55a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751968, "uuid": "ad97d8d2-f043-409e-a568-8ada5a4279f6", "value": "7b6019731ad7119c12c7f92d6287be36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34f95e4-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751991, "uuid": "70cd1549-fa8c-49bc-9086-0543c83831a9", "comment": "Malware payload (Mirai)", "value": "44dac03da37e37c94565eb0f96b2d8aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751991, "uuid": "0196a608-3129-4365-ad27-656234dc3bc1", "comment": "Malware payload (Mirai)", "value": "73235c4d28f6bc0c5b0e9c60f76cbd5bf725827aea4b694d8b589d2b7c366712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751991, "uuid": "c2595ebe-8f21-416b-9cad-ef771db67c31", "comment": "Malware payload (Mirai)", "value": "b4471537f005ddeb1bf5e57a390bc44d850d2a2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751991, "uuid": "9a607905-9b88-4066-a2da-3d3c02c2b3f3", "comment": "Malware payload (Mirai)", "value": "2d4cda6901ddea8e60645bb4e473df488f91ea6494aeee49f11411a4c61a8ba0b17d3f338e7bc6279c9bcd3ba176dedf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751991, "uuid": "6935bdfb-4965-41ee-921e-8b9c043aa89b", "value": "T1B4238EB7C8796DD0D1588274A9258EBC1723A406C6E33EFA5E45C66A4007EBCF62D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751991, "uuid": "b8e60e3b-ae09-461b-9218-2b89301f8e14", "value": "768:5a7wtk6ov4SeqUyIP66ivGK1ureCynnkLCVot2vXCCqA:5a7wtkxbxgjiBu+kLhtgCCqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751991, "uuid": "8c023597-05e1-47d7-9a65-0b35c23fdaf7", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751991, "uuid": "a3fd5b57-deda-432a-95f2-970055594d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751991, "uuid": "4732a57e-eb96-402c-b0ba-74cd39cc21df", "value": "44dac03da37e37c94565eb0f96b2d8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1110cc1d-e533-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710771798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771798, "uuid": "85c57600-c787-4862-9f77-dcae37244fd5", "comment": "Malware payload", "value": "f62a2d1490e32ee4ad577ebdd45cd1c4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771798, "uuid": "336646b0-519a-44c4-a339-cdb38544b8d8", "comment": "Malware payload", "value": "73d41e6765a44bba2ad12ea9bfa052ffd5366e73c9355675439c2aa240a33efb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771798, "uuid": "3e75d49a-c842-4272-a982-f7e93ae8ea4b", "comment": "Malware payload", "value": "9df72109bfd7e46363d43ecd57532d4b938d2afa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771798, "uuid": "e5983a05-8a14-4180-862f-e9c1a6537dec", "comment": "Malware payload", "value": "4a8183e7e230114af1402b61f7f0ef376ff1d1ea478050abe4ba8dc0b2c84e6f403f64dcd30f5c7e9d26595163f97335", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771798, "uuid": "17ec66f2-2ec1-463d-8a77-5503f37515ba", "value": "T1BEF307E3CAC926188A461AB3DE134B338DB4415D77171E349BBCD68D604385CA6BFBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771798, "uuid": "05e345ca-b4e7-451e-9c8a-b7b7eec6949f", "value": "3072:sA4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRtt2OY37bZtwbS0L3gFgCiah4eP:sA4yENVOY0NpVXpK68kH3DPbkhZi3eN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771798, "uuid": "e3923752-54ae-4f7c-be6b-98756e666db2", "value": 170618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771798, "uuid": "3c40997a-7c1a-47c0-83d7-4f6d322e707f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771798, "uuid": "e5400757-3239-40a0-9a48-97fd8a1b2c91", "value": "ART\u00cdCULOS IPAR-YATCHS EN LA LISTA DE ORDEN DE COMPRA ADJUNTA..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02805d69-e504-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710751587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751587, "uuid": "5183fbed-3a50-42e4-b598-3563a78b2777", "comment": "Malware payload", "value": "2224a29dc556164f3885eab38cc9e196", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751587, "uuid": "08d5bab8-088c-49b8-9f6f-a891a5281026", "comment": "Malware payload", "value": "752285d51d3a144420988ac017aa2898a970e27de597b616fb11097e0e11aaac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751587, "uuid": "4d6b9e7d-3353-456c-aa51-c09ec256a48e", "comment": "Malware payload", "value": "cf74e1d7f8057f53d6523e2436d08c078d1bdfd9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751587, "uuid": "fd07c27b-e922-4c1d-aa7d-189e3aa7bfc1", "comment": "Malware payload", "value": "84028e80c92b564bf418a10046b4b33202ac2f74ae75701bd5fd40dbcb72b22444abe30977bbac0492b60709bee5dca5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751587, "uuid": "7aac957a-cbe9-4e3e-981f-6a8dc6ce6306", "value": "T18AC5629B2FAD17861304739B97AFED151A17CCEC07C66F8892C39CC9441ABA72950E4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751587, "uuid": "acb8c4f7-1e10-4965-98ad-6d168661dc1f", "value": "24576:Iej4//ttlV4+HAIgigtO4/X8wft73Q382mSZDcot/:IY8zlTA1P8wdExZHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751587, "uuid": "2fe7ea91-1d72-44d6-8c49-bcb5b110a2c7", "value": 2569083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751587, "uuid": "0e25c563-2d87-4685-bd19-33c4f61530fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751587, "uuid": "033fbbfe-ed80-4e7c-a7b9-cd65e94fa09a", "value": "PO240405-050 \u0096 02.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3cfaf3-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771711, "uuid": "72c92574-739f-4405-bf93-186070e6b305", "comment": "Malware payload (Gafgyt)", "value": "e0927f703d45b9a87e6f34cedb475c26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771711, "uuid": "5f62ca9a-4963-4460-a13e-47400c64b72b", "comment": "Malware payload (Gafgyt)", "value": "75bb77db0d49a75868adc9ac8c1b0b2d94f2c7a43d8072b3096daf12bd7e78f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771711, "uuid": "43bfb951-90c9-43e4-b8d1-0833b14d3a3e", "comment": "Malware payload (Gafgyt)", "value": "6292971625fd6c1477017a3dbf4164a3aa4a3787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771711, "uuid": "dc1b934d-b0bb-47c4-a7b5-b2d99f7a3e5e", "comment": "Malware payload (Gafgyt)", "value": "e6e879629a4b6aa3a61de313d59f5087128dd95e5978e5eb8b5ad3961b3946ce77f03ccbcb37c8384a601f997e1b00f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771711, "uuid": "fb9987e8-1a51-4ec6-bfc9-d517480d349a", "value": "T122935BC2B741CAB3D04306B512AB9F210432F9BB1B5AAE16F36C7CF49E150C57626F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771711, "uuid": "0c96c153-ca1f-43e7-b1be-6cdc6887c1a5", "value": "1536:71SH+Ux0zn964ja1MU6Upmqa17lMMCNNm3clF7tdjmzqtslBKmJIWVOCjXZRs9S:xSeUI964ja1MU6UYR7lVCXGclxkqtwMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771711, "uuid": "ca158334-9494-43c8-a4a2-0e0aa9f5a2c6", "value": 89233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771711, "uuid": "94169968-c186-4230-8984-7a0255e14c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771711, "uuid": "2f6ec15d-769b-437b-9f46-393b26036d1f", "value": "e0927f703d45b9a87e6f34cedb475c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f5ed28-e502-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710750949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750949, "uuid": "5e6e6398-458f-4b63-9fa3-776a199737dc", "comment": "Malware payload (AgentTesla)", "value": "f72eebad7ff1ed756c5894cd7ad4fb75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750949, "uuid": "a299a2f2-e399-42cc-a0cd-e821739ecb10", "comment": "Malware payload (AgentTesla)", "value": "76721c2e11a0bf27067c5858ab464de53c3b7f0c30dd36d9099b5dd9f6d9848e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750949, "uuid": "541969d3-c9db-4657-a55c-ee070505fa57", "comment": "Malware payload (AgentTesla)", "value": "8272a53458bb6be7c7f2c7d6dfa8187dfb1485e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750949, "uuid": "c88ce365-fa37-4836-a9ac-deee56385ee8", "comment": "Malware payload (AgentTesla)", "value": "d2bddca8e483dd151199fd51f55024ce3fe977d9c0c7e15bd7616f00f2316243cb6eaecde2b2912123c0c9fb91e753f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750949, "uuid": "da8f14c9-82db-4dd7-852b-2f6c0bb2be03", "value": "T15D25D06C2B985B56D17E877490662046F3B094C3E4369F5D19C7A3E92B3328279C0FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750949, "uuid": "94df66e7-f388-4941-807e-c68489732519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750949, "uuid": "d02059d2-d3f3-474f-a418-3e90fa2b02ff", "value": "12288:OePgYYVGhz0EG4oZ3GJcU7yTtbGfTikcYqrxqYaKju1Tj5uWebcbPtAAnSLHCpTM:JgaE4h37+iikcYqtgT+cL9qHgTtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710750949, "uuid": "2f813c7f-aa3c-4e39-8e8f-241299ca42f9", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710750949, "uuid": "be1f45df-4cae-4a3b-8e7d-a88e7d2c15f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750949, "uuid": "256d005a-f1c9-4d32-8d81-769e6b662b97", "value": "MAP - 0013_1664926093267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f9bace-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710783215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783215, "uuid": "bcf7ff14-2841-4183-b959-bc88f9f2641e", "comment": "Malware payload (RedLineStealer)", "value": "6d8c71b3cda20b4e8f1980672de98ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783215, "uuid": "f44d1ac7-63d7-4d7a-8e3f-6592acbec34f", "comment": "Malware payload (RedLineStealer)", "value": "770d7762357d81bb193d2be8596f7a777c7e743f751dbecafc04400837ff65ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783215, "uuid": "7d9aedad-f678-4aa4-8149-449eb7b72b06", "comment": "Malware payload (RedLineStealer)", "value": "e968d8914f7aa942b79b343fd6c6b666fa32121d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783215, "uuid": "5076ecdc-aa6f-4470-a940-74cf9fc077e9", "comment": "Malware payload (RedLineStealer)", "value": "f7bd11603a4c2349aa5171913412011c0905e404f5942ab3dd006c74b07cbc239b93a98348c48f87b7ac38d04bd318d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783215, "uuid": "24c8d3e4-4e8e-4dae-987c-3a3339667343", "value": "T1EEC48E81B709BDA2D67B06F9948518200F71ED79E906D31AADDB7FBF3E32351420252B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783215, "uuid": "c0420497-4e00-4b8e-a2fb-5f0f2ff3a676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783215, "uuid": "386aa1c6-32bf-4abf-9c20-119d351e2439", "value": "6144:3a9dbaaHZG+ZQlQdtNpqF7DscN3p0NIb88WsNMPaKFP3b2V122J0sL:3SaaHZG4rEF7QcN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783215, "uuid": "73c7445c-efae-40c4-b183-4f60be860c85", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783215, "uuid": "63652887-ef0c-471c-baa0-52aa18c17ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783215, "uuid": "7afe13df-c0a5-4372-b2ee-ed461a4624f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8173c090-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760390, "uuid": "0baea101-da76-4810-a4f2-977d76cdce75", "comment": "Malware payload (Mirai)", "value": "ced852114bf59ac1196d9606f3255f6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760390, "uuid": "fd734cf7-af86-4c3d-9db8-5ece0d0b19a1", "comment": "Malware payload (Mirai)", "value": "7716f6c2c72d10b159a0b4d9737cacb727a76be592a79cc131906c553c6bf99b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760390, "uuid": "36bbea2d-3794-46ad-aba8-71f53bfd8e58", "comment": "Malware payload (Mirai)", "value": "d4995377bc9cb8fa80212ffc1cc4b437cc6af579", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760390, "uuid": "da037c6c-7a61-44f6-91e6-979761c694f7", "comment": "Malware payload (Mirai)", "value": "04c2427f8c5e9e292b000137f8429a215fbcc69dea6d7c2ed8dcc210cd96d88f934c358d39ba418088f38d0a93803910", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760390, "uuid": "78362c89-26c8-44e6-9be4-6090ec41eeb4", "value": "T17241CE8A1F714EF8F559D93847374B3527AB924846D04249E2ACD6406EC430D499EBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760390, "uuid": "e306252e-c429-4bf9-bd56-914573a91b59", "value": "24:3u4dsgph8AmsiRD8AmyT/z2HdllSnqtWB4u37I8pa8+Ddz3N9l5zBkEp7ilAGnEe:exgpEuQ2H7w1ErD/9LuEp8nn2ZLBqxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760390, "uuid": "265ed146-9d59-422c-88bb-479fb5e371f8", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760390, "uuid": "a7209724-8e4d-4d5d-83fa-b5f425fcd05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760390, "uuid": "5df06171-15be-4159-b00a-1829c161b809", "value": "ced852114bf59ac1196d9606f3255f6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bcfcf9-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741684, "uuid": "a8bfe3a1-26b2-4978-bc24-c67bd843606b", "comment": "Malware payload (Gafgyt)", "value": "7320cf34b63ab413acb03a9bc261d480", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741684, "uuid": "3d6361fe-45b8-42ab-9793-e5a51d1a1344", "comment": "Malware payload (Gafgyt)", "value": "7954e5aa80d084013ce59f3d84b45e3bbab3e25a219838de9ae5c1253fe6e694", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741684, "uuid": "c8f481da-0dfd-4ab7-9fbb-4f984bcab84a", "comment": "Malware payload (Gafgyt)", "value": "19d85dd21e39808e34215ff94f25f59aaf56aeec", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741684, "uuid": "3e013cca-6875-4218-8979-320ce2b9a8e2", "comment": "Malware payload (Gafgyt)", "value": "821aa71877cb91e5429d5f3938df7d5ec313cc30e283079f95980829e003909645188ceef8292af0e0a7b2f64e8a5c81", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741684, "uuid": "44176c85-77e8-491f-9679-85ecc8564230", "value": "T171934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741684, "uuid": "cd7a2cbb-77f3-41b7-8511-3c8596ef2919", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyD5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjH5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741684, "uuid": "47aabb80-089e-4967-a5e1-72542b1477e6", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741684, "uuid": "be9cd839-ef7e-42da-b023-21c7f9d9b5a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741684, "uuid": "8e3a1391-9eb5-4009-9fc5-7225216a0c3e", "value": "fuckjewishpeople.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f03637-e52a-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710768313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768313, "uuid": "8a4dd860-1c0a-45cd-8156-09757ad60fff", "comment": "Malware payload (RiseProStealer)", "value": "0bc42c7443957056988e03e993dbe703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768313, "uuid": "efb40c04-06a4-48c2-a011-505a6eb6288e", "comment": "Malware payload (RiseProStealer)", "value": "7a54e5c76068d0b91153629eaaf1a63d5111b51fccf49194ec9bb7012ee8c730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768313, "uuid": "b3fe62ae-8e02-40ca-90be-fd51e8650a58", "comment": "Malware payload (RiseProStealer)", "value": "09ed09b4ec85e43ff4c8885ad45fe5407aa57248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768313, "uuid": "9a5819dd-39a9-460d-a870-82dd9dd99562", "comment": "Malware payload (RiseProStealer)", "value": "c6ebd08d87dae60babc2d4f17477b9e6746d285990a4dd72182976df0fa045ed3c5e193c61d5ea92817ec8d292c33314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768313, "uuid": "4831b92a-6202-4ad6-989f-5284b49e39f6", "value": "T1C3E54AD3A40975CFD49A63F89537CE82595D42F8873049E3A82DB4BABD63CC125FAC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768313, "uuid": "88cd6eb0-c471-43b1-b559-4bf79f090dc2", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768313, "uuid": "ea73624d-b087-4c02-bd97-0504024b81a1", "value": "49152:kS5qyY1RxU9tbV7xno2ZhimjWqw9iG2+H19ed2AiirCrj1:kShAitbV7xno2hjWqw9BrV9edU2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710768313, "uuid": "d76fd027-c42c-4fe8-987c-c36f70afe67b", "value": 3109888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710768313, "uuid": "e3291138-cf42-49d9-8e2b-19c57eec71ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768313, "uuid": "fb9c0618-1f03-44ed-a449-6c09fb6c4725", "value": "7a54e5c76068d0b91153629eaaf1a63d5111b51fccf49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b25ffd-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765949, "uuid": "ce6f7fb9-3a51-4a5e-ad98-e42aacf0fce9", "comment": "Malware payload (Mirai)", "value": "9e859bee3de63123dd8ef4b7c67ec90c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765949, "uuid": "2f9b6d52-f356-4025-b9b0-d718268c7af2", "comment": "Malware payload (Mirai)", "value": "7abaed965a7851744ad1482ff18b55ff2aeff5a4686695985f59edc379bbd1cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765949, "uuid": "0972f214-a59a-4235-88d7-fe71f017b55e", "comment": "Malware payload (Mirai)", "value": "3ede67d23d61d0aeecf8157e7ce3fec062d82e62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765949, "uuid": "262245bd-fedb-441a-9e15-df266eaba06f", "comment": "Malware payload (Mirai)", "value": "6028e448255a5fbca3edc8bbdc88dca1eef78fa0a038332e0ac3ed6a72eaf69303dccbe5a6c0fe6738e950cbc172ee07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765949, "uuid": "a0efe8ca-2a49-4ed7-a486-c63664eb69a5", "value": "T14C130941B32C0543D5625EF0393F17E0D3ABAD9231E8B248791F9B8AC5B5E33A542E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765949, "uuid": "190f7597-0f4e-441f-a152-454a76244d9f", "value": "768:oiUmy9adKbDeHIfx05El9GKkau83ujTtX+KvSHkEX5juxMKsUJIu:JiDdfxjl9GAUTlffI5jgM7fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765949, "uuid": "a4841583-166b-4e34-9d9a-ad0f1b9bd220", "value": 44812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765949, "uuid": "ecb0dc19-5060-44c4-aacf-390301a7796c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765949, "uuid": "f779c6c9-767b-45dd-82ec-0d0e219fd087", "value": "9e859bee3de63123dd8ef4b7c67ec90c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4a4846-e4f2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710744276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744276, "uuid": "8f12160f-5e7e-46d0-a086-29ffe96a76e9", "comment": "Malware payload", "value": "9398ede765072a5e7e144a59b983fc02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744276, "uuid": "a9fef135-79cf-416c-8d70-4e5f4529eb57", "comment": "Malware payload", "value": "7b987c3e111e273ea8da7e33652c2c2463d5d3b05fe38d4f601b695996bb11f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744276, "uuid": "8773545a-ba0a-418b-843b-f4a4e8b4cb7f", "comment": "Malware payload", "value": "4a5d0213c5e1ef231415c7ca7877500232232230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744276, "uuid": "bebf6e51-c4c6-48cb-a852-9985c290dad9", "comment": "Malware payload", "value": "135c6c9668c4a90467084e71d7934c0af243470724ffd271a8602abf38f1662e4cd1fe991e63f012b539c93c075d42a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744276, "uuid": "9dd4fd40-0057-4766-9cb2-75be71035c8c", "value": "T130E733E9BFEC7A39C009867677808C7D0F9166399913F4F2D6A6500E34124D6FA0AE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744276, "uuid": "d250cbea-e076-4fb9-8ba9-97132f8c0dd6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744276, "uuid": "300e5878-19ca-4547-8ca4-9568afb37ca2", "value": "1572864:erziNjX21a8cKauEXEnREpwWGD5Pb2PKDLrWE36D57:hb21Iu+W/kvEKl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710744276, "uuid": "1508c15a-b134-4eb5-bfc6-2e401628b4a0", "value": 65746439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710744276, "uuid": "c417bcda-549f-4b5f-9cc6-1884b78da626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744276, "uuid": "f8b23ed4-ea9f-4290-a957-e77cd2d5a1b6", "value": "Tank-RevolutionDEMO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c488b92b-e54e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783696, "uuid": "5cdb07e3-e099-4487-956b-ae70a9c7fc56", "comment": "Malware payload", "value": "38e15195e6528044d7611908ff2502ef", "object_relation": "md5", "Tag": [ { "name": "egr", "colour": "#47D467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783696, "uuid": "6d3f5f27-d803-4938-a99e-f4e251828d7c", "comment": "Malware payload", "value": "7b9e7f0f8a55074ded301cebb06560eb1d143dbe9884b81bee140621b6567020", "object_relation": "sha256", "Tag": [ { "name": "egr", "colour": "#47D467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783696, "uuid": "0eb215a9-bbe5-4891-a77e-ef7b329f1483", "comment": "Malware payload", "value": "0445659db7a10f6a88d0ac2e05cbb91d6870e10a", "object_relation": "sha1", "Tag": [ { "name": "egr", "colour": "#47D467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783696, "uuid": "fd8f196d-33e9-4ea6-8338-b5cf69fa0dfb", "comment": "Malware payload", "value": "11d1bad80426a3b88be2356da05d59b53fee3f28e18516dce7314c3dad2163bace567011b11340b1a5a9083aec2bc2c0", "object_relation": "sha3-384", "Tag": [ { "name": "egr", "colour": "#47D467", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783696, "uuid": "196cd0e8-0df3-4de9-a8a1-c079a15134d9", "value": "T1D3768C47F88565A8C5E9D230CA358252BA317C890B3037D33B61F7B92A73BD4AB79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783696, "uuid": "7a20cb80-d45d-4a12-8e47-ccd952fd506a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783696, "uuid": "29023a0d-fcf3-4e1f-b515-ada566d6489c", "value": "98304:63nV4+wDuEi0OEI54bLegok9F+jPl0xLJ2XFT34qNXeoPZ6:6XCiEi4bLxoeelQ2tNXeoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783696, "uuid": "89288af0-548a-4909-b976-72d9ed85fe0a", "value": 7143424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783696, "uuid": "231fc228-d23a-49ba-aaf6-2782f0d10b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783696, "uuid": "1d84253c-8ad7-47d4-94e2-360787d4da64", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d134a5c2-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751934, "uuid": "cad3abac-430e-4eef-ad68-4bcae14d0484", "comment": "Malware payload (Mirai)", "value": "5a8b44ff8ad7d4e5ef9d332527437b15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751934, "uuid": "cddce10f-6093-43e9-a386-b5e012c62d19", "comment": "Malware payload (Mirai)", "value": "7bf6cd432413882220df881d1d60fa8a1f0f0f3d8c5bf55225cb86bc81d3dc91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751934, "uuid": "3cd3b4c9-32c9-48d9-a200-695048e3639f", "comment": "Malware payload (Mirai)", "value": "d27eb0f984ead02fb396493b11834d26788faba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751934, "uuid": "9f17e6c3-c7b2-4bd8-88a6-e8a5aaff5128", "comment": "Malware payload (Mirai)", "value": "edf0b6e034e0955dabfeff33a823531616186e1f5c8ea7f1fa9cd61d522ff2fd1b80c488a72126ea921da22042f938e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751934, "uuid": "9e8bc278-3517-42d4-83dc-e028464a07d1", "value": "T1A273980A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751934, "uuid": "a37ce13d-76cb-48ba-a224-476b6af792ce", "value": "1536:HogWL2T87i8qXc3SEyNhXLKgLhaV4+6uHO/YQBSmP9AAod42+Is:HoB2T2qX4+hXLKgLwV4+6B/YQBSmP9/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751934, "uuid": "7dbf15e2-de63-4448-8bf8-3da3732883eb", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751934, "uuid": "a58bd333-29ab-47b3-9402-1d5c9182d90c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751934, "uuid": "b4abb90b-5156-481d-941f-19eccbc66e9b", "value": "5a8b44ff8ad7d4e5ef9d332527437b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da0411f-e506-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710752707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752707, "uuid": "bd1d1a74-27a0-41ce-b92c-e132de65519d", "comment": "Malware payload", "value": "d083a0a6f4fcd729badb0057c1c15ae3", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752707, "uuid": "408ea956-90a8-49c1-8df0-d4ffe3a8cb19", "comment": "Malware payload", "value": "7ca4d9de64cf17713cb9142f86124b10546874df123fe66fb10735bf4746c64e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752707, "uuid": "0b44f37b-3cdd-48c1-ace6-85f9e37a07d3", "comment": "Malware payload", "value": "1492f9bfbe07baa5906814ccf4f1b6dfb1fa0339", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752707, "uuid": "7ed97829-468f-4762-9445-87fe8920d4e2", "comment": "Malware payload", "value": "4e41f4549fd4b1d717ae23b719df24e7ddb269c039ea0e8990eea95e6c8474867bf953678f5f86d3733d5b3342f44f08", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752707, "uuid": "85ee1634-6af2-4a04-8edc-a9462ff261f6", "value": "T1E323F139E3292940C8F4987C426D1793B986059C8743F97B6AC9790D5186EFB33AFD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752707, "uuid": "2cbfa07a-7395-47dd-a782-02001c00d416", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/3:tLq94YV7JMxXyd4x+gzexTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752707, "uuid": "4e4ff66d-e627-4e72-9fb2-10dff2804a36", "value": 49373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752707, "uuid": "0bd06a2e-8f9b-4881-ba98-b37304fd5dfb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752707, "uuid": "2d4684cc-a078-45dd-ac2c-a4e2678c23b7", "value": "ACH-7830-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0aa19c-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749350, "uuid": "b5a1bd19-c957-40f1-9f4a-6f4e1dea888e", "comment": "Malware payload (Mirai)", "value": "018c321588bb38d7835eb6a0ae3c7043", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749350, "uuid": "f3ee6c29-9963-43dd-9f78-753e663fcaa1", "comment": "Malware payload (Mirai)", "value": "7d04d07eee65a4bdd80ae452cc001da6a90607e3d611f7bcea5119e0e75f6611", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749350, "uuid": "319479c6-aae4-4eb0-a37c-821c4d79fad2", "comment": "Malware payload (Mirai)", "value": "ce85bfe1d62af09b8a0a9658f8ab28e99829178a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749350, "uuid": "2ed1189c-a431-45c5-b1fa-2eed097d6bfe", "comment": "Malware payload (Mirai)", "value": "5102f2b6fd3e33ce5d9cc7f6daafcda328ba49ce4168362184bb8de0751a37ee020d529fb6fef9f33fc1121b8a7124dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749350, "uuid": "6febea29-65c0-4075-8819-6364a0e62845", "value": "T1CE138D77C42AAF98C2454774F971CA740B53E009D1A36EFB1B5682668447EECFA093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749350, "uuid": "5fc5e743-1838-4a09-97c5-8817d6fed589", "value": "768:JaTywt9X0t45ezozioZGcdbTZR3ifefYRf79okH9oRUICaTwR:Jauwt9Dyozi3cdYld7yk2RhCacR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749350, "uuid": "9b38de33-d031-4016-8883-fb450cc80b6a", "value": 44336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749350, "uuid": "781eb63e-f0ef-4b26-bb53-8b2f6a7a019b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749350, "uuid": "5d7003ea-823d-4633-bd4c-59d5d4a68fe0", "value": "018c321588bb38d7835eb6a0ae3c7043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260daffd-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710783000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783000, "uuid": "38332ce0-41f4-482a-80bc-464c75e46652", "comment": "Malware payload (Gafgyt)", "value": "570254333c7e46a26bf177e360d72041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783000, "uuid": "07ec32a4-34b4-41fc-97e0-b836fb105a04", "comment": "Malware payload (Gafgyt)", "value": "7d075bc31a088e0ac5b87d84204aadfb1524e4fa1b432ffe796d5593b2d5c23b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783000, "uuid": "0f116ce4-2b03-4a23-84b2-7a13a447b39a", "comment": "Malware payload (Gafgyt)", "value": "42ee333ad9fb11854e8f76470dc786141cc2cb3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783000, "uuid": "492e0bdd-7623-4918-b5d7-b7509d851dcc", "comment": "Malware payload (Gafgyt)", "value": "ac57e20d390cf6a14b387aa541f315bce8bcd55bc69767205a3c1a67835d2501462e1a240d3e51a33f7c50af32f27554", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783000, "uuid": "d56856f4-7892-4723-9fff-b311af8bf0a4", "value": "T1D5B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783000, "uuid": "65f94c85-aba4-4ff4-85d0-d1c3aad41e91", "value": "3072:b6an17WtsWhdgYJZ0D6mbPbmTQOWsXAOn:Wan17WPJZ0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783000, "uuid": "01265049-b713-4e8b-a395-81236ed5245a", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783000, "uuid": "04d09810-e013-49e7-bcdd-f17c835b03b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783000, "uuid": "97046d31-72ca-48b4-95ee-c82efcc6d63c", "value": "570254333c7e46a26bf177e360d72041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2a6a9a-e519-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760789, "uuid": "46f99bc4-0261-4454-ad43-84f966be2e6b", "comment": "Malware payload (Mirai)", "value": "38a3c912e8650c959a99f9130faf8a59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760789, "uuid": "82b2f6ae-a0e4-40cf-acc1-c5c0642f4fb9", "comment": "Malware payload (Mirai)", "value": "7d2b2c7daace6301e2928596bc68be18c0073c7de6dbde3f640a22f93c144563", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760789, "uuid": "dde88de0-9249-490a-b1e4-fe1e5f03bcd5", "comment": "Malware payload (Mirai)", "value": "20e55fe9a563594db4048fa492f91fa7dda1405f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760789, "uuid": "a5c710a0-778b-4077-94b0-5d113a0476fb", "comment": "Malware payload (Mirai)", "value": "da29f6a8aca2506ae9e4ad74bf284d8374711928103ae3a4f4df2fbfbdc24cac95454e7cb5aef6e43c8288dee64c9225", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760789, "uuid": "41d97f6f-9230-4b60-be62-6f6b1bb53eed", "value": "T134F31A45FC909F26C6D752BBFB4E42DD372A1768D3EA720389255F24378A85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760789, "uuid": "fa8811e1-40d9-4fff-b4b9-1b75dbf3c2be", "value": "1536:Tq75Y/qO7O6kfUimtxmE9/+Oa7bU7b+PsWAtADeqnTiDIIkzfUOAIiMILVNlVJwV:T6sqD6kfU/+I7qGAjnAIIsF/WQ1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760789, "uuid": "afe372e9-515f-4055-83d0-bd083c8aaeef", "value": 158432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760789, "uuid": "b2c5f40a-168f-4c8b-ba17-c7f87b289e22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760789, "uuid": "fe3de3a0-418e-49c2-88c4-4a379cea56b9", "value": "38a3c912e8650c959a99f9130faf8a59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc13443-e51e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710763179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763179, "uuid": "995920fd-b023-49a0-bf35-238225dfbd05", "comment": "Malware payload (Mirai)", "value": "58e10882f098a2e5385b8fd94e47ce32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763179, "uuid": "0cd9b728-96d0-4ed6-818d-1a0f9f227c7d", "comment": "Malware payload (Mirai)", "value": "7d88b67ac64a3e6f6ea192128f07961f751b6a9cad200ca61114e447eddcc29f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763179, "uuid": "f0d6fd0f-9784-41de-97b8-264203f9bd13", "comment": "Malware payload (Mirai)", "value": "e8f4684f05028e059cbb8302cf022984e7ae86d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763179, "uuid": "28a4b9cf-7cbb-41fa-afa4-b7147f3ea7dc", "comment": "Malware payload (Mirai)", "value": "df2a69915683d093fe65272e85165f17c812ecf4d0f1fb263963d0d25b81fd9669eb47e87d5126667ce674d792c16cab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763179, "uuid": "3d0b2396-8c4a-44ec-9dbe-63e9497bce32", "value": "T16924C609AF510FBBD86FDE3702E90A0529CC650722A43B763678D528F54B94F5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763179, "uuid": "a407ba43-18d4-49ab-b985-5a6e3a5ebee7", "value": "1536:z2t/GIFxWvuiF9SrXadFr+4GaNdbXhvQp8kqjru645s24EZMQebnq2ZkVVSlRnM2:64u9rXycjsu647heKgnMM6h7seEyyTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763179, "uuid": "44fa16ed-d663-4f5a-9167-531a7266cdaf", "value": 213280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763179, "uuid": "5e7f61d2-6858-456b-9d06-1004d065cca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763179, "uuid": "4ac3e941-d149-4588-b5d5-fe61fcd70a27", "value": "58e10882f098a2e5385b8fd94e47ce32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9a6107-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767823, "uuid": "c9739e68-e3b4-4535-9dad-9311dba115be", "comment": "Malware payload", "value": "7e774e114ebc9dae417693cae6098278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767823, "uuid": "14082340-5243-4bfc-8651-4294b904c921", "comment": "Malware payload", "value": "7db1526ffc07afdad65c53d15cfd190cae29b613951167649785f9db5fcadc13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767823, "uuid": "93516e04-b50b-4815-a9c9-1a6874cd9613", "comment": "Malware payload", "value": "d62cd584040b55eba070fb63efe493974f3d008b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767823, "uuid": "ec7bed65-e127-43e5-b9fd-a0fd30c06955", "comment": "Malware payload", "value": "71239d8d324c8d9d048e5cfffed53003e74b83416e8804c508cbcac6ba057d0c52737c08399f12e8bb7f60e5ae7ea86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767823, "uuid": "b7e98b65-27f8-4b9b-a322-bfcfd2781144", "value": "T100A23A2105E19C72F1E1157C59FA3332D9B6F9254838F787E65CC82E1A78843DA3AE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767823, "uuid": "f977bbcc-504c-4b49-a8a2-8da1818fd3d4", "value": "384:pTJ/SdW7PvjN7KhEzqxR9ShXGIs0pReR9j3UWuXT0beUaW9ibWLcF:bjJKhxRg5xs8ZFVU4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767823, "uuid": "a6019c15-c83c-4c39-b390-bc9f10b5aaef", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767823, "uuid": "e4f67532-fdb0-4e2d-bf58-c31ddfe21345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767823, "uuid": "e9b9ef7d-6986-4bce-9b4e-d34b405faa87", "value": "7db1526ffc07afdad65c53d15cfd190cae29b613951167649785f9db5fcadc13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d36b051-e513-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710758289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758289, "uuid": "9cecd3ca-a545-44c3-a801-e0ff1e182200", "comment": "Malware payload (Gafgyt)", "value": "3d58a6b0ce2be651bd01dcf3d8607bd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758289, "uuid": "d91935e7-25b5-49d1-9020-d2d7ec266697", "comment": "Malware payload (Gafgyt)", "value": "7e0bfe16d6ef28fd95397a199e8a61c4c4212dc534eaeff7c63a0cb162d8f37f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758289, "uuid": "540ae0f8-3690-4f3c-ab92-32a9a20ebb38", "comment": "Malware payload (Gafgyt)", "value": "ac85b9f84fa8ca7a94f60b35b9f0d976accd262a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710758289, "uuid": "cec378b8-5214-42cf-9b47-0cfa856d19bb", "comment": "Malware payload (Gafgyt)", "value": "f7149975984e1e4a3deab9ba7f747e186c9323a81b6de9536a03a2a161abd9aaeb87dfb3144701df461552a3c437fef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758289, "uuid": "90d2963f-0a5e-47e2-bcf1-9bb9c975e8da", "value": "T18FC3742A7E22AFFEE668863107F35F708395219227A19386F26CD7185F7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758289, "uuid": "fb3126ff-4daf-45d8-b6cd-fe1189ceef3a", "value": "1536:L7ju1Tkeq+P5jb2rKSXCTALBcDgxllWWvvzOgeg95y4aDqtVLmkiLkcC5+aTSe:a2XvtIWvvzOu5NaDwVLmkiLkcCgaTSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710758289, "uuid": "928b85ff-e08a-483c-bf02-bd33570a5cd0", "value": 124012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710758289, "uuid": "f47c1342-ee07-45b5-8bd2-ede3ae815c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710758289, "uuid": "ac7367c9-0107-4048-baea-2e99a9ed7978", "value": "3d58a6b0ce2be651bd01dcf3d8607bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a99ff2d-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745669, "uuid": "1f070bc7-c9cc-47da-a93e-6c4f0d42c01f", "comment": "Malware payload (AgentTesla)", "value": "6d3930ecf861e79d08933eec906f2932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745669, "uuid": "bcef0a2b-780e-4ca5-8a2a-40cc714568bc", "comment": "Malware payload (AgentTesla)", "value": "7ecf055419ccb76a13fa53d8f5c5888ea369271ceaad4263f952da6d265c4c41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745669, "uuid": "b6b6321c-8e91-43bf-bfe0-bd614d2779e2", "comment": "Malware payload (AgentTesla)", "value": "5beb9fa04ae644e2dc1d2edf5073119287b4f9b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745669, "uuid": "2aec9e71-c786-4486-9e2e-f0a7650f87c2", "comment": "Malware payload (AgentTesla)", "value": "a2c0e8e5459bed2aa70d6bb723efcdd454d737aed6692ef4d05e15698079d250055d4e279f2964d9903cb9fa64a9fb80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745669, "uuid": "77496083-6770-4957-ab15-5344a5bd59a8", "value": "T13206AE37F64AF8F2D5480BB6E3BB0C0817B8DA553327D75AB9C96315190B366AB41C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745669, "uuid": "b1aec0b6-6be3-451e-9be9-e4dcf3b3b16c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745669, "uuid": "4ea24366-cf9c-40f0-a14d-35e423b739a4", "value": "49152:Nx1iPZNePalY+/wXZxtjBTePdgNGQG0f6Czt+D9s445i3kTA6AvBgbqYBMR:NulatjkPeGGyCJ+x4dAvBgRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745669, "uuid": "789bdf43-5258-4f49-9c60-87dde804a51b", "value": 3861232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745669, "uuid": "c496dd97-7d97-4b7f-b76e-3c46a16b74d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745669, "uuid": "f94e4b90-e2d1-4995-b8b9-e7a2395eb319", "value": "DHL20240313 - Packing List.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1ff271-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710757754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757754, "uuid": "4d66df4e-2749-4b92-b216-eda2abc914b1", "comment": "Malware payload (AgentTesla)", "value": "3b669ace85e75d81bc8bdba9846ec483", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757754, "uuid": "425fc77a-c559-4e32-b4ab-c8869e663668", "comment": "Malware payload (AgentTesla)", "value": "7fc81dfbce08e31aceddc316a3862e0b3e4ae48702c1c478947d5174c76165b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757754, "uuid": "052b004a-473a-40bf-a8ad-37539146bc1c", "comment": "Malware payload (AgentTesla)", "value": "f70a66cb9053d8e48552cb7800e4b8f9f93f9643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757754, "uuid": "9f287639-0012-47e3-a3dd-b20067b5c5f4", "comment": "Malware payload (AgentTesla)", "value": "82aea94814c65bcab39950853741737f04455c451f7912db1bfb28bf290482153ea7fb5c1b2dcbc072316168cef5251f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757754, "uuid": "7d99288a-e5b2-4710-87d2-d04af3af63eb", "value": "T134D423166BE872B1F8BC1FB6176C41515B7B73A66C20C6BE15A1A88C6FC27F17072207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757754, "uuid": "af1dbfe1-ab95-4fe4-a8cd-e83a6b760099", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757754, "uuid": "b81b06e8-50f8-4592-bca7-fb0755af027b", "value": "12288:Pvl/4w64UzhkBzMTvIzV0vQZG/CWTKnroHpDjcEr1TVh4YxXcOfOmNpLkzgvyb3d:nB764xBzJx0vQZCCoJDjfDVx/fxpYgv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757754, "uuid": "be91f0df-ed9b-4ec9-899f-317451477add", "value": 638984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757754, "uuid": "3dab7d8e-ed1a-4538-b3b8-ada48877488a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757754, "uuid": "85c98240-7049-484e-9266-d86121e63a6a", "value": "Proforma Invoice001&002-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7bd7df-e4fd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710748917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748917, "uuid": "6b73a2c0-8d5c-46a9-8c50-e81c7e66eead", "comment": "Malware payload (Mirai)", "value": "cd87661b604466df011b8cae295ce0ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748917, "uuid": "d0cf065f-8ac8-4d6d-a165-3582db172b56", "comment": "Malware payload (Mirai)", "value": "8053c46d941255a81b42ed9ddfacfe60d29dd6c0938a334b224458a0d71dbaa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748917, "uuid": "aef2985a-63b9-4c04-9cbf-ad4857f028a9", "comment": "Malware payload (Mirai)", "value": "b1b1c2ef49730e476c22caedf961c85e18e177ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748917, "uuid": "16cdaa5a-583f-48f1-a423-87f76905c2f9", "comment": "Malware payload (Mirai)", "value": "91f27a6f789ba86eb05933416f80c41988c548f25d09812047575f394191bb61a2527ccbb7cbe3d9dcd0f36f009faa4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748917, "uuid": "f104d293-4dc5-43c6-9443-1853ef5801b1", "value": "T141534B02731C0A47D1A75E70293F63E183BFE5A031F4BA88690F9B4A9671E36554AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748917, "uuid": "6e612896-85a3-481e-9eaf-e7ccf0069ef3", "value": "768:+zBJq4rOkbfR5iC4rB/oqrOJp0pURzqibMpszAPQT94+kXxK0epDOKF9It8kK+wM:747LdoaqCIj4J4xXx3epa2Ieh3/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710748917, "uuid": "fd74a6d1-8901-4e2b-84b8-ff2ab3d412f6", "value": 63032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710748917, "uuid": "84067e98-528e-472c-9453-76d1c2bb7eee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748917, "uuid": "ba25dca6-292f-43ac-bbda-640b735fb4d8", "value": "cd87661b604466df011b8cae295ce0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34fc922-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757441, "uuid": "40509877-843c-4c15-b654-0d3f07fc126a", "comment": "Malware payload (Mirai)", "value": "68b4c6b86fc354719d0d95c16b76bafe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757441, "uuid": "06f0d06f-a0cd-4238-b7dc-edac3b398fee", "comment": "Malware payload (Mirai)", "value": "80b779c768e0fb781bc164bc00c59c234bf4d22ff75681ce6159f98fc4ccb708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757441, "uuid": "cacf3fc9-136d-4315-8eb5-5aaf208a54d7", "comment": "Malware payload (Mirai)", "value": "319a428c1c1c2e9d5415af15018b2505ed4ce389", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757441, "uuid": "7fe1306e-d57a-463c-8ccb-0904f8124a83", "comment": "Malware payload (Mirai)", "value": "52618e80ead9348bfba2b0a364a201f7403f0c5c9bfb849643c83744a3d8546257c6bb2623c1b096ba4e2cdbe08154d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757441, "uuid": "a48f6326-3831-4dfd-b31b-864482790713", "value": "T15C437CC5DBC2D9B5EC5225B0187767939B72E9394638FB93D7A82132AC13B50A21738C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757441, "uuid": "ad7d4cfc-e06f-498f-89f2-40c466a8c4a4", "value": "1536:oaN5O+LB1u3bnUO89UpGN9x6pwvCmj8XBxXBqDXTlWhfS3Vm:oaHO+11+bnUOSUpaP6pwv7UxRqDZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757441, "uuid": "a4c4ace4-691d-485f-811d-7552ad88a7b3", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757441, "uuid": "8898087a-9838-4dc9-bc81-f56b9d508873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757441, "uuid": "df660623-183f-48ac-83ac-a0b419c18b03", "value": "68b4c6b86fc354719d0d95c16b76bafe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ccb06c-e506-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710752635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752635, "uuid": "37753692-4ad1-4afe-a08c-e4a7afa1d113", "comment": "Malware payload", "value": "6304e8e2dc01899bdcb564092962c6cf", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752635, "uuid": "d361404c-587e-4245-a54a-92fcd5f657ea", "comment": "Malware payload", "value": "8114b50ad817db311eaeddc12d3969e3568c2f79235866db432bc0aef727e87e", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752635, "uuid": "a4972433-b496-4179-b03a-2965ba5349a9", "comment": "Malware payload", "value": "4ea7b0a46df36c57c77f6febd0334f381fdfbef6", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752635, "uuid": "54d4ae53-37b0-4984-82f8-33e34bbf1b31", "comment": "Malware payload", "value": "bf0cb5a5986712a533d93529bd211077ed39af5897c6512c2e1668e1d8a92177b49e8edc3fea81d553b5ef44346af88a", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752635, "uuid": "a566802b-ffdc-4f27-a2dc-649856eb8a64", "value": "T1BA23F13AE3292940C8F4947C126D1793B585058C8742FAB73AC9791D518AEFB33AFD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752635, "uuid": "08e4fba3-e712-49fd-9d58-29e88aad9ec0", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/s+:tLq94YV7JMxXyd4x+gzexTU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752635, "uuid": "f051b005-fec9-4ac8-b0e1-c655b05bf8d8", "value": 49373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752635, "uuid": "2d2e99ad-ee5b-4975-8ed0-cfd01e15cbc8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752635, "uuid": "23d3a181-1187-4811-b731-f61ee7cf9279", "value": "ACH-9914-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d3492a-e4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1710743105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743105, "uuid": "2e134671-6fa6-49dc-9839-f786306d1668", "comment": "Malware payload (DCRat)", "value": "2b287961fc264bf9c109d26d679dc701", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743105, "uuid": "c7300648-15b2-4bec-bc72-06660ff22659", "comment": "Malware payload (DCRat)", "value": "8116bc1cc5a9952d53a2b5a35956c631c45feb96a82316444cf287ed9a18f81d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743105, "uuid": "22ec9e12-12d9-4c13-94dd-0ae3e2e98520", "comment": "Malware payload (DCRat)", "value": "75d383800827417273811b0eb755c4f78484f6ee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743105, "uuid": "34cc6666-19b6-4b10-8bca-03cbeba94669", "comment": "Malware payload (DCRat)", "value": "7f4ec4f8ed2ee23f65e1fd58b1a6932293d4ffd0564a108b47c618ab8c6e5367e9d80ebb18c22c53490b6f60eeade9b1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743105, "uuid": "f31cc671-4fa3-43e0-be62-def1539d8803", "value": "T11E4549027E44CA02F0181233C2FF454847B9E95166A6E32B7DBA37BE55123A77D4DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743105, "uuid": "486fb6fb-7c6c-4fcf-9199-968ab44cb3b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743105, "uuid": "9459bd90-58bf-4902-8426-5b095127a4fa", "value": "24576:ChuOUh2FPFCKEwLv85pCuZjims4NelJsWR4EH:czUghYdXQFyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710743105, "uuid": "884bb487-5f4f-4a33-a08c-304a68de2f86", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710743105, "uuid": "a69d206d-91df-4c6d-94e3-4ed06f6cbf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743105, "uuid": "a0463dfd-2d0f-4df3-9f03-87e43cc1db27", "value": "2b287961fc264bf9c109d26d679dc701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b5f9e0-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752400, "uuid": "63912c4e-4afb-48e5-90f8-02e0490db626", "comment": "Malware payload (Mirai)", "value": "1faa6440f52aa0fdbbd9da1e8c72a19d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752400, "uuid": "a1be409c-013e-4d4a-89a1-a106e31237d8", "comment": "Malware payload (Mirai)", "value": "8127569a5c075da5c4424ffa663985c991417477e6bbbefa54826c3c1d26561e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752400, "uuid": "36c22d35-bcfc-4157-b7b4-9c2a011244f6", "comment": "Malware payload (Mirai)", "value": "50edbbc902e02403f65c824908e0ebc9bebabb87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752400, "uuid": "8f8e536a-a084-4220-b91f-64f02ea37c73", "comment": "Malware payload (Mirai)", "value": "163793eab21e87356b8a321a1e137497aeca6653243489774e6cc97e936472353352a5546d489f0c6b58c4834e39e3dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752400, "uuid": "77d2e2f9-69d9-48e7-9ad7-e905024635de", "value": "T1BE4302DEA3987BDECA997BBDD0E9862D1D8CB180E69B03C92B144CC5A43740E54CE176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752400, "uuid": "fe9e301c-d686-4134-91b7-2bdf650b1728", "value": "1536:Y9DC7QDpgTI9Mhj5SiPiWXZYCLEogbBHtrg:Y98QKldSiPiQXgbBJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752400, "uuid": "2dd98806-249d-4def-a862-1f4d098b4f12", "value": 56428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752400, "uuid": "6b40e8a3-ea53-4f98-afb1-a43ef5d44ecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752400, "uuid": "d95a3c61-4842-4f85-96cc-b1b33d39d28c", "value": "1faa6440f52aa0fdbbd9da1e8c72a19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7578d8-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757891, "uuid": "e07eece9-89be-4a98-aac8-dd5113e46157", "comment": "Malware payload (Gafgyt)", "value": "c650a65c47b144d0f41a366197976a34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757891, "uuid": "47c6a428-a217-4831-a2c9-92621ca75ea5", "comment": "Malware payload (Gafgyt)", "value": "81efefc16cef4d0d7bafaf43047c7277c0ec994605c96dd622edabe8160e1a34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757891, "uuid": "64211317-6552-4e15-b328-cf1352bc1b1f", "comment": "Malware payload (Gafgyt)", "value": "2f924f3914b3f4c21cc5078b0f89f5c17e5e9553", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757891, "uuid": "9f502e4c-a8d8-4d17-9e18-21d82eb0202f", "comment": "Malware payload (Gafgyt)", "value": "ee268174d6c825ea63b232e3ff09bf60629ac008a0504d61964838b8e7ef314dd4a54b6ffb98ebe3084d276f69f32201", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757891, "uuid": "7782d13e-b8be-4ed2-b037-c5989acb20f1", "value": "T1D5C3D717AB619EB7C81FCE7306AA4502108DE45B12E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757891, "uuid": "0207a4a0-e31b-499a-ab0b-129f502b21e7", "value": "1536:YHeTl55H9skke2Ax0MrZ0+zEtYtIPemgFM1/awGeHLmkiLkcC5+aTSe:Ycdx08btaemL/aFeHLmkiLkcCgaTSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757891, "uuid": "88cc01e4-599b-4a16-a437-21b9fff7a106", "value": 124012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757891, "uuid": "005708cf-a1cd-4cd0-a462-5715d4143be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757891, "uuid": "5bb6694d-9285-4eea-80db-2f4d125e24ed", "value": "c650a65c47b144d0f41a366197976a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1971b6-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767872, "uuid": "2975fde0-3758-4c58-93cd-d95a223b7dcf", "comment": "Malware payload (AgentTesla)", "value": "359a0da01428a1943744edfcec75c63f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767872, "uuid": "a5386a27-8ee7-400d-bb14-6208b86ad4f3", "comment": "Malware payload (AgentTesla)", "value": "821c41164399865a1b2cd77d7b6825f9d83834732fd215dab978f30ae48bb5fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767872, "uuid": "e2824a81-db49-454a-9357-8497713aa15b", "comment": "Malware payload (AgentTesla)", "value": "9e3f7a710be5efe7241e142f8ef20a37765fdca9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767872, "uuid": "ee00ed62-bf60-4fd1-8773-3519c84d190c", "comment": "Malware payload (AgentTesla)", "value": "a1617d1c3789d83196293ccd340b8ad4fa6ba47397148d3ad31afdca731d3794ce9f83f7009607da6811b1c100e3d6ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767872, "uuid": "460f0ed5-d907-4041-b70c-fae59601cd46", "value": "T1B4540918BF94911FDD2E82B8D4C2870FD7F1D4ADE65A7787EA84A0B05F237B58902943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767872, "uuid": "53fd20f0-eca7-4c9c-ac1a-07452050aeff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767872, "uuid": "90048540-ebfc-4ffe-8aad-676694d1d905", "value": "6144:yC7b8XPNiX8IN68dIqZZFlYyD18mKFoNs+BfYsJ0NwPaQt4N9IXuMz:yo7FT8mVi+pYhQt2Gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767872, "uuid": "b6754c75-ba1f-424e-8822-1bc1cafdda1a", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767872, "uuid": "94345134-f7ab-4a1f-ba03-e40b87686ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767872, "uuid": "76f7e11d-4f47-4ab9-9eaf-701218be9d96", "value": "Teklif 8822321378 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70148f57-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710747047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747047, "uuid": "9569ba18-ad4d-4ba4-b96f-9e28994049e0", "comment": "Malware payload (AgentTesla)", "value": "af1972cb43049b4286c131d8798aa312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747047, "uuid": "30cd5d3d-93b6-45ca-b5a4-677863678a05", "comment": "Malware payload (AgentTesla)", "value": "822e0724950f23313f46337ba57f73ffac6e95cda09bc4f347aea36bc4f72995", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747047, "uuid": "4db6e406-3be7-4d33-8dda-15c6d0e9631b", "comment": "Malware payload (AgentTesla)", "value": "4944c1a41e1cf824f41178049de407f0457e3791", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747047, "uuid": "fb370fcc-1dd0-4752-a746-8d00bbabee93", "comment": "Malware payload (AgentTesla)", "value": "2ba89aecd25ca975a6624c403b968bf58daf418a951bdac72145d78058afa06bf3f8eaa1559cc91881659da32cd34cfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747047, "uuid": "60e2d109-3450-468a-a438-e39de5429062", "value": "T1FDC423EC623CBEDA98A41C00D2B43DD80D9EF77C683750FA3C62E691512D797B931269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747047, "uuid": "e7075ed1-d6fa-48a6-9f1f-d3df236c3967", "value": "12288:XNVQAJiSDs6plTUvez6cINmZ8NtcLRVR7g40JLhPTvW8:9qd16/YvezrXZ8NuLn+4kpe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747047, "uuid": "17c55eb5-960e-469b-8ac7-fc83d545d36b", "value": 548266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747047, "uuid": "18c542dd-321b-439d-9c88-a6f9461c372b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747047, "uuid": "62f4cafa-f060-4c1c-90a0-8c933f33a568", "value": "Q468009_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65f4869-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767861, "uuid": "fcf32bc0-cc39-49de-b79a-677a0297a440", "comment": "Malware payload (AgentTesla)", "value": "dd7ac5f2109c2cc61763ae93e4fb955c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767861, "uuid": "940ca889-d8c1-4854-9dd4-59c2e8baecd1", "comment": "Malware payload (AgentTesla)", "value": "84b2a0360556088e4aad29627d4ed15d53b18aa72d9d98b4b0d1be27916c681e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767861, "uuid": "4e7c31dc-de6d-4832-874a-636a5af83186", "comment": "Malware payload (AgentTesla)", "value": "558e89789946fb4cfc3b63bc258ddfe23d42c558", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767861, "uuid": "f424b881-551e-4762-b8c2-fef30a78f9fd", "comment": "Malware payload (AgentTesla)", "value": "3c2ce89d04e37f89eefcc91279239499759f78c36ce7af11aa5f71b839a52b7f8c0b5db114ccc664c16ecb5ae243eb01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767861, "uuid": "8412970b-e5cb-4582-a989-9c3ba6f8e303", "value": "T1B0D42340F7CADB33E8BD92B72E62E281177784D47C62E3E564A621CE0E1AF459D52343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767861, "uuid": "31bfc733-3259-4969-80ab-1071bb4a02b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767861, "uuid": "bdf3c547-37fb-4c37-b96f-5857ab1d66eb", "value": "12288:ptapNjL4yL4uaRt9f/JUfA2BMm/In4wqS77Eb7FnPgRh:DapFLXIt9fRUI2umawR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767861, "uuid": "234527f4-0847-4442-95ed-c016a707d95f", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767861, "uuid": "a346db60-c0a7-425b-a614-742541bf2fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767861, "uuid": "c44f629c-d60f-47f1-a589-48dd0a0a98a5", "value": "Quotation lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88604819-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760402, "uuid": "4241f091-9f83-4c4b-a23c-782b5cf9ff86", "comment": "Malware payload (Mirai)", "value": "03629327ba4ee538bf409366d90b226d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760402, "uuid": "a7d9de26-7e09-4e03-9e44-af64a9be9329", "comment": "Malware payload (Mirai)", "value": "85f24a8469ef8060e17d4fb7ef0e27ff73905ac3a00580c5086ae9cb9b41c88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760402, "uuid": "8a2a6193-1550-4c07-88c9-89decaa6bf9c", "comment": "Malware payload (Mirai)", "value": "948b3023f6542fafee7b9d7dd2d8f39bf62a7311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760402, "uuid": "7de447ca-f492-4109-9ce0-4c584c53e050", "comment": "Malware payload (Mirai)", "value": "ab6a0f216972e1665c495368f716e3a23fb3235a9dad8fb5ecf1c24a871793d5e2f59fc2971d32ccfebaf8b171a0c650", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760402, "uuid": "7142f954-ed42-4f33-b6b8-f0175aa91c17", "value": "T1AC3144A062D05EBCC8E4517F9D66472473A4DF88E1C733A3920C6728BD1DE3C1C16545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760402, "uuid": "2a653f71-d076-450c-b6ae-32e74d34f4f3", "value": "24:DKGTA3wnHflfmoUxz1tmv3gRGI9iTBu4qnlxrR+f2KpQt:DKG83wnHtmoUxBwsCBu4qnlxr6LpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760402, "uuid": "3a8d9db3-8d6b-49c4-861b-f8753257ec13", "value": 1460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760402, "uuid": "578f9a22-32cf-4a0e-aacf-b2546b59f851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760402, "uuid": "cd847d6c-8c3a-4099-b5de-501246480ac8", "value": "03629327ba4ee538bf409366d90b226d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a021fcfa-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727371, "uuid": "7a1e9bd9-f0ac-4f64-966d-999813eb164b", "comment": "Malware payload (Mirai)", "value": "934e9f95419c6c50e7c7732edaee8062", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727371, "uuid": "1b5a94f5-c697-4978-82c9-7f2ffb6ebb0a", "comment": "Malware payload (Mirai)", "value": "867550dd42a5cbfeed90a375e56667e900f60c0b84be0ee15cedbb8b42d58f13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727371, "uuid": "13470928-dd5b-4bbc-9984-6a260a177a22", "comment": "Malware payload (Mirai)", "value": "2baf32f09da524f313e14e924dd6a2558aff9593", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727371, "uuid": "ccc2b025-bf0e-48dd-92a2-e97cca240c64", "comment": "Malware payload (Mirai)", "value": "9025b486bc21404f497cb3b15d4cde8326a3b1ea41854c1b21fcbf80e82f1b852ece11104e8f645ce37f87fcb6c1af0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727371, "uuid": "2a0a05b9-cd1e-4c4c-a0de-a391eea079af", "value": "T12D937DD1F743D4F5E89705B1513AAB335B33F0B92019EA43C7795A32EC92510DA1ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727371, "uuid": "a0959163-3b45-4913-a42f-74bc02c5ce67", "value": "1536:0pG2cWAcCghsZcecJmR8/bDCFms8CasdPIYWdgtaEoSGtA6u0xZ:0pG3WrCEjecCwbDC0ls9ZWCt718u0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727371, "uuid": "db414367-de10-466b-9f2b-5b7ee644ed39", "value": 89544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727371, "uuid": "3d2c55ac-4063-4fe9-9f91-b973a9d2f688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727371, "uuid": "aad924ae-9816-4835-99d3-e473316dd376", "value": "bot.x86-20240318-0202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a5f1ca-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779943, "uuid": "6ce0c64d-aaff-4350-b0c8-4896c936a481", "comment": "Malware payload", "value": "dfdb121f887834ba80ddd116f44b80f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779943, "uuid": "36bd5f7c-4b94-4cfd-af04-dfcbc34cb658", "comment": "Malware payload", "value": "872ad9b02cc5dc4067576ccb89373c16d3ef72c8afbf1e2fb9de3495f0923f5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779943, "uuid": "79aed0ff-59e6-4a25-9bef-21741b226fe7", "comment": "Malware payload", "value": "62ca8f9baa572c68c3f3f511a28fab8aafaa66f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779943, "uuid": "91b925cf-f5d0-4ca5-8413-81feda1ab6f2", "comment": "Malware payload", "value": "8d2d1778310ad1a69dab749896953febf49598315c403da3b1ff4af3094dfa663480ad24ef140b519afa1bdc9ab73e7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779943, "uuid": "562ebb28-d68d-4cea-92ff-8c1cfa6735b5", "value": "T126946B11FB90C018F5F610F9A2BFA178A51E79F0576860CBA2D127ED9A305E4AC33793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779943, "uuid": "c1ea8c03-ebea-4028-ae04-624c50c988df", "value": "0ff61fc48533763f63db143772878ca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779943, "uuid": "b4e73bb1-b728-4713-be39-d26aaaf59a4b", "value": "6144:1muorCNGfdpHSguRymfhKenWTmVvR2qxuTeA01hux5zVNF5CgcYG:s3GguRyMhKeW8vd0en+5zVNe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779943, "uuid": "0ca7d71f-c395-4b91-9fdb-152541b2257d", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779943, "uuid": "43fc4d26-3f95-4df2-ae30-fe6ac8c842c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779943, "uuid": "43399292-994f-4c56-87df-bd319053d30a", "value": "SecuriteInfo.com.Variant.Tedy.214997.12155.9582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fb00cd-e4ff-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710749528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749528, "uuid": "1ce49047-c898-44ca-8522-d68db536acda", "comment": "Malware payload", "value": "005c309300bbd6a84f4921b80bf1e850", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749528, "uuid": "e10a5987-4f22-469d-b8f5-31cb4d8552db", "comment": "Malware payload", "value": "8739bb15e314c2a93948830a873c7f0ddd1e23a623b1cd198878d89f71713f21", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749528, "uuid": "4d3e10a1-8f65-45d3-9bcb-f26580efd947", "comment": "Malware payload", "value": "882e0a7e31928648b497e85a3bd8b8fa3823e68e", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749528, "uuid": "330d1199-51bb-4af3-bd3b-481cc80e424f", "comment": "Malware payload", "value": "a1a83cb611f77c05dc782bd85a2c6b2e317a365de554a52025013505186eb5b680fa158aebe1bd2fadcea8c42075f8a3", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749528, "uuid": "8d6ca55c-a548-4f56-8653-7af0a425e31c", "value": "T115F43356A22B3284D4C578D640ADA69DF2E9983D5CFC60113F8C25B4F72C9CAB39FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749528, "uuid": "96ff851c-4a46-4db6-8003-199d89f4442d", "value": "12288:55Tqxaua52EoeD9/nbfMsT/hWC7XrY4jUEdfECn/DZo5PdQ9EVF/UXTMf0OHt:Eza52XQ/gsTsC3YlEfBrZoJCmVq45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749528, "uuid": "db4b6d93-2a48-450d-b269-3d514d07199c", "value": 787676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749528, "uuid": "011a5ea6-a4a1-41f3-b3c8-6f708bf66d83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749528, "uuid": "6af7c4b2-4ea0-47b3-8224-21b0191b635a", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bb6f1f-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751974, "uuid": "1bba6889-1ca7-43ad-a315-7023a36870af", "comment": "Malware payload (Mirai)", "value": "581736f547944728a104894a2879971b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751974, "uuid": "400aab4b-e69a-4e8a-ae4d-3c34bb36007f", "comment": "Malware payload (Mirai)", "value": "8817f84f87701fda427a1f48b90e63c08667c24cc78ee4dfe0b3eb6f3876a5db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751974, "uuid": "ad4d99f0-10eb-4831-8fad-32c043b43ee7", "comment": "Malware payload (Mirai)", "value": "1a918cf05ead2be262a1beb600332cf5a3bce058", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751974, "uuid": "a3b29f25-b21c-4c43-b39c-8945c4d76a88", "comment": "Malware payload (Mirai)", "value": "fa7c998c0edebf36dbbc3dcdfc9424a73308950b12a976395961a1b93444a19521a4d700df469e70223edf3308a1126a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751974, "uuid": "64482938-a544-407f-818d-0a54d01e783c", "value": "T1424302208956AC14FAB01C33F4BB0147363C4B75E1FDBA583DE6204A389F6F5CDA9526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751974, "uuid": "3abb45a4-ce56-4ebf-882d-3d0906008449", "value": "1536:B8AyaX1fTb+dl/JJ3FTKFxYVozKcn76MkBTJEEL1:IaX1fHsdJt0xYVozKcnIBTSEL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751974, "uuid": "6b9b8e46-1e0d-42a8-ae38-09e3f4c149e2", "value": 56936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751974, "uuid": "dcbfc12e-99d7-46b7-b716-cb1a0de17918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751974, "uuid": "bf326e8b-9ba1-46cc-92de-0641daaf209f", "value": "581736f547944728a104894a2879971b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63a0853-e4ef-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710742977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742977, "uuid": "99ace0e0-c20a-4337-98f4-eb56a1a7a988", "comment": "Malware payload", "value": "5fe40134a93b5111e5556ec5cab9359a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742977, "uuid": "52f37d1f-74fa-4b48-a304-092ed1de0b9d", "comment": "Malware payload", "value": "8855133697cac0344d9059d009df79f18c0ee02312188c1eb2da0e0f15ab893c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742977, "uuid": "a637c57e-a379-4ca3-8c4c-30e455270b9d", "comment": "Malware payload", "value": "a6b6d10c2dcdf42e8047966e5dfcbe4dad9cafbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742977, "uuid": "d9a08446-e64c-4c36-913b-fd5402b6002f", "comment": "Malware payload", "value": "2d59308b06f72bd937a4f23d9830bc49a6d814dc141c9c8a5325f4e23bcc9af124341244006535f7cfeb10348aebf8ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742977, "uuid": "f052e3cb-20a2-4473-85ad-2d9f6b710b25", "value": "T19566C166BB443DF5748F8C264133A7E5C26858A2C4F3824FCB18B5818C6DFDDBB29496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742977, "uuid": "63f0308e-390d-4f9b-9999-237b4e20dd18", "value": "3072:VRo8uY0G9jzxwdokV+N6qB/IKJibNeMjHKJY/QlBKKdZn99Fw6a3w7nGi2Q2adjT:Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710742977, "uuid": "22c93392-fae0-46b4-bc19-383301ea6002", "value": 6838576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710742977, "uuid": "a82aecfb-3ccc-41f2-b494-f41d1e4aa0c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742977, "uuid": "02959744-9ad3-42ed-b74f-03fceab3011a", "value": "atom.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73aa4e02-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710747053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747053, "uuid": "9dd03f70-12cc-4d5d-9d21-1fbeabe087b7", "comment": "Malware payload (GuLoader)", "value": "d258bc3f14a12f4513c64c43a0366c28", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747053, "uuid": "9708ab79-e43e-4964-902b-691b133e4357", "comment": "Malware payload (GuLoader)", "value": "895ec8431c6004b09368335cab5d63100a7987f736d0e1906d60b7dc3c97cc15", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747053, "uuid": "fdf76ee7-1121-45e5-9156-32a4b0107329", "comment": "Malware payload (GuLoader)", "value": "6eb6d0b47011f1dd64be30251113fa3b32384bf6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747053, "uuid": "6c9ed369-3c7a-41fc-95d5-18d1ef0818aa", "comment": "Malware payload (GuLoader)", "value": "d513c70ae6945ad50f3cb6f885839d916335c1d0dbeccd94e73ef38b9ba34a89df9957072fd8f793998d8c06c2ad023a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747053, "uuid": "9ee564c7-38b0-4ee8-bcb5-26a349305efc", "value": "T14445234D82DCCA76E68385326DB26BF7E83FB5203026540F772C3B6E9F553C188569A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747053, "uuid": "fdd95be6-dd43-467c-bd63-45337609428f", "value": "12288:sq3doXphD/ejXq+WCW98QJC3PxC5ZVHa6QhH1CRjU0u3FZWTzg:PSPZ+D6NCpsZVMVCq0cszg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747053, "uuid": "5b39a558-02ab-4f43-8efe-6b5957e6f88f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747053, "uuid": "097c0b5c-de5e-479f-9ad8-d0519d7aaca4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747053, "uuid": "38a8eeb9-8f77-4702-b637-f16a582434be", "value": "Request for quotation_pdf_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573fa177-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753877, "uuid": "a133641e-6dd0-4c51-b1e8-289ac75880c5", "comment": "Malware payload (Gafgyt)", "value": "5034e1eb708171e9b63ac231224e2ac3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753877, "uuid": "82ade4ea-4009-476e-85d0-ff0e1de6c366", "comment": "Malware payload (Gafgyt)", "value": "89c9b9d71f6bde99d93e67b1d3bcb3a3799846e19ee587cdd99743195bf89af3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753877, "uuid": "927de661-8408-4130-b230-54eddc9543e8", "comment": "Malware payload (Gafgyt)", "value": "3a77a921b644f8f57e6767747c0d7c0b7d32d823", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753877, "uuid": "6c0e88c1-7e2d-4145-8042-6293582f9d89", "comment": "Malware payload (Gafgyt)", "value": "eaa81e30118c8a0f1e42adcfb4e88c50118cf43d789fec17d99dbeb9ff4c8997418c62dea15cab933b96a2bbd663b3e0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753877, "uuid": "712cb0db-986f-4812-b07e-ab407d6c4d0c", "value": "T107E32A06FC004623C2D16BB7B39B428D77225F695BCB3351EA297DB02FE1B991A395D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753877, "uuid": "e11a0ac3-1932-4a83-832c-8014ddcc70ba", "value": "3072:WhRHih54YD1dMw1vsRtH9sssB0QetJ8add9QzhszmX6v7xBX8dX4TtQ6W8GoQTRk:EntH95E0QetJ8addQ/X6vCX4TtQ6WvoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753877, "uuid": "c2ef0060-ed81-4ddb-8573-baf441280032", "value": 146438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753877, "uuid": "12535b66-63ba-4189-92a6-1fc87a81e33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753877, "uuid": "a44903b7-776e-4043-9b20-02704b2d0bb0", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b880af8-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710747039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747039, "uuid": "fdbdf34c-c5f7-4db0-93ba-d8bd7299de66", "comment": "Malware payload (Formbook)", "value": "9cfa5f0001131d797c7b25349e173dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747039, "uuid": "717068e2-c97b-4dff-a804-20cdd9b1da16", "comment": "Malware payload (Formbook)", "value": "8b78d6da98f169fd75cb59064e11661d4b56461385985214833732b0b7958301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747039, "uuid": "be732e59-fe62-4f0e-8841-8e4549e96a7b", "comment": "Malware payload (Formbook)", "value": "b14b2098f108e0e899b6a90c31f17b40e8593be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747039, "uuid": "6af39338-a6f6-4b51-ac50-d54b310d708e", "comment": "Malware payload (Formbook)", "value": "f1352dd58e026e97077214c1b6006e19724533a9727dc9231966bbc333f75e8b69533b64e063db7b97534918a1e5cd52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747039, "uuid": "7cce8b85-b63a-44f5-8d32-2d44c9a7050e", "value": "T11ED423E3332C9613DEE62B3497A2DA405737A7256D64C35838FD5288CDC1BD0DA98B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747039, "uuid": "76ce2282-ef40-4a64-b682-6d156808a7ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747039, "uuid": "3884bfe5-a8fb-4a52-9215-b9698e614447", "value": "12288:7gRhACCqzP3uNIXj7Xy7lb/UqeyPaPZR1i0prHVfGercAfM+M2qkR:8JzP+mXfCTUqeXPIGrNjrfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747039, "uuid": "fd844156-2a5a-41aa-9a4f-efd472fcf817", "value": 654344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747039, "uuid": "2605add5-753e-485b-8e35-937c7925d885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747039, "uuid": "0baf2b6a-270e-4809-9710-70cfd3879653", "value": "Payment TT Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de09b64-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727367, "uuid": "9a9f8281-753c-4b20-b749-91e72e657e3f", "comment": "Malware payload (Mirai)", "value": "88d5840db62eb790e2aa86c59e0041b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727367, "uuid": "70178789-bceb-4d72-9cc5-735048d6a862", "comment": "Malware payload (Mirai)", "value": "8bc23398181b60f4a5871dcad7d380bee7e43c46959276c7e0faed5755651c43", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727367, "uuid": "57cfb97a-51b3-47a1-8152-76f92c7a0f83", "comment": "Malware payload (Mirai)", "value": "7f8a385cca4fd3a405042be3bd128461a195b543", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727367, "uuid": "7eb6e0ee-05af-4779-8400-364affd6c5a0", "comment": "Malware payload (Mirai)", "value": "0a66e9ad891f3993ea0f9f34c4cfe3ac8340ce8ff26bb0000e431b0d9fd9ea33f2de5a10208084c3f507c129e2ce1b92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727367, "uuid": "f2e32eb0-5717-4ddb-8dda-0b504e96782c", "value": "T1F5E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72129D246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727367, "uuid": "9221c574-aa45-4a88-a2c9-393ffbb89dd8", "value": "3072:tUkeP3UfChBuXIjITYXakO0PTNPC+3ckRF7:tUHPYguXCITqaCpX3ckRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727367, "uuid": "198b6250-a91a-4d81-998d-40d23485dbb2", "value": 143228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727367, "uuid": "5618ef65-8295-4099-9763-e20dd9cda975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727367, "uuid": "ff1ed05f-23e6-4a68-b491-1ddcfd49c9b8", "value": "bot.arm6-20240318-0202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e36587f-e512-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710757835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757835, "uuid": "c661ffb9-ed72-4cc7-a3a4-01fa23079559", "comment": "Malware payload", "value": "a9abe9751290aca75dabd340c8d71a66", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757835, "uuid": "3b0d94d7-4aee-4a17-a248-a869239afe3c", "comment": "Malware payload", "value": "8c15f75f1e58f923418d6fb131fdec9ac8dd10095b70331e074f43157b160d20", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757835, "uuid": "f1752ff3-4b50-4205-bab2-4a09f0f01667", "comment": "Malware payload", "value": "eb6697989276ed59636cb0ed3af0499d8c490eb8", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757835, "uuid": "f734eab1-b6db-49f0-babe-081353c723c0", "comment": "Malware payload", "value": "f67e4dd2127dd70ba9a11e0ebd73a7a45b22c393ce9b2a51b37e35dabd5971f02c1fb2b36e1f6f2cd6d174e6791c52c9", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757835, "uuid": "1fb6a10c-674b-4d9a-b567-05dca3482295", "value": "T1CCC42333DA6C5683DAD2BE9AF6017C250944470678BD0C34A452365BC7E1E3EBFBC686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757835, "uuid": "36de4fec-9249-482f-905b-e666c9fd1a3f", "value": "12288:kvEqykwHFEffdQ0v5V1IBkQQXe6vP7qnXNBZzv6vOetS4W3pHhQ:LzkwlEfltvnuBxyd+nXNBZevTS1p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757835, "uuid": "d4c78153-e79b-4cb4-a0cd-256c8be0769d", "value": 592338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757835, "uuid": "193a904e-b24f-470b-8968-a683c117e3ec", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757835, "uuid": "4b981569-2179-407c-a6cd-0e5974440d43", "value": "PO240405-050 \ufffd 02.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee0a99-e51b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710761888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761888, "uuid": "29041ea0-306b-4d78-921d-b383d0d39cf9", "comment": "Malware payload", "value": "797750259e06cdfb642067eeb3728f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761888, "uuid": "1bafca4c-58c5-4717-bad2-4d94cebf9d0b", "comment": "Malware payload", "value": "8cb320041b76be2e673bb78fcc4e03599fdc90ad03d452eb23e2027bc0bde669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761888, "uuid": "f69a03b9-120c-49ef-9e54-2c63999490fb", "comment": "Malware payload", "value": "10436d918ea9a1ab916b685ea74ac691db1f4630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761888, "uuid": "475742d3-f37c-4738-bb94-aabfd4da7a2d", "comment": "Malware payload", "value": "5a78427a8efe238d0b08072fdb6fc35363cd43933c25b2ccf8b58a6dbd3ad636bf48e334a7bc26ffd15ea879c7132610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761888, "uuid": "0cc53692-725f-445a-a341-75a52d8f848b", "value": "T116236D1378A2C473C981C5B052F58F29BBBFE53311729517D760252AEE709A1DB2B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761888, "uuid": "116ed533-b613-4e89-ac70-0b566cf4c7cf", "value": "dac47ac32a58b9ff8ab80f814bffa22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761888, "uuid": "eb6c9297-7bca-4ae4-8e8f-b10afe83eb00", "value": "384:StRUpyQcS9Rm7gouRXN7nF3Q9Qv4VPKC23fXoUUEtyW3LpKj/zSHbAA1eK/8gtPN:SitLuMfRXN7FAqgl9WvLw/GD5/8gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761888, "uuid": "f3dc9ec1-8a6e-464e-8f3d-b9ca67ddfd83", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761888, "uuid": "7074c9ac-94fe-47fc-a773-98b3ae852127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761888, "uuid": "56df46de-2cdd-4f92-ad1a-112458b5668d", "value": "SecuriteInfo.com.PUA.Tool.WindowsPassView.6.11183.19561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e96708-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710745708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745708, "uuid": "528540e5-e4b1-4e1b-acd8-102dae28f1bb", "comment": "Malware payload", "value": "1e3084021b9d76729c6432a94a069905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745708, "uuid": "36d81631-3d95-4f8b-94e0-84cf655c9aa5", "comment": "Malware payload", "value": "8da720eb678f8bf8ea9095e47f045137fb3c8cba609a868525e6c2aac207f972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745708, "uuid": "c3c142cb-515f-4757-9bcf-4bbbc711cb3c", "comment": "Malware payload", "value": "2f078c8962b6fd220f4a6a5700aeab7b988b95fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745708, "uuid": "b9e9e214-a384-434f-8904-dee755a9784c", "comment": "Malware payload", "value": "8ced8d7918aaba20ba3a644d9b4fa9ae05fc91caa39ab0715f35ad8a0ccb964322a5008551daee3cf7eb76be3c8963bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745708, "uuid": "ae8eae91-f976-49ab-ab6e-552f68ce5ada", "value": "T16C133B920B34E812E5A48F7489D2C5B90D34FD03A905E94B15E07E877EB7FA3D91712B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745708, "uuid": "f114733b-abfc-4e71-a018-2182181ba740", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745708, "uuid": "b408631a-be47-4dd6-b622-6af3c8c0004e", "value": "384:dZwysCXp86a5kBz7nj6XpNwQrhXpJXpejeQ1RZq6Ni57TK/pKVsd0nYPLLqeMi1:day/LX6X1dXnXJQ1HxNiBuBeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745708, "uuid": "77b51cf5-82fe-43fb-be33-373fb5cc4f44", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745708, "uuid": "d909a4be-caec-4f5f-b311-9b582b1ee8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745708, "uuid": "e9b53dac-eb10-4b0c-a12d-51ec7e030b8d", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3364ca22-e51a-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710761118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761118, "uuid": "28216c4b-c3ed-4904-9339-7c64c4e85c36", "comment": "Malware payload (Stop)", "value": "fa0fdb300f7d2b2f4971908b19796c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761118, "uuid": "c1001243-2ce5-45a9-97d2-115688917951", "comment": "Malware payload (Stop)", "value": "8df072a5fdd3d744912ffd65970e0b8ed9d98ccb234f023a1e81fdfaed81b8f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761118, "uuid": "a0e24bec-26e6-4636-805c-1c18ee2b2152", "comment": "Malware payload (Stop)", "value": "27d73a90e8031934252ddd9067a365767563807c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710761118, "uuid": "e50a3b83-045d-4538-98d5-ad860ee5f5e3", "comment": "Malware payload (Stop)", "value": "207d1f6b3f3cc8eaeb867c647cfecda6f17c230c8c23d96f5ea641cddc0779fdc8698f944a22194f9ace0440b1423138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761118, "uuid": "4fb521d5-1356-443a-b6db-7d8cbb5a1b61", "value": "T15B05F14335E2FC74D46107350F2D95EC372E7CB29E654B4723843E0E2A71AA0EAAB752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761118, "uuid": "25f05a84-64fe-48e7-8195-6319fe37c9b7", "value": "57736d727b019d98ef28404f91500352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761118, "uuid": "48386a26-115e-4661-ab76-0729c00c3f91", "value": "12288:6rULIk/oZJ1XZO27cJFlyo9tPhkkqtXuLUsKue0q+vSftsv3ytugKAU:ajJF/cfHGduLnPMSIfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710761118, "uuid": "2f6a38ca-4a59-45f6-a8a5-79d69d128b01", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710761118, "uuid": "34b1d6d0-eb8a-4716-a815-661087916993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710761118, "uuid": "de3f030a-19c9-4cba-a76f-bb3c29e1ddbe", "value": "fa0fdb300f7d2b2f4971908b19796c47.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9668ed-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753863, "uuid": "394fafd8-d371-41e4-95d4-ad445ba15b5f", "comment": "Malware payload (Gafgyt)", "value": "6ea1416d04dab74c75d35920db31f8d0", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753863, "uuid": "72d35344-2c14-4280-bd40-6497195552df", "comment": "Malware payload (Gafgyt)", "value": "8e249bc3b60fb66a987535c2ced8441cadb0fe81284caa3f8130b3ebf260ccc0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753863, "uuid": "4aff12e6-34cf-4dfe-b742-74130602ac8e", "comment": "Malware payload (Gafgyt)", "value": "9772eeab599f070c0e7fd47f42d04ef75d6f0c87", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753863, "uuid": "178128cc-e7d7-4ae7-85fc-3e10bb86326b", "comment": "Malware payload (Gafgyt)", "value": "d52725d7dadc4c8c41904f9e5989fbe7fac5dbb60cfc5dac5e0fd0e765c40aba57a1038114c6d1d1dfa6dcba80dd8265", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753863, "uuid": "a9995d5f-69c9-44a8-a3ba-bd4e52133e8e", "value": "T1D3F34A06E4404663C1D22BB6B79B128D77235FB997CB3311D9287EB02FE1B9D1A3D990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753863, "uuid": "de8ccea1-f806-440f-be70-90f5e4b0a65a", "value": "3072:dorBzuvjgC/m/rpCK0miDaAOd5hGLH/JgPbetJ8add9QzhsD+xCjeTV8myOQ0LO/:d60m8a9dCzJgPbetJ8addQG+xCjeR8m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753863, "uuid": "612608f4-2922-4cb8-a6aa-0e1bf016ec8d", "value": 164453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753863, "uuid": "9021ae1a-3cfc-4dc2-af6c-19f4af148858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753863, "uuid": "5c8e409c-426c-402a-8f96-4084b1cde303", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2961fa6-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752393, "uuid": "1c84beb9-9823-4b9f-9101-2eff365c3c44", "comment": "Malware payload (Mirai)", "value": "1b9657ab130fb4a73490a8069687fdc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752393, "uuid": "dc8a24e5-1b39-47aa-90f3-963d46ce61ea", "comment": "Malware payload (Mirai)", "value": "8fb0a77018b5fd1b9c8d0753f8129530786e876e2d4690fd1e51701cbe7685b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752393, "uuid": "52c5190e-fc15-4324-9999-cc08fbb483ed", "comment": "Malware payload (Mirai)", "value": "3f183cbf8a8a7dcf491bcc0b40b27827f8ca5a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752393, "uuid": "dce1ad7d-476b-4ef4-99a7-e9ff20ee82f7", "comment": "Malware payload (Mirai)", "value": "c18ce453ddbf5e7bc76db44c393a817bd9513c321bd290a5ad7c0e72a0653f2f9ac8fc31110d4586af869ec4a00862cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752393, "uuid": "faf11ed3-194e-4970-a11b-a20a10b3e14e", "value": "T13B334AD6BB00AD3DF99BEA7F84130A0AF23077951093073A63B6FD935D322945D16E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752393, "uuid": "c01ac61a-bbfc-4c70-a14e-6e765cde9fb1", "value": "768:mWedj2sfZxobchQ/2UMrpw70VxCQvv+EI8uuQYzxVjBw3ivoT8gjbG/:zojZob3ez9i0OuI1uQqVjBoivS8Qq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752393, "uuid": "60e28df4-9544-4fd8-a6a0-250fc4dd44e2", "value": 53160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752393, "uuid": "df31780a-9e01-4d40-8364-986c3e8c7a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752393, "uuid": "7aa090f4-d1a6-4a9a-9b93-cb619cedcd34", "value": "1b9657ab130fb4a73490a8069687fdc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab31df3-e53e-11ee-a120-42010a9c002e", "comment": "Malware payload (PythonStealer)", "timestamp": 1710776646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776646, "uuid": "927155fe-c050-4717-8b05-a5734592442b", "comment": "Malware payload (PythonStealer)", "value": "09e4064c7fadc44d396f5bb1fee0869a", "object_relation": "md5", "Tag": [ { "name": "password stealer", "colour": "#62ECAA", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776646, "uuid": "f0d12be9-68b3-4c09-bce4-c1dfbf78b685", "comment": "Malware payload (PythonStealer)", "value": "910bc0e0e5afd7669cfd1932606e30484751c5cd8de63d37a39716bc039c5317", "object_relation": "sha256", "Tag": [ { "name": "password stealer", "colour": "#62ECAA", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776646, "uuid": "c2efe2da-0b5d-43df-b3f8-89334981c125", "comment": "Malware payload (PythonStealer)", "value": "d7d84ce5c8ba8acb476178dbfa65f25a8547eb23", "object_relation": "sha1", "Tag": [ { "name": "password stealer", "colour": "#62ECAA", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776646, "uuid": "69a752d3-a48b-43d1-8083-e3b6f691790b", "comment": "Malware payload (PythonStealer)", "value": "2e13ed88fe94e37d3c600deb0a049164fcedc75b855c5ceb8b053d9ab0347e1fd8283eb6ba9c3cd13e1f41ea05376cea", "object_relation": "sha3-384", "Tag": [ { "name": "password stealer", "colour": "#62ECAA", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776646, "uuid": "661f8200-fe80-4e56-be24-ee0a4f2d184f", "value": "T1542733C77ECF835EC1ACF43C59F86B70B29493661D33C90C6B4696E7275AA41AA4D00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776646, "uuid": "e10746de-3085-47e3-9d81-f3c5d6225614", "value": "393216:atWdB8u8/PdOJisxnlx/aaYoGE8NXxJdQhJJ5gX5uex0kCFmKBIxRcuuSkDCN6vr:sWHL8/Pd2ig1YpNXxvQDLgpume/MU64j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710776646, "uuid": "3be84e1d-114b-43bb-9af9-f97b91bac36c", "value": 21110662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710776646, "uuid": "5d86b318-54df-4c5e-9c69-373e7e653e93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776646, "uuid": "e59b7e63-c09a-4ca8-8db6-2732c9e26ea7", "value": "setup-x86_64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d1fb43-e50b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710754818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754818, "uuid": "766e590e-0389-422d-b143-4fb06e1ab0da", "comment": "Malware payload (Gafgyt)", "value": "9ed194e2a99d940b78678dc6f46ed659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754818, "uuid": "fdd39afe-91fa-4bd9-a348-a0b888eaf8c7", "comment": "Malware payload (Gafgyt)", "value": "913a34b4df48d63aa559d4358c0aafd055a1ab0205aa535b3f40bf20f01fc8c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754818, "uuid": "fb5ebccf-188b-4c5d-9479-ef1098aed436", "comment": "Malware payload (Gafgyt)", "value": "76728ad620a9e7ad6f4f2daa72fa28b3bdb01165", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754818, "uuid": "20402a67-b689-407a-9854-77b05995ba5b", "comment": "Malware payload (Gafgyt)", "value": "4f9708bdc2190c7a62418f6d6994fabc44ff44e0868958a9e6b8f165224667f4cfe5c989a424221219e9056af8df9945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754818, "uuid": "adc889bb-abaf-4b61-b514-9b0009e2df6f", "value": "T199E33B3727230E63C0C4547212E32331AABADF6A38FA52D7E9947DA86F359443166FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754818, "uuid": "9817e162-5126-4a2c-8ba6-5bb77a9d1604", "value": "3072:GzDmA3tmfloPfDJhtKutJ8adPF4KQThs56POx1a0CudW2Zq07bySQ0VGngf1k:GzSA3ty4fcutJ8adPF4f1EaOg07bySQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710754818, "uuid": "6a392f74-7d18-467d-a316-5caa47611ef2", "value": 152207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710754818, "uuid": "d5de41a2-fb93-4461-ba27-50768e40781c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754818, "uuid": "312def6b-b74a-434a-92de-daa620fcfe8f", "value": "9ed194e2a99d940b78678dc6f46ed659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655f3785-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745740, "uuid": "8608a3cb-dbec-4f6d-a3d3-8c2156743c33", "comment": "Malware payload (AgentTesla)", "value": "f76679a097d8e6c63b89db9bf06d3d0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745740, "uuid": "a81aa7e8-0334-4526-96f7-904d754cd5de", "comment": "Malware payload (AgentTesla)", "value": "9186054821ebdb3ab0b330686697afe855a33742a51456ac55a8b172d246eef2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745740, "uuid": "5b667160-9a8c-4d5b-a53f-6cc0b984173e", "comment": "Malware payload (AgentTesla)", "value": "5de3332f27aa86a5235790527d74d711b796a636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745740, "uuid": "8a48a6b6-98a0-4c18-9835-7236de75e44f", "comment": "Malware payload (AgentTesla)", "value": "6f4475a7c6a5175845845b1c2e1d9cf20e542cf4af1db8d80935d77a63c2ea968f7f38a298d5fd35416c9d1a4906809f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745740, "uuid": "e2cb814b-2b71-4a56-b304-71363ea3f474", "value": "T1D0D423C02B588B73C9648A7B59BDD3809B35E7162079D34E3C6C60CEABD1764DB98D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745740, "uuid": "6d4d8b02-9202-4320-9043-13eabe865208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745740, "uuid": "a8ce0ba4-72ee-4d7a-8789-0c1f177d6aab", "value": "12288:8gRh5I/vgDcfO6H0a2xv2bv51SgvfKQQSp9PNn3QAJdDZUUY7XfkR:bCnVjH0ZWv51SAkSp9PuA7DpEX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745740, "uuid": "41d1aeb2-7fa1-4ef4-80b9-35b79915f88d", "value": 650760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745740, "uuid": "a3e19a20-39dc-4f57-83af-3db328f406aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745740, "uuid": "a9ea6bce-ef57-411e-866e-267dfdcb49c9", "value": "DHL Receipt_21138777109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220db63b-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763237, "uuid": "4b541b0e-bf5f-4bf9-a88c-1376d98445ad", "comment": "Malware payload (Gafgyt)", "value": "887d64692c62e67539cb2dd20d967cb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763237, "uuid": "0d582107-f93b-4b7c-832f-0bf4a1d627c0", "comment": "Malware payload (Gafgyt)", "value": "91f034a8dfaf589b2975e4de2c003497042101d40f8f468eeb0dda9caa4d8eee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763237, "uuid": "4e105581-0503-47e0-8be5-b9db92f57a43", "comment": "Malware payload (Gafgyt)", "value": "27162487d46e83ca3a1c6a56db83f81f86b66fff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763237, "uuid": "3a2efd14-f631-4215-abfe-7dd11bf9a2c8", "comment": "Malware payload (Gafgyt)", "value": "86abf0a7c5682d0fa1e93f6eb0c91f5380d80169ab5b6c5374155ef4dbd980f618f4d43a4fb00e16dfa6cc2effe65155", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763237, "uuid": "1006f2ce-5e17-4537-aed7-d440c10063b3", "value": "T1FFB30856F408DE67F01B963109C76B19B770ABED0F432E32622739669E323C5E426F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763237, "uuid": "a402a1de-94d5-4ba9-af5a-2c7d8484b408", "value": "3072:BFpzhJmg3Q9/gUJFm3tyNVuJ3DJmkK7uTy0UKCM:Bz1Jb3Q9/gdyNkJ3DJmkK7uTy0UKCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763237, "uuid": "4469e935-b760-4b1f-a394-041423f0b17a", "value": 113199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763237, "uuid": "76b3d0fb-7282-4a05-bc66-3b5381fa5f93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763237, "uuid": "8ec5c08c-317d-4df2-866f-9fb14b9f9e9c", "value": "887d64692c62e67539cb2dd20d967cb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cf1081-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752425, "uuid": "186cecb3-a62b-4b2b-8ecc-c80bcb021aaf", "comment": "Malware payload (Mirai)", "value": "2976dd001ae9fe7887385144a6ba7d6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752425, "uuid": "9fc052dc-4ae8-4c8e-bd92-32420d9142fc", "comment": "Malware payload (Mirai)", "value": "92ba50175f2b9d58d32f141bf53229e828898512f8b17f15b492becd94e17d20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752425, "uuid": "2761b03a-0a99-4fbc-a774-44f5be446337", "comment": "Malware payload (Mirai)", "value": "822171ad785324899225057b2a5919fc44ecb828", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752425, "uuid": "6b6502e5-3ead-454f-aacb-6268d7a340d9", "comment": "Malware payload (Mirai)", "value": "ef1f16778a461c4d0ab6342f63d99bd26ecbc8bdcbe9cd5852cfaa3eb6b7838d111ef9a6eafe88b3bcc44432c992fe86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752425, "uuid": "98d9a512-b5ef-48be-9c30-48e2909afbee", "value": "T12C434B41B729084BE1E35DB03A3F27E287EE9E5120F45108795FFB49EA71D31098AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752425, "uuid": "b96404e9-c161-4712-b538-6ecf4ab3fa59", "value": "1536:Pn68iFJHmf88jQ1vNF2F6jF3H/r4N9Qs3WYhQA/H6T+ru:/68OBDrBNqRBhoKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752425, "uuid": "3c3dee9f-af69-43c4-b7f8-b5fe5eee9f38", "value": 58924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752425, "uuid": "0667ab88-05a1-4137-ae6c-c11cd14fd59e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752425, "uuid": "ed4803f8-69f4-4412-a170-12816c203601", "value": "2976dd001ae9fe7887385144a6ba7d6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14a0bc0-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767853, "uuid": "31d44276-66e4-404f-b07a-20bdb4ebc31a", "comment": "Malware payload (AgentTesla)", "value": "f061401dd36dc8e88017ef9f9a43e5a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767853, "uuid": "d05fbb3d-15e0-4c6a-93d9-a2476884fe73", "comment": "Malware payload (AgentTesla)", "value": "935319064e3a30103096a9241c2467b7d19fdbd371d078554a1a7503e1a92cdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767853, "uuid": "c483e913-f380-42f5-8c6e-6ab0fe408322", "comment": "Malware payload (AgentTesla)", "value": "ea4d27815a1cf0f447fab333bdd52825e32807e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767853, "uuid": "11d0a149-6a87-40f7-a1de-663383a09a6c", "comment": "Malware payload (AgentTesla)", "value": "7cb00942bd769d4b65656a6c2a16298a75739ed0ddd69d78a07f5fe894ead5982f75b09e57a640250837ff6ab0e2253f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767853, "uuid": "7573d0d3-949f-4db6-be2f-bf36b43a14a8", "value": "T1EFD4232F36D8A7A1D8B9A7F91F31105123E5E382E088FA690BDA399D36533F50504B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767853, "uuid": "b6886e84-bfa6-4727-bf4d-8a769875d1e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767853, "uuid": "7a81e276-f3a4-4aa0-b9f2-a373583c6fd1", "value": "12288:ripUWpDRbyAAMNPOtta6rE9y4+HQi4ieitahh6j:riaWPbyXMNPOtkIEowi4UtaSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767853, "uuid": "cb68b774-9111-4279-8085-c6ea19f134f4", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767853, "uuid": "b52cd8fa-6709-4f74-81df-68546388d96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767853, "uuid": "2be5a87b-df37-49c3-a6f7-8aaeed0eca4f", "value": "P020241901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09072df-e4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710743397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743397, "uuid": "0b7bcaba-d0fd-43be-b80d-716f0238f7a0", "comment": "Malware payload (RedLineStealer)", "value": "5a2a3883dbb564b4ae87d05707d4cd5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743397, "uuid": "165c312d-e000-4892-95b0-55124ac3aaae", "comment": "Malware payload (RedLineStealer)", "value": "939bd5097a5a1c3d3ecae7d6f90194e47a6d20fa0e7c21d68679be9ea5c65f2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743397, "uuid": "9f94e33c-d318-4830-870f-468d73bb1abb", "comment": "Malware payload (RedLineStealer)", "value": "b277cc5fd2358ba865e011fe9d8c2f89c40a0649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743397, "uuid": "9ba4a116-e601-4a7b-9ac7-d4b8ac9d3ad9", "comment": "Malware payload (RedLineStealer)", "value": "2bc158f7c551bc381dceba9989b56557038545c3ff9d79891eff47557aa46af6654a2b4e7d224a1419647ffbdc2cfccb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743397, "uuid": "156592d1-ae30-47c0-82fd-c441639df276", "value": "T18EE41AA4B25940BAF8E5D2B8F4730B419BF0E52E53879FD71329D25EAC33A81417931B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743397, "uuid": "077bcee1-b4cd-4c12-a3a2-16a3d000b107", "value": "e7d857a6b1d7de1b6c756d2d381fe554", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743397, "uuid": "a3de7762-84ad-4e83-87dd-2274d062b0b3", "value": "12288:2txcN49VQbkeWL/+wdxc38oZrYu1Oi2hZABT5gsMAE:2g4DUOL/+k5u1FaWgsMAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710743397, "uuid": "b7f0ede0-ef53-48cc-be7a-1a0f8af6568c", "value": 693494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710743397, "uuid": "f8a75538-c872-47b7-a4d6-5b481a55b7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743397, "uuid": "cd821418-8f6b-4b86-9f99-774b0f0470db", "value": "5a2a3883dbb564b4ae87d05707d4cd5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e8c5fc-e505-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710752365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752365, "uuid": "daf10a7e-78bc-4447-889b-e0963dcf909e", "comment": "Malware payload", "value": "821725a0344caf3415a1a20d80b9a803", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752365, "uuid": "7c6e1d9a-8b5b-4c43-a9e7-6cb172472594", "comment": "Malware payload", "value": "95604009d773dc1738f9e7b3b6ad323f7953cf8474ad5165f1138500b78497cd", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752365, "uuid": "cebdb840-2347-4ac6-9ccc-657937915aa8", "comment": "Malware payload", "value": "dada39b1d72aa66eb01e4303de74564187c5e7af", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752365, "uuid": "024f8da0-4c79-461c-bdaf-a03c98446f35", "comment": "Malware payload", "value": "2b7d878000281e9354815699a2a880cfc9ce398e47381bd2eee7041ff24550a241f835403e8c2c97bf007cfacd810d3b", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752365, "uuid": "52c0b6bd-be27-4d6b-b2e4-543530dc68ec", "value": "T18523F139E3292940C8F4987C126E1793B996019C4743F9776AC9B90D5146EFB33AFD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752365, "uuid": "fca233b1-9089-4a71-a424-e55d6f435545", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/s:tLq94YV7JMxXyd4x+gzexTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752365, "uuid": "a5b336a5-f64f-4334-a323-c73357327940", "value": 49374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752365, "uuid": "37f2e227-9f62-4ec9-afd9-70db6b0aa624", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752365, "uuid": "0eb8f767-9076-4705-b074-fef68e05b25a", "value": "ACH-1202-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb487f8-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767843, "uuid": "eedfbeaf-d14d-4428-84a2-bb07f8ed871c", "comment": "Malware payload (AgentTesla)", "value": "f9a102868bcd7a4c6779c73d678b50e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767843, "uuid": "ddcde243-7e05-40b1-9ace-510b0b94a6d8", "comment": "Malware payload (AgentTesla)", "value": "959d491cbde6323dc2bf7c377a9c1e0940b988f51a3efcc0f1bd526cc0d210b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767843, "uuid": "36498b6a-f8a9-411b-8b88-be48390cc19c", "comment": "Malware payload (AgentTesla)", "value": "5116f1b9a635c7c884ce558177ebe34fa5d992b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767843, "uuid": "2cbf204e-720b-4dc4-ada4-b851cf7bf1d8", "comment": "Malware payload (AgentTesla)", "value": "fd127c5d7ad34663bd8040292060204c77943fdf2894516999427572b0f54fa8689906b66f7f399f93035d393d3fa608", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767843, "uuid": "8bc99f2c-0c64-4593-994a-d2662b4b4008", "value": "T1B7E412857B244A87C2BDD3F1661694995FF2A0227A32DECE7CC611CE1FC5B801611F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767843, "uuid": "31bbe8a2-445d-4609-aa62-05809ed1d5a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767843, "uuid": "edb65467-1e9d-4737-aab5-2e1e2928ec55", "value": "12288:mlM9hCaaXGx7Q6hFlcODMuNkk21MSXI+ygne0N0scCQAS4kmEJ57chCVseIkR:RUpiFlcO2MRBO0sFS4kmEJ50S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767843, "uuid": "44ed5753-4dd6-445c-b460-03e9a59fde7b", "value": 714248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767843, "uuid": "5c1b69bf-3434-4236-aa10-4e247d4e33e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767843, "uuid": "26bc7335-20cc-4076-8c0f-f4d4c82d5de9", "value": "FVN001-230824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a34df1-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710782993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782993, "uuid": "b949f798-c945-4221-8efc-f5e633c0b337", "comment": "Malware payload", "value": "754f649148d8652914a10f1f20a7fb2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782993, "uuid": "5402ab25-abc0-4bae-83b6-d5ebc8cbe11f", "comment": "Malware payload", "value": "95adcad99b7ae665d4793b761053b8421faed0d00b40ddd004d7486f9d057110", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782993, "uuid": "d426ac94-6fc9-45e8-87fe-471887aa86c0", "comment": "Malware payload", "value": "fd1fef14744d5b88e6f7357174b81bfb34aa8f01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782993, "uuid": "7c1ae60f-9fae-4836-a919-1f6cc5f881b8", "comment": "Malware payload", "value": "5b937cb0f360517c1413010c6eb96219744e788cfe43f809e95772369d9a26eedba3c441a43d4c9b2fdef11fb5e96812", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782993, "uuid": "9fcfe2dd-1521-4abe-9c9c-1f129ed9b501", "value": "T1ACB3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782993, "uuid": "7bd519cc-1989-443b-a93e-9de3625fb9b2", "value": "3072:R/4tNF9U4vvbKw6J73x8UmkiSFxfKxbXe:BUNFK+b8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782993, "uuid": "cded70d9-9876-4832-8077-db1d8a44802a", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782993, "uuid": "58ab09b0-dc2c-49d7-88dd-e545f4f71430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782993, "uuid": "fe471b96-76be-48b6-877b-0f9f19e3a329", "value": "754f649148d8652914a10f1f20a7fb2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373e26f9-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710757689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757689, "uuid": "9a83a630-60e1-46dd-af99-7f38cb555a39", "comment": "Malware payload (RemcosRAT)", "value": "836c979c938611962a9f895484dfbc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757689, "uuid": "eb57e9cb-77cf-445a-93d9-a5e3014a6f40", "comment": "Malware payload (RemcosRAT)", "value": "96b3276c7d34980a39195cdf235b99147bd715655869c3b70692979ddd290d53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757689, "uuid": "7f1d016d-e20a-409e-8736-f824a54f5ccd", "comment": "Malware payload (RemcosRAT)", "value": "4facfc21d42050cd5b9e813a113cda43f6dd6823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757689, "uuid": "e21f49eb-4311-421e-85bd-c282171f4b8a", "comment": "Malware payload (RemcosRAT)", "value": "17cd557496ade52f5f561175d8195c29f94e9722191b2b1dd61cbf5fc927bb725f5e91027d36d8e8487dcdc28d9537e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757689, "uuid": "be4bfb23-be87-4c31-ae50-ce0dac43ddb9", "value": "T12B0523ADB23CD5B7F9240B721DB3D5804333A7161970EAAE0F2B998E764A350DE40D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757689, "uuid": "ffe9629a-84b1-4d58-adf7-d7fadc2e6407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757689, "uuid": "bfa626f0-6233-490a-8878-ec0b8d423cfd", "value": "12288:7EYQqVD80MuI0qqbUdCrDcKpFGbGK38KLbMCCzeDdFHugMVznhDP3dSLHE8X7ArA:MqVAGnUdQD/PGbu2MoHu/DPgHE8XEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757689, "uuid": "d46b941c-83c6-4bf8-be92-fb74f3143439", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757689, "uuid": "71587c8e-864c-4f8b-b433-8720aec9cf14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757689, "uuid": "8589fe5f-ad62-4368-a056-5b573e11460e", "value": "SecuriteInfo.com.Win32.PWSX-gen.30390.16066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53fe645-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741687, "uuid": "3917f4ce-d5b1-4d7f-bc2d-10d8e84ab6c6", "comment": "Malware payload (Gafgyt)", "value": "f08f7bfef59dfff95977ae66bf86a027", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741687, "uuid": "5a508740-f7d8-4a44-99e7-4eb83eb30ec2", "comment": "Malware payload (Gafgyt)", "value": "97d8e0f7a6179702db8467c469b22147261e3c525d3516f8b0ea8907f98a4070", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741687, "uuid": "08f8c7fc-c654-416e-9176-5cfe18bbc803", "comment": "Malware payload (Gafgyt)", "value": "4cd81c7fe8a21e421d418083cfde2b5dd66e2f87", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741687, "uuid": "a067ac0e-ab20-44e5-a885-7bacedb37877", "comment": "Malware payload (Gafgyt)", "value": "df896674cd567cefcd0e5062bc6a3f5dc0db66a790a986b110030507404708d6986a92a75c0854b122d56049bc7f7992", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741687, "uuid": "dbb1e8b7-a97c-4dd5-8e59-0f17ce1f5d13", "value": "T175A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741687, "uuid": "6c8a5150-aabc-44d4-a7f8-9a36367821a6", "value": "3072:7e9h9oZ15hvFfKufS2faYj0+rQ0Knm4XATe:y9wZ15hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741687, "uuid": "3352ff9b-1fe5-4294-aa91-1cabc6474b3c", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741687, "uuid": "81a2b3e9-9b29-4d22-8272-6df1bf650a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741687, "uuid": "d64cd442-06f2-490d-ad0e-be6a033c209b", "value": "fuckjewishpeople.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f448a6-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751914, "uuid": "528ec731-4fd1-4f60-9842-506454d8c805", "comment": "Malware payload (Mirai)", "value": "f07703530296a8a56855909e8c236853", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751914, "uuid": "303eea97-7ed6-4af9-ab68-a25a8861ad7e", "comment": "Malware payload (Mirai)", "value": "97dea5da9cdc746cfc23487b639fe7e4a4b1b6e43e771c1aba2e2f97444fb987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751914, "uuid": "7124b7a5-0256-435d-896e-2fd6972d5c18", "comment": "Malware payload (Mirai)", "value": "45cf7b95a3424e0796613c428ba04a01c6dae263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751914, "uuid": "48232119-29f7-4e43-ba1b-86c0092aae92", "comment": "Malware payload (Mirai)", "value": "34e76d37623c53574d309d326b1f18c0b2675459fd0e5463a797f739bef4ed362ef971e74926489391a795c79d90f222", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751914, "uuid": "f4d3d1d4-1f21-40a6-ab21-064014d99821", "value": "T146134BC4D983E2F8FC1213380077F77ABB72A8AE1175CB93D758A435D6527109A27A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751914, "uuid": "e28faa24-ffb0-4a25-b1d2-54b161695444", "value": "768:JcHCvhec99DnS3BjzjiIp6kAKgcKoLIC878SzYIJ:JcH0ec99DSRJpgKgcTLIp8SzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751914, "uuid": "d6a2e669-4406-4904-879b-661673661b94", "value": 42544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751914, "uuid": "84fc7e44-ad44-4af0-be6f-ff913f03ba7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751914, "uuid": "f5014f06-259a-4554-a2a5-2db4732e5ba2", "value": "f07703530296a8a56855909e8c236853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c9c8b4-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710747051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747051, "uuid": "6aad9374-2823-45bd-9e84-dd161978f958", "comment": "Malware payload (GuLoader)", "value": "ab43026d2cb5471c10e463530e9c6af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747051, "uuid": "d23a7fc5-d1b4-4eba-9096-e378c7b10ff4", "comment": "Malware payload (GuLoader)", "value": "9845e47adb818b782750715818bf6e47883961eaaf623db8c9554c03d371903c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747051, "uuid": "2d01d144-b50a-4272-acd9-a1b072bc17c6", "comment": "Malware payload (GuLoader)", "value": "6886152c3d34e7f09d99c7a0b486840aad4e593e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747051, "uuid": "657eb77f-e6cc-47a3-8759-9f97bcbc59db", "comment": "Malware payload (GuLoader)", "value": "488515dfb24d635e342c7628f9ff2d0f52040052eb54f2b006d34adc1ac7fa8710caf3a1853d6aa449c912d41486a8da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747051, "uuid": "f4598856-73a4-4a43-a8ed-37ffc8dd8512", "value": "T1D6E4234D81ECDA7BD68385326DB26BF7D83FA520302A540F5B283F6EDF513C194469A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747051, "uuid": "d2be8d50-2a8f-479f-9a41-16f2bc2e0549", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747051, "uuid": "bc84f3db-7cc4-4ce4-b2bf-1299a7d33027", "value": "12288:vq3doXphD/ejXq+WCW98QJC3PxC5ZVHa6QhH1CRjU0u3FZWTzgS:QSPZ+D6NCpsZVMVCq0cszgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747051, "uuid": "d7335a30-af19-4a60-8dd8-ceef9d1c2205", "value": 680232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747051, "uuid": "eba04b15-a705-48b1-b9d1-e866dd83f775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747051, "uuid": "7b946b6d-7626-4797-aabc-df4336b4fa4d", "value": "Request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b79c0da-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783036, "uuid": "385aa7d7-3ed2-4394-9c2e-f6902bcb2a39", "comment": "Malware payload", "value": "4cd25a82c0651e543d42389c14dd86f6", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783036, "uuid": "7203c82d-3cdf-4377-8ead-9b8bb1569156", "comment": "Malware payload", "value": "98b5b4f96d4e1a9a6e170a4b2740ce1a1dfc411ada238e42a5954e66559a5541", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783036, "uuid": "0ecbf148-d47a-457d-af99-5c7e95810cd5", "comment": "Malware payload", "value": "6d4dc35c0d70a8ca90b87c39e644db36ce29e232", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783036, "uuid": "23e22ed6-1761-4daf-95fe-88fa33a911b8", "comment": "Malware payload", "value": "49ab1e8ac691be53289012b90af7a5169c77376379d655b150bdc142a9f1061ae435f453f663789b5c6cef6c58fdd320", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783036, "uuid": "d634a56d-4886-4a0f-8556-4fba557e5191", "value": "T18F44F857F2FA14BDC44EC4B001DE2679C5E0B81899A57EAB2280FAF11BF2B906F54747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783036, "uuid": "ff5806e1-2b75-4d06-a3ea-0b729e40581c", "value": "6144:EQPczBa3vgEvQN9glnA1wcP5g2GQOO/3xsk0M1l3H99zZnI5:2BvEvqR1jPKQDZsB2l3H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783036, "uuid": "6b991898-8a22-4f7b-8cc5-0df32362ab9f", "value": 273528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783036, "uuid": "5286e89b-4000-4fbe-b7b2-ab33336a1d95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783036, "uuid": "509d2688-e3e9-4904-a482-54a5c0a052ab", "value": "4cd25a82c0651e543d42389c14dd86f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35b12cf-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710769547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769547, "uuid": "90cea5f6-5853-46dd-837a-27f0474401a6", "comment": "Malware payload (RemcosRAT)", "value": "ec8d5ba6cc6d7b51fda7f9b7f7c1c42a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769547, "uuid": "0b0757b7-b6ac-4be8-bb8b-8b9c201461ba", "comment": "Malware payload (RemcosRAT)", "value": "99ad9fe4c0818bf345e89f7bb15a11bfd2c2888b6afab1ba461f60b0a629da1f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769547, "uuid": "1463e98e-fd4f-4f30-bf5d-9b4b9d5fb1ff", "comment": "Malware payload (RemcosRAT)", "value": "5580337642cbae7792123a082b35121391538721", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769547, "uuid": "68df8400-f59f-4659-a3a2-a89b31518170", "comment": "Malware payload (RemcosRAT)", "value": "d2574db23210277d4f54cfa6f37bc8c6051ca58206cd089c4844dbae928817ad798d64037917974d8da6dafd2b80ac99", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769547, "uuid": "a802b992-f268-49bb-856d-34fde6db9b48", "value": "T19A053306DE7E9AF2C7A14E56B6A20695DB73249C0772D588C3E13D3088DA77C4F6432B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769547, "uuid": "f195efa2-6d9f-4c59-b92f-b358906bae34", "value": "24576:mdr398n7r2NY6gQ7lkD2PI4WQxQ6H/XkK17Me:mdr39Q8Y6giuOhxQ6H/XzMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769547, "uuid": "e91753f2-ee77-4771-ab6e-52b6f54833b7", "value": 864046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769547, "uuid": "e10ce70b-a67e-4167-a1ae-8eea246def02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769547, "uuid": "2bdf256e-356a-428e-9a63-73aec8900c8e", "value": "DHL AWB_NO_907853880911_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c955a4e3-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749344, "uuid": "d4655718-d6fe-4167-8d69-2c4fd76705fa", "comment": "Malware payload (Mirai)", "value": "43ddc4b481b3b1499010ac173f4398a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749344, "uuid": "e62b3aae-ffea-4437-a1dc-3e2a646589ef", "comment": "Malware payload (Mirai)", "value": "9a34fb9eda2739469f6085d8e4063488fe5e31005422c3ab04fafe6038c0d308", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749344, "uuid": "c3947aca-f8cd-4425-b96c-55b08d8a8c32", "comment": "Malware payload (Mirai)", "value": "1e37b04f413dedacf5bbe4f8058c0381f76ab764", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749344, "uuid": "e8715826-672e-49a8-8a82-8f8ad7926431", "comment": "Malware payload (Mirai)", "value": "e4195f344e70052fbd1d379e7cf4f61d9747c7012092ed474b0143f6bed3558ddf7608ed744820828e5328b730e2595f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749344, "uuid": "19cae784-f986-4528-8a5a-8bc49774217f", "value": "T123439E37C4286E88D59A87B4B8318A745F63E04891877FFE2555C26A9083DFCFA063F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749344, "uuid": "b6a65f3e-4287-405e-9344-221496bc2e9c", "value": "1536:KaNwt2SfotDmc4Q/yvK7PEx53fPHTC/083Sr:KmWfW748yy763fPHT63Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749344, "uuid": "4ef6e2a0-34c0-4fdb-abcf-28d0a2801a77", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749344, "uuid": "7a2a4ec4-60b6-4db1-966a-3e06c6ec0347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749344, "uuid": "39f02acf-d522-43dc-a0df-96d63fd6ce06", "value": "43ddc4b481b3b1499010ac173f4398a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b601cf2e-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749312, "uuid": "663337b7-fb02-4aed-a137-3e41901ac1aa", "comment": "Malware payload (Mirai)", "value": "3cb0f449e93687cfb43dceffe1883787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749312, "uuid": "c4b7e3ad-0a15-4b3f-9d81-6731896e9ffc", "comment": "Malware payload (Mirai)", "value": "9bdb209287bab18bdf26797796a4c350c80e0149bdd35f270eda0fa11a18eb2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749312, "uuid": "b7c2ae49-fe36-4797-a2bc-725fd99d110a", "comment": "Malware payload (Mirai)", "value": "626b0faf7833712df6b9dce5deb19da2e4d18cca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749312, "uuid": "03991f4f-7345-47b3-8313-4a177d2a7d52", "comment": "Malware payload (Mirai)", "value": "2ea4ae6421c6054e7acad1cc31cd0849d767551f714597b0ff58ebeae9f343a3cded12a03375202ec50d90f4df2a12f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749312, "uuid": "871bb97c-bc6f-4952-9e35-121bb19e3325", "value": "T1DB031792B8925A6BC2D013B6B67E429D3371B3B8C3DE7227CD109B20BB9550F0D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749312, "uuid": "91a71d7a-bff2-407f-b506-706247f159db", "value": "768:FKnEFAzln3rwEuzsL/fcvTrgOginPJfeCrpTthH++ojqcS0oeP5YCDw:Frin7wxz4QgePJrpn+3jPSRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749312, "uuid": "cfa6b3ae-a65e-467a-a263-0dc15d78b3b7", "value": 40968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749312, "uuid": "85a15e71-8e2b-416c-bb9a-3681ef360481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749312, "uuid": "10ac5e14-3a0a-43f0-8af0-cb990bb24536", "value": "3cb0f449e93687cfb43dceffe1883787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c487b-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749284, "uuid": "4477cd53-d105-4311-9d68-b61133939179", "comment": "Malware payload (Mirai)", "value": "45e27d8671b68e73bf87ba914f8c2ff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749284, "uuid": "a287a40c-4e9c-40a6-9e28-3ce7ace64973", "comment": "Malware payload (Mirai)", "value": "9c3349f45596be30b85608ea0276150e87b226c3080c0e357f1dd65b283c2bc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749284, "uuid": "998e37c0-b22b-49db-8a23-cb4678297b91", "comment": "Malware payload (Mirai)", "value": "3b487f3aad7f931df9c6535acb180342cdbb52ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749284, "uuid": "63ed54be-bbd6-42e4-8c9a-975ab5f24859", "comment": "Malware payload (Mirai)", "value": "eff35136d16f67588b25aa06336e16370d266db88924efe85b94bab96331df539e3241b012af9f74f93160fe829e31e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749284, "uuid": "8a5267cd-8e32-4acd-a20a-f188b748b89f", "value": "T10383F805BF514FB7E8AFCD370AA9170124CDA51B22A53B367534D828B64B24F5AF3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749284, "uuid": "ea25f4d6-36e9-4077-83d5-3c9a8193c0c6", "value": "1536:PnHTmE7JiYwVKG0D/j6okNh5ZgGj6OEI5JG:PHTmE7dB1kj5PEEJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749284, "uuid": "91603aff-72df-4942-b737-70156cc59d3a", "value": 84892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749284, "uuid": "bd54c3d1-938f-4407-87ef-a8f4798f772a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749284, "uuid": "0ab1cc38-2388-4be2-b2ac-7b5251261d73", "value": "45e27d8671b68e73bf87ba914f8c2ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c3e2e3-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710782976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782976, "uuid": "bbbdc283-b229-4da6-b5c2-c8b10c597034", "comment": "Malware payload", "value": "2b97150e559ace501977af99d5a041f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782976, "uuid": "0c6a8e9e-d2d5-4a6c-b8f8-b5f4e53ace42", "comment": "Malware payload", "value": "9c767e579c7b0729d48adcfabcc6a3bc703cde0844795d7e06f4aaaad0ce9c4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782976, "uuid": "a66cc97d-9ec5-4d54-b993-7eb2a988cf83", "comment": "Malware payload", "value": "5e3818f779c1109baa9132205dc1dd245547dd70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710782976, "uuid": "c88be587-a46b-4a86-a391-0b0b8555c963", "comment": "Malware payload", "value": "06b75bd61787699bb509fd534e291c0c9e871d5ed93160d6d7b610378cfe9e0613041e158ffc327accff74e5ac2a0992", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782976, "uuid": "4a7216c0-fb4d-46d1-a279-af127d8862e0", "value": "T103831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782976, "uuid": "cd078054-12c5-42ce-9399-5ad4eed635eb", "value": "1536:BQOc40ozMPjej5qckA39ikRFaPnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BqrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710782976, "uuid": "fd23befb-448a-4ee8-b833-e7214a8a2605", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710782976, "uuid": "543d850c-3e71-4fcc-b4cb-f7c80342e7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710782976, "uuid": "b73b504f-a43d-4220-9403-daf81fbc3e07", "value": "2b97150e559ace501977af99d5a041f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf59656-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1710741430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741430, "uuid": "ab4d3ff6-fe92-4fd0-b828-40fc6eef51b9", "comment": "Malware payload (Rhadamanthys)", "value": "9c6f7aa0286bf0f7f65f2d009d743bb8", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741430, "uuid": "aa6802bb-821b-4911-8955-3c2191cc8c88", "comment": "Malware payload (Rhadamanthys)", "value": "9d16873adcaa931b05b400ae21edadfc1f4a1cbf456f46e68047c6a29fc1a186", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741430, "uuid": "84d8af43-20df-4669-a90d-3a7be63415f3", "comment": "Malware payload (Rhadamanthys)", "value": "41c44f80d8d9056279d313f6c0256fedf3300762", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741430, "uuid": "9d7928be-7930-4f10-8609-a50ae7e4bec7", "comment": "Malware payload (Rhadamanthys)", "value": "ec6b421ee7c32c064cafbc4a3b47580a47386ebad014f1501c6fb8e7d3bb520bb23896e2c7bfaa9e7480e8de05d0bbdb", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741430, "uuid": "df81e5bb-11c2-4511-a902-63986de90307", "value": "T17F6633CFCD7127736181732F702A47696476D856B2A236AAB2E444071307E6FEEB132D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741430, "uuid": "9cc74ec8-8759-44b5-8368-a9618480bc07", "value": "196608:Re+uedmm3A8wJQwoSrvePEi5BF5Q9BcQbTOQY:Rbt3V0ZoEvgEizjImQPOQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741430, "uuid": "cffa17d3-bbe9-47db-b995-3541a6680800", "value": 6894734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741430, "uuid": "9a722dc6-c1d3-4562-8db2-66981f6505ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741430, "uuid": "249dfa2e-fc95-416a-be46-a54c2a2bc266", "value": "CheaterRun.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6925e9bf-e530-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710770658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770658, "uuid": "225ab84c-212a-454c-9075-82e26550a979", "comment": "Malware payload", "value": "0f7bde1fdb5bb27eeb765250e2131d1f", "object_relation": "md5", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770658, "uuid": "4b794325-ada9-41da-856c-44b164e3f8bf", "comment": "Malware payload", "value": "9df97085c71592e97c06ee2923ad1a732e6b08943c2e58a216957ba301f621ff", "object_relation": "sha256", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770658, "uuid": "7eab61f5-1554-40e2-8209-f656c27f85ac", "comment": "Malware payload", "value": "8292d5355df900103f7e759f00dd9d8478680cfc", "object_relation": "sha1", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770658, "uuid": "beb219c3-8207-4d35-9db1-52724f86eb72", "comment": "Malware payload", "value": "94acfc418ca72e7fdee8768f65a9ce02fc43dfa0da606beb2582e1508a62db45bec344f7a25c9704927e6b891ee1b562", "object_relation": "sha3-384", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770658, "uuid": "6cb68f3c-49bc-4755-8947-69e1123aa6df", "value": "T1D9722AC6EF820FB1CD1945F83B73C6A8943F71306B1A91A79750485D08BD5D8E92CA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770658, "uuid": "aba69254-7e54-4789-8761-5bd46f1f4c7d", "value": "9e0dc1c127579ff7b74c15fbafab7c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770658, "uuid": "29cc3a85-1835-4340-9ccc-33e66a07c7e2", "value": "384:oVMB/rTq/X+4sEFqZHxI7WJPmKtjtPoc6K7PwPe:TxTcX+4sEwhxnPmcQcr7Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710770658, "uuid": "64b5dd18-145e-40be-b1de-ece8ff5ab367", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710770658, "uuid": "6c33e6dd-73d7-4035-9ed1-2da3ec701abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770658, "uuid": "91ed69f8-b526-4bdf-bc6a-517cacc65318", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2483dd3-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751963, "uuid": "cde6a563-5b49-4bc7-8bd3-5f10b45640a6", "comment": "Malware payload (Mirai)", "value": "e8e64fc9b8d316678d7bcdfb15882b1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751963, "uuid": "14a0060f-52d7-48d7-8d4e-093308a3d88f", "comment": "Malware payload (Mirai)", "value": "9e3c4af0c0a919713dce0bfd8b8c227aa96dea159cb8e017474a82884f1a3b56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751963, "uuid": "d734358b-276c-4e8e-9fdd-53f55be869c9", "comment": "Malware payload (Mirai)", "value": "0e1e33e5a0a540a694593830d2d2f59685080a0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751963, "uuid": "d81f01d3-45c3-463d-aecf-23504da8312c", "comment": "Malware payload (Mirai)", "value": "732b2fd96b12bc4521d2594178ad0b2190ba9503c112e73e9466b879d9b79db8079a8af2c4586abad697538d29585ef0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751963, "uuid": "40395ebb-5edf-4f6c-a838-2e45ed2768a6", "value": "T1AF43D655BCC25A6BC5E423BBEA6E518D3331A3F8D1DE3217CC111B24B68952F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751963, "uuid": "4c1d8d0b-c7df-4999-b2a4-d0db74fbf302", "value": "1536:jhZAFs6myVyXQPL5zcKQrrFRQvVlG9Ww3fxHMd42+m:jhZbMrgKQr/QvrG9r3JHsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751963, "uuid": "c362055b-4901-4f65-b955-7138c1cda3a9", "value": 55564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751963, "uuid": "b5f52aef-9a5a-4812-bd86-030d2dcce379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751963, "uuid": "bcb7bf37-dd85-4408-92a6-27b310d81086", "value": "e8e64fc9b8d316678d7bcdfb15882b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2855f0ab-e528-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710767113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767113, "uuid": "cf60a338-beb8-4c9c-a869-9b537b5d1510", "comment": "Malware payload (RiseProStealer)", "value": "11244c83b8d99c528dad9c9b1c931810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767113, "uuid": "9796989b-0398-44b0-8381-f4ab5dbf5ada", "comment": "Malware payload (RiseProStealer)", "value": "9e3cf89b1298e295a70282111f9446f5000f40de34dfc7c5fe28fe6e03073e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767113, "uuid": "123d2045-4dba-4b8c-9f46-ec17a9c9fe91", "comment": "Malware payload (RiseProStealer)", "value": "9c7761ab1446a861bf0d9b59b50da4ad18f05d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767113, "uuid": "5ff75b68-36cf-488e-9177-56c132c5c6c1", "comment": "Malware payload (RiseProStealer)", "value": "63be69219616dd51a3c0951458cb1268cf943891c2f69c3caaf8b5d5467c7ab8ab90e4d535c0720427ee6a5eda5a39aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767113, "uuid": "1ce8e1a4-fbcd-43bd-bbbc-24c44272987e", "value": "T193E56B72B605B1CFD48E2378442BCD426A5D43B84F2409D7AC6978BA7E73CC616B6D38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767113, "uuid": "69744ae9-1fa1-4380-8a13-3a2aaebc8b36", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767113, "uuid": "acb9e8dc-4256-4977-b204-2ada033a3d65", "value": "49152:8GoD1267+whyW5+FWkxBqfJjQLYmXQsQU4gnstkHz+qQzzzVLZxWJXaMZ:DoBn6wmFWkx8fJjQLYmgsQUlsGHazD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767113, "uuid": "ae699130-190b-407c-b6ee-2afac62dc264", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767113, "uuid": "3d249a3f-fbc6-4609-bf6d-7558a38872e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767113, "uuid": "55331142-6cbb-4939-8a59-b2ec6e43a8c4", "value": "11244c83b8d99c528dad9c9b1c931810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3afbd5e-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727403, "uuid": "1bb10340-bbb8-457a-b7a4-d24c8129ea93", "comment": "Malware payload (Mirai)", "value": "d6b4b2030c379dc2ca95d7a54f76d1e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727403, "uuid": "40b98504-6e7f-4e14-8fa3-80bcde5d8353", "comment": "Malware payload (Mirai)", "value": "9eb8d57dac4a0f2696167cdd2aa2e2b9642b64612cb9a2830674e26423486215", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727403, "uuid": "e21293ae-e1a2-4284-b76a-a8d41281df49", "comment": "Malware payload (Mirai)", "value": "e6de461880e677a12e06443fb97b6f437819530f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727403, "uuid": "a44a12c2-8af6-4f92-801a-2b7ea81ed889", "comment": "Malware payload (Mirai)", "value": "69faa37ddbfcfb862e26e83e3d772859a5cd13dc4702b020f6fe06ca07e4144bf27db131226540d62388770f534a150f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727403, "uuid": "d2626c71-8581-41ed-b562-a2a42b31907b", "value": "T1BDD30845F8405F23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727403, "uuid": "5aab7a00-999f-49ba-8e91-5d140f11db56", "value": "1536:1HQeHIjFlGz/r5BpR/lFcAPWZf4VTyqsTgDNAov3Lu2/IRd2lF0twyw2FR4comim:1HQeFBn9FcT4YZMDNAoxAREYZiH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727403, "uuid": "bb449cb6-3914-427d-b3cc-19a4ecdca5c0", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727403, "uuid": "1c1beca1-82a9-406d-a7cb-4cd8311afca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727403, "uuid": "84cc0981-6a6f-40dd-8c3d-b622fb47cbb4", "value": "bot.arm-20240318-0203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469af1f0-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710745689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745689, "uuid": "eb3b54c8-798e-4355-89fb-3cbee54b043f", "comment": "Malware payload", "value": "f1a798eeefba3feb3d6fd9148cdc3262", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745689, "uuid": "64c4eed1-4e78-4ad0-91dc-8cad7364b7ee", "comment": "Malware payload", "value": "9ed0d30922a9f3605ede808733d1322514815900128838fe9ce02f2418ee536c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745689, "uuid": "fbf05bb6-4cb2-4345-9216-a99ed8fe0b87", "comment": "Malware payload", "value": "968532fb41de3b207c432a50c6b88f60976f609f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745689, "uuid": "5872de2d-b7bc-4d22-bb53-c77f32118020", "comment": "Malware payload", "value": "fd9d9b0e5a2138319b9e453db8390c59d48e20a784c61b4fe8e2157e468d39555d0ed649c6ade04d0fcdcb3372d52392", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745689, "uuid": "17e1834e-66e6-436f-b76d-286008ca91e2", "value": "T14726972BD48610D33B0873D7530B5A8289A3EB372EBA9A9567C0105C0F7176E7F646DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745689, "uuid": "c3af42df-ab37-4114-bd26-be78658e047c", "value": "49152:GrdThEtIOng2sZAcgJTcPJne5hYSM/wDX1+F1vLgd:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745689, "uuid": "9445655a-cb00-4dad-bb28-7b44d762e3e2", "value": 4439959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745689, "uuid": "c79029fd-1ab1-480a-b80b-3c97f63202ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745689, "uuid": "3af60df6-62dc-427e-b1c8-d6bfdd1855db", "value": "DHL - 1ST PAYMENT REMINDER - 1003706339.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760285be-e50c-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710755217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755217, "uuid": "e2e51381-6102-4aa7-aaad-611d4d0a71c1", "comment": "Malware payload (LummaStealer)", "value": "74a769cb098545db9d966e142704dfd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755217, "uuid": "11caccb3-a679-46d6-b50e-ab102b3f8cf9", "comment": "Malware payload (LummaStealer)", "value": "9ede60df2413791861f64add22036616f5c19d09d1cb4f39610e61492f15a344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755217, "uuid": "6f676e03-806c-4479-9dff-932d7dd81bc0", "comment": "Malware payload (LummaStealer)", "value": "b09b7c86ddbb44a35a0c0aef6ba8d90bb6a57b00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710755217, "uuid": "5b7b7b28-f99c-4be6-80b7-b67d0f23dbce", "comment": "Malware payload (LummaStealer)", "value": "e16b95d3884de48a0c2680c696478998d117795977259e351ba1aa03ff68060487f4396a9b17139435895e9b241028fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755217, "uuid": "2f7ef012-99cb-4046-8386-d368619382c3", "value": "T14936AF86BEC6CC11C1596B33C5EA782853746FE19307E61F3AC16B9D3A9333A0546D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755217, "uuid": "3687016d-a4b7-48c2-8530-20104cca0977", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755217, "uuid": "874ec83f-a863-4183-b6dc-587ecbd700fc", "value": "49152:rVoCM+SU++6xwxndn7tvtdGxDg3qY9R9ca1DLeY9at+8R86zL8qeX82p/6sozz7v:rVGxwRRma1DKd+Q8yLK886JzJ8ZzQ5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710755217, "uuid": "c8fcc949-46f5-400c-b3b4-3a1bec4d80d4", "value": 5174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710755217, "uuid": "cd94a673-0be7-4d12-8def-35c984f3dcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710755217, "uuid": "1e38f662-2400-4d18-91bb-889e379e3a94", "value": "74a769cb098545db9d966e142704dfd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15074a0e-e55c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710789414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789414, "uuid": "66fd665b-2a89-49b5-a634-272e8779add1", "comment": "Malware payload (AgentTesla)", "value": "9689f366906e43c9b10fcc247a7f34ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789414, "uuid": "bd1367dd-8390-4806-8a7a-6b3a929a1a4a", "comment": "Malware payload (AgentTesla)", "value": "9f172db7ed366ff9f5862b467b80202720badaa722712c38f880b8e9a80093e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789414, "uuid": "2db5224c-cf2c-422f-9f0c-3a5ee0b0f18f", "comment": "Malware payload (AgentTesla)", "value": "950ad590a4a8c26b485da87777a6c89591259e55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710789414, "uuid": "2673c6c9-f2be-4440-a47d-279008e793e8", "comment": "Malware payload (AgentTesla)", "value": "45c6db7710b9640b045c1c6eb0765ec237452dd1c7f746f106b6e4ddd83ad4cbc571a65e9037b3198f0bb7b8a668dd6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789414, "uuid": "2b61b016-6496-4aed-9c31-1c47cb4ec9c6", "value": "T1E7D4221476F89332D89DABF24751818007BEBB53E822E79C5DC1E1ED7AE2710E61294B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789414, "uuid": "0d0f1bf2-461c-4a9f-bd4b-5980ab9f29d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789414, "uuid": "cf15ec97-eea7-4046-b9b9-44e07fef66ec", "value": "12288:IQgRhFPz0sFKRExbKb7ucBIgzja7MWuPqzcCaYDE6llm:InhJKR66ucna7AeSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710789414, "uuid": "1ed1bc00-a106-4d1c-b2d6-a493c025e659", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710789414, "uuid": "a5fd5a19-345c-4bdb-a84e-763be34efdb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710789414, "uuid": "659e0d5f-2928-4a37-8101-fbbf1c78c864", "value": "OT 21051905 COTIZACION 48948.Xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c558881-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757697, "uuid": "77d57595-5c27-4634-a9c7-aad29629dc19", "comment": "Malware payload (Mirai)", "value": "9ee9db97d8700eed890662bb886ed1a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757697, "uuid": "7b878cd2-6c3f-4551-b74e-fda793929d03", "comment": "Malware payload (Mirai)", "value": "a00bd69bf2567e4711ebffabd66b3cc790cb6408ab8f75d85b1aea02b3a2c1ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757697, "uuid": "77140d75-c69e-407e-a46d-bcb133d866ee", "comment": "Malware payload (Mirai)", "value": "024f1b895a889cb9e419d86ba9922d5b53a1d441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757697, "uuid": "e8779e50-123d-425a-b8cc-25b92868aa2f", "comment": "Malware payload (Mirai)", "value": "16adb1c3e8303a6eacf3e2a246208f9e2d28a619c078cc1ed32e3927692b2c036fc8e38d5f141bfd450f0cc6c5b3feff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757697, "uuid": "88b78065-3022-4c4c-ae15-934af48c68e4", "value": "T15333F1BC6B0286D7C66581B57EE013F122DA2DF57D87810751FCAAE19E430E639A3390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757697, "uuid": "b484cb08-d6f4-4842-9562-2a6fb3e73012", "value": "1536:tMCdsFiTv0dQ+JERlR1D/Ca5XOIRWQYKLXNEEVJux:RKk4leRfZC+DLOEVQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757697, "uuid": "6176318c-7db2-449a-85b9-2c50205482ae", "value": 54700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757697, "uuid": "055e48c5-24ce-48d2-bc4f-738bc92c0f7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757697, "uuid": "23735b77-ca0a-47e4-a4f1-0bde5d3477eb", "value": "SecuriteInfo.com.Linux.Siggen.9999.2504.21351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb7cb92-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749326, "uuid": "fa0fa4b8-c182-4306-979f-b571e61145ca", "comment": "Malware payload (Mirai)", "value": "ef9774daa998e4018e141444568618f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749326, "uuid": "95ecb881-567b-4ebd-9f31-243b4a7a56ff", "comment": "Malware payload (Mirai)", "value": "a290495347a0aab3a0007495df7e2020bc3eacf90180aa64544bc87e3bab990c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749326, "uuid": "32b11295-04f0-4a3e-bdee-875b4de7cf2d", "comment": "Malware payload (Mirai)", "value": "a6d8b664be9585804b8d5560a2b108ecce70b7fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749326, "uuid": "3cbe61da-f2e7-42f3-8a4c-f6a5f3a1b4c3", "comment": "Malware payload (Mirai)", "value": "fbd8fdd6d8bd53892ce74623cedfaafe620e1333ec11dec47d9cecc4f5c161fcc1c091df89da73596d313f78b3f9e37c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749326, "uuid": "b32424aa-e58f-4401-9a44-903815753552", "value": "T19F332AD6F801AC7DF80FE7BA4413091DB671B78102831B3667ABFD93AC722995D12E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749326, "uuid": "3c5fe1f1-3668-4924-a175-0cb0952d3362", "value": "768:ZtC1e1nyDB/6kx5rpOawVBq/O86YuH3A3l7A5t3B2q4wR3nGd:ZtYMnchx5rcawVBKO8tu2l7A55Bf9Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749326, "uuid": "f998f299-3ab0-4a0a-ba11-53b94067401f", "value": 51164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749326, "uuid": "7b92f693-756b-4756-af9c-f93aa518dae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749326, "uuid": "7ea814af-0110-4a9f-ab41-129204a3f932", "value": "ef9774daa998e4018e141444568618f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c59fc1a-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783011, "uuid": "cf7a295a-4551-46d4-b494-f46dac64f6da", "comment": "Malware payload", "value": "20b4ac6be041b72862e1645953a951eb", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783011, "uuid": "6b9df441-9f1d-4122-802c-128020675ec6", "comment": "Malware payload", "value": "a2c3073fa5587f8a70d7def7fd8355e1f6d20eb906c3cd4df8c744826cb81d91", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783011, "uuid": "f10edaad-dc83-4bad-a349-a10205741186", "comment": "Malware payload", "value": "dd5f99687aa953b422f27035b13398bcdf8e0401", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783011, "uuid": "456cf15a-7d63-465c-8ddf-31deab3ed8ad", "comment": "Malware payload", "value": "c61dbb80cf21a15caecdd01fcc3898def413d5fde6bc2bcd791d5efc73828fcc4fd164731059d8daea34fd22a318177b", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783011, "uuid": "c0e2dc02-b2fb-4f19-b79e-d2bc8d98b7d2", "value": "T11E640857F6FA08BDC08EC47001CF2639C5A0B81589A53FAB2584F6F12AF2B946F55747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783011, "uuid": "2ac66b80-50cf-457d-b55a-2a0a00615ad9", "value": "6144:SQPczBa3vgEvQN9glnA1wcP5g2GQOO/3xsk0M1l3H99zZnI51z49Q:YBvEvqR1jPKQDZsB2l3H9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783011, "uuid": "e6b8e12a-5cd0-431e-a8e0-36e9563d7b3a", "value": 323016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783011, "uuid": "3613a089-3fd6-4572-8278-77809b01da88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783011, "uuid": "c449cabf-4024-4eb2-86b6-d7b107e36ef1", "value": "20b4ac6be041b72862e1645953a951eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd99b3d-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765998, "uuid": "769dcdf8-95c3-45d7-bcf0-4e75493f0ef2", "comment": "Malware payload (Mirai)", "value": "b0012b9645961d021e2f40c99250b434", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765998, "uuid": "f06234a4-2a3b-40fd-9db7-e51a10ca7518", "comment": "Malware payload (Mirai)", "value": "a37904d2bb13fb5357ed5f8bc3fc69ca0eac0443e58b39ce487837b3ee34f98f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765998, "uuid": "80cf6266-6866-43f9-8555-cc40ce80088d", "comment": "Malware payload (Mirai)", "value": "0b548c965dc94cc6b930a4873974d354b5216cbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765998, "uuid": "84e039ff-08ac-4a35-afad-9efdc7ef6886", "comment": "Malware payload (Mirai)", "value": "d771ba7e8789620926194315ebe987f186d21af7cf60aeed683f14ae3276315f9f1b9ef9f0c3642fb4d9621a479872b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765998, "uuid": "4954a513-734e-4909-b1c0-f1b41a5d21d3", "value": "T14D53950AFF610EFBEC5BDD3709A41B4A349C650A21A93B357934C928FA5A60F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765998, "uuid": "114a599b-09c8-4a2e-af56-36ed706ea8c4", "value": "768:OUnR46fhVePQTRlx8V2Emw2HyTQOUy84rNheOeWzerSZ7JQGMXiZsnr1n3JI5oB:O2mPWnx84qqCUynD/ziSZ7JBSrA5oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765998, "uuid": "88951ff7-e0df-41fa-b4ee-abbba3f70097", "value": 64184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765998, "uuid": "e7e01ce8-8ebc-4ab9-b8db-8303f1095770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765998, "uuid": "4041ecbd-de28-4105-bacd-7b030a1b3189", "value": "b0012b9645961d021e2f40c99250b434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b30fee-e4e2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710737388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737388, "uuid": "66d57296-495a-4917-a509-ce79440fab9e", "comment": "Malware payload", "value": "b6e7e5592b914ed29149bc605c0e4b0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737388, "uuid": "6589cfff-719e-4f29-bd28-c696fa8165f1", "comment": "Malware payload", "value": "a4071bcbccf061ccae8b89c4e87353fd3a2db2bc2e3ea97e7b83fc9391b271cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737388, "uuid": "989c0221-10df-46f6-af29-58b3b93bca7f", "comment": "Malware payload", "value": "a2aadfe1e05815ffc2ccf26fb496967d61ffd796", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737388, "uuid": "41386142-68ee-4db3-8f06-d76f2022db95", "comment": "Malware payload", "value": "bd70255bdf12e373689aa7116e2db9f45e9a0f045dfa002c9e10b850c7ceb809b55707ca126d35e7df880349d66e09d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737388, "uuid": "8c1ea0d8-ff2a-48fb-9bfa-b2566cc42808", "value": "T1D3E44AD076984A23C45E72F6417BCEC187E5EC22428AF30B6872B2A616B57D3DE151CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737388, "uuid": "6bf9d9c3-f73e-4c7d-b096-5a50f49df379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737388, "uuid": "793e36f6-78b9-450d-b9ef-f29cd6417620", "value": "6144:h2IbZ0/MfzVflxpQUpQR3jPoLSLFw1ojIoo2hqnYDMwVaeVSqpQ:h25EfzvQ8Q9wLcFw1MIooQYFwxVbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710737388, "uuid": "9e7113be-3480-4d80-8b11-b9f6b3c53a7e", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710737388, "uuid": "26f265cc-6bec-479f-acae-11cd3b072c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737388, "uuid": "a175e71c-61ab-4fbd-81a5-8d23e9a8c18d", "value": "b6e7e5592b914ed29149bc605c0e4b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd1d662-e553-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710785830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710785830, "uuid": "ee6181e5-a160-414c-ba3c-a0943e63ee5f", "comment": "Malware payload (RedLineStealer)", "value": "8b79949eb899e62cb4f97d296063fbd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710785830, "uuid": "b8796c0e-18f9-4d80-a12c-ea783cf7ed8e", "comment": "Malware payload (RedLineStealer)", "value": "a5839e451e46669765657efe3fd5919b730b7f5db1c0ecd932005a3bb9dc988e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710785830, "uuid": "7ea4fe47-064c-4965-80fc-581362f271b8", "comment": "Malware payload (RedLineStealer)", "value": "830b3c073aa483483ad34237bc0b0e0e3dd579d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710785830, "uuid": "a1d42eef-e06e-4515-a941-a61f7ce94346", "comment": "Malware payload (RedLineStealer)", "value": "cd22be06fb62d70c6a00c7c707e85ce5be12eb3f6a223956fd923c5aa0aefd047b01357f592e198babf112e702b06d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710785830, "uuid": "3fccb151-4606-41ff-bdc1-9f41669ab818", "value": "T190D4022076D1D2B2C8B7513944E8C7796E7930700765C6E7BB9D5B7A6E202E0B3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710785830, "uuid": "1ac4685c-8af3-4d01-a2aa-cff384cebf7a", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710785830, "uuid": "f366cdbf-ab8a-46be-b9ae-c7c02bd7f401", "value": "12288:8h1Lk70TnvjcXWMPM2f40o4aALPZDVcK4D6jga4ENDp80gi8LN9:Ik70TrcRPM2f/zhBZ4DAga4ENDm88Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710785830, "uuid": "8f2ca814-320e-4460-b70e-12284184c77a", "value": 621896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710785830, "uuid": "0fdda36a-d844-400e-901f-06eca1e39db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710785830, "uuid": "f75dc461-8ee9-4501-b55a-f071ec3ba8b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3308c1ae-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710751669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751669, "uuid": "f3f3db34-d2a8-4e1f-aa7b-8d0172623c25", "comment": "Malware payload (Formbook)", "value": "f684e3565aabe07ae9c8bb837de97e15", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751669, "uuid": "4bfc189a-e5c4-4dff-8953-5206b474764e", "comment": "Malware payload (Formbook)", "value": "a639780a2b1cafb3c0bb210fc2066a51373e7b5963c1dc8b432a8ad6e0793cc7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751669, "uuid": "42cb24fb-ff86-4c08-9173-9a0b5550df21", "comment": "Malware payload (Formbook)", "value": "6e86ebd4aa81ecce133cd53c84d857dbc71663fa", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751669, "uuid": "5401a3a7-d295-492e-a387-35380b3f262b", "comment": "Malware payload (Formbook)", "value": "deec85a72b54839437ecb4c9f835c82948c4b9682ed18c055d4ee581ad65a934561499b4127ef8434698b04d83391606", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751669, "uuid": "baa73194-590a-411f-8e8b-b633f57a7642", "value": "T1DAF42372C2E656C148363FA6CDB71ADBD9715FED02B7EEE8084E9384968C324770059A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751669, "uuid": "971617dc-e0ce-47f5-9eb8-b31d18d9eddb", "value": "12288:LLs6F5PImqTHq0wuQGB1vx98YN9TDexeabDz2sQlYwKIEROtWzTX2B9thIespfN9:Pt/IdTK0wzG7v8YTCbDKsQBEkt+CRhI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751669, "uuid": "a7e484e1-aa8e-4563-8c7f-4b95a2f5beaf", "value": 741463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751669, "uuid": "7b5a7a60-1106-4fdf-8e20-79df8ebc18ba", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751669, "uuid": "0435a7ea-d202-483f-9e47-b642720250e3", "value": "Swift 3-15-24 $13,800.00.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc2ee75-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753860, "uuid": "4d50915e-e293-479e-aacd-743af0ccef24", "comment": "Malware payload (Gafgyt)", "value": "c96a9c60a6fca2c87b08c384fba18fee", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753860, "uuid": "360a459e-2e20-4cf7-aeba-61fcebca5ef4", "comment": "Malware payload (Gafgyt)", "value": "a7ee500ecbf9ccde2407089b1acb1380b9923b2bfa7e70a369af265978b52c35", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753860, "uuid": "1753461d-b13f-44c0-bc1f-368dcceb240b", "comment": "Malware payload (Gafgyt)", "value": "91cf21cc1ea2e209879e9723a73cd084603a59e3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753860, "uuid": "e04629ea-05e3-408e-95aa-823d920fccc1", "comment": "Malware payload (Gafgyt)", "value": "cc92dc661401ff47b5c3a8d6d2561b29ed1dd03dbf06e2480b21b55c1eda7f15938463a4c5bd0550220e42908f74ea47", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753860, "uuid": "7bc43b88-07fe-4edd-b846-827c2a3f14fe", "value": "T1DB04B82E3E11ABBEE164863107F75B70C3952AE725D19382E26CFA185F7028D195FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753860, "uuid": "a9a7a7d8-9379-483b-acd2-b8151b3ee0ea", "value": "3072:SjSeAMkLexEQZNcNetJ8add9QzhsPMMOO/PqQdfi+KqLwZi+LUk:CSNbUDaNetJ8addQiMGdfi+KqLwU+LUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753860, "uuid": "9bb32577-020b-460b-a7d9-7d2abe11e71b", "value": 174954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753860, "uuid": "4b076606-8698-4865-8f14-3d3960b89bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753860, "uuid": "b472f4b3-6999-4a35-9a2c-5955b64a5cdb", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a60ab5d-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710751762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751762, "uuid": "fe4b8dd8-7d8d-4554-b677-63c318d16a21", "comment": "Malware payload (AgentTesla)", "value": "3b0e691b61190ff43347898a1177a354", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751762, "uuid": "7fc4ce7b-c062-4267-8972-fa7b41b6ca51", "comment": "Malware payload (AgentTesla)", "value": "a804310a4cdf5566b2bb8552583084d3a9ed6c2bc82474e37838d63d0b7e4732", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751762, "uuid": "b3957125-ed3a-4848-897c-88c49ee266d0", "comment": "Malware payload (AgentTesla)", "value": "256f2b1d6f22676b8b002407163a4ff24feb4708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751762, "uuid": "ba3a6e11-e1fd-4b11-b3fd-ea440d41ec79", "comment": "Malware payload (AgentTesla)", "value": "ad7da7b1cc4d939f60bf23708a56ae6d97672d37c3fc23cdcf9322441cdba7c1eff35fbc6c831681b09ca1482cb6c4a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751762, "uuid": "75913a1c-db53-41ad-b281-642f7dc0349a", "value": "T16FE42349E3EDAA31C5A30D33D9A2ADF6F87DDA1811F3814B4B449F6CB6303929C79650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751762, "uuid": "86fbc6e3-e9e5-4ee6-ae13-12a9f1365f91", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751762, "uuid": "d1dca84e-5955-4fea-bc81-e4af92c05725", "value": "12288:mq3LHgKTC4CTji52n0xOLDvLIgJ8pQhH1CRjU0u3FZWTzgb:drTCBTji52HvLIgdVCq0cszgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751762, "uuid": "0cd30099-49e7-418e-a4cb-bd4fcf725b9d", "value": 676896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751762, "uuid": "fbffa167-7c3d-4a7c-8367-7c997e094ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751762, "uuid": "831d82c1-2ab6-4223-83f4-8f347a60fbbc", "value": "Vindegade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06658b8-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710767824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767824, "uuid": "f6e7b541-39ac-4125-8aef-edb7d402007e", "comment": "Malware payload (RemcosRAT)", "value": "62088e841fe4058ad4e40d0e7b39e88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767824, "uuid": "52b12330-0de9-45b7-adc7-7851923e6206", "comment": "Malware payload (RemcosRAT)", "value": "a82c551f40e57708be4af769a191dbfc5c45bf7db808d47539411e77b8be41e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767824, "uuid": "408b1444-1248-4095-af0a-5c0837d703c2", "comment": "Malware payload (RemcosRAT)", "value": "675f6e89020344a6f7e43dad8530b9d1f6f8de47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767824, "uuid": "2fda6628-7939-423c-93d5-5ba5dbecfad8", "comment": "Malware payload (RemcosRAT)", "value": "2f4228e9515636c87dc872c13f8e76a69f15187473c356fdbb5bf990ed23bdc895919cc38ed3da6c2d90b709c1534dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767824, "uuid": "8f5fd0aa-8f84-4d23-8e40-778122f6172a", "value": "T141B49E01BAD1C072D57524300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767824, "uuid": "8d0f2553-be5d-4c8c-bbdc-e8f833119cab", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767824, "uuid": "4b7bb6d5-c259-4517-b668-3a54314c9c59", "value": "6144:0XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNSm5Gv:0X7tPMK8ctGe4Dzl4h2QnuPs/ZDgcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767824, "uuid": "dc0e8be4-cc0e-4111-9f6f-21f3d48a682a", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767824, "uuid": "b2880526-a893-440f-8cd8-6e406dc150a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767824, "uuid": "1a9829d7-ce9b-46bb-9644-655047d2aa7d", "value": "a82c551f40e57708be4af769a191dbfc5c45bf7db808d47539411e77b8be41e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224f1a89-e535-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710772686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772686, "uuid": "12bd46ec-07f6-4615-a91e-3fd552eabcae", "comment": "Malware payload (Formbook)", "value": "3d5ac85829e8b64458d0743297681fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772686, "uuid": "0a33ca7d-1348-4d53-931c-53c00b26cd73", "comment": "Malware payload (Formbook)", "value": "a83c288ee02e53fc492939cbba3b33070d3e6ba9ae70053936b6dcd72a2c8828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772686, "uuid": "0e978991-5436-42cc-adfb-323b9d819cd5", "comment": "Malware payload (Formbook)", "value": "48291b2504da0c192e8298aa72f2f49dcc426467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772686, "uuid": "5d552b09-b50f-48bd-bdd4-9bef2d09d468", "comment": "Malware payload (Formbook)", "value": "a3bcd81f5ca4fe06028e41deae1d38858a0287ae1bbbf6798bf47f61f9bed7098e2be9e7a7e97ba7967e9864a91a7147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772686, "uuid": "8983442c-caa0-4159-82ae-e66dc4e6f575", "value": "T1EDE4230C7E2ECB72CC5AD6794CFF9155CB0433529C8CD36CA51DB58EAFA2AA086D0647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772686, "uuid": "252b094e-3d71-4fe3-9605-455a356dd249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772686, "uuid": "2c1e8c0f-bb1d-4196-b70d-fbc06c851343", "value": "12288:EUb8qb9a7o3z2PClnPoSol8SSomUEkWQmBtp3ROIskdd1SjgRh:EUwW9a7a26npSaLlBOIfddwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710772686, "uuid": "d3d9c908-c7d1-48f7-a3cd-2106572d873a", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710772686, "uuid": "ce803965-e103-4734-911f-e51bb0e17eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772686, "uuid": "2137c023-06fe-4d77-aa9c-b6877eaf6334", "value": "SecuriteInfo.com.Win32.PWSX-gen.10617.3858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eddf2e0-e561-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710791632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791632, "uuid": "068f3b89-62db-4f99-a45b-e116ce9497d9", "comment": "Malware payload (QuasarRAT)", "value": "f0e2c9077145df06fc292d0d7583c5e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791632, "uuid": "36165de2-f129-4b3e-b074-01d85ce0bae2", "comment": "Malware payload (QuasarRAT)", "value": "a841a1fe8b81516cb7d07d1bf57d663a26ce360e61f2f90c9dc046e9280bd318", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791632, "uuid": "b51cbe7a-f7e7-42f3-89d3-1a9381acdd4f", "comment": "Malware payload (QuasarRAT)", "value": "7c6182b7d61fe8a12670021f8499326b83e1e3f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791632, "uuid": "0f5262cf-abcf-420b-bf35-48039222182f", "comment": "Malware payload (QuasarRAT)", "value": "762bba07bc808719d73ce5ae9af91c5315694a1b6de959519edd1b84162539e42b18abd4321b42481baf0cbf52ab0c1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791632, "uuid": "93618ff1-574e-45d2-92c6-4e6c536e0500", "value": "T125E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791632, "uuid": "a2a5374b-741a-49f2-a152-5e5f7e20626c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791632, "uuid": "0acefaee-1832-4311-b63a-27085f754294", "value": "49152:7vmI22SsaNYfdPBldt698dBcjHcHxNESEOk/irLoGdfrTHHB72eh2NT:7vr22SsaNYfdPBldt6+dBcjHIxF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710791632, "uuid": "9f652596-87c0-48a2-b604-2330012880ce", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710791632, "uuid": "f9b11553-833c-45ad-8836-a79cec7370a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791632, "uuid": "9ddb07c0-f83d-4562-9e09-2d66bef9ab84", "value": "f0e2c9077145df06fc292d0d7583c5e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cf9bf2-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753880, "uuid": "7c716e5e-c6d6-4330-96a5-5143e10288f3", "comment": "Malware payload (Gafgyt)", "value": "409875aeca25aecbeb5b8b4790780b50", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753880, "uuid": "dc665961-5e98-4deb-8f4a-c3f7137afc08", "comment": "Malware payload (Gafgyt)", "value": "a983c4ca4466cd56e1be107a68e10fd6eb218268c5b9c68120bddfe011076938", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753880, "uuid": "c3c10aa4-fd2b-4a83-8d99-f08aa8d98b88", "comment": "Malware payload (Gafgyt)", "value": "bbf36d11677073fa042999dcf7d713510c0b5b34", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753880, "uuid": "5f5f0ec3-69c8-4221-a187-cbf66176c86c", "comment": "Malware payload (Gafgyt)", "value": "57b02626c7b74496785a86149fe5029a014cd38d461f71afa924159726c7a36eb0ba2414f0c7f70838ccffa132e0680f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753880, "uuid": "953db547-15d6-4089-b9db-37d7b4fa2682", "value": "T1F1C32AC79641C5B2D00209F222AB67454522FF3F499BA9E6FB193CB09F309866236FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753880, "uuid": "a9ca735f-0c6b-4eec-90c1-af8d433122f3", "value": "3072:JmCiYwWSZkuYvg1+NyRetJ8add9QzTsVzXUt4NKcXeGcgqGK:JdZowoSyRetJ8addQWkt4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753880, "uuid": "cdc6a44b-feab-451b-9321-437d0cb0c70e", "value": 125342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753880, "uuid": "c23853d3-36da-4528-81fd-a891c1c48087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753880, "uuid": "ca135782-92ac-4831-a2af-902205169d5c", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069cf639-e54f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783807, "uuid": "260e4010-2b6f-43fb-a6b6-85b6c779180f", "comment": "Malware payload", "value": "c3570b178f305753b69a37b0619fffa7", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-22555", "colour": "#C600AB", "exportable": true, "hide_tag": false }, { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783807, "uuid": "6cbfc958-4222-45ce-801b-42ea938fdf2d", "comment": "Malware payload", "value": "a99bf162a8588b2f318c9460aef78851bd64e4826c2cb124984d2ab357a6beea", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-22555", "colour": "#C600AB", "exportable": true, "hide_tag": false }, { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783807, "uuid": "e9194d95-cf83-4428-9aac-696d22b670c9", "comment": "Malware payload", "value": "7db16e7434aaf120da63de3950bea3ebe67b3ae8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-22555", "colour": "#C600AB", "exportable": true, "hide_tag": false }, { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783807, "uuid": "23a17415-dd08-425d-a6c7-58957870d22d", "comment": "Malware payload", "value": "25c22fe034438bdaf24846cf603916fa99891a012b8d26af79c71d888a7977979b0cdee6f74cf699b68d1f0c9815d656", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-22555", "colour": "#C600AB", "exportable": true, "hide_tag": false }, { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783807, "uuid": "d3166ee2-ec6b-4d5d-99d1-ea65c321d5a9", "value": "T1ECE47D9AF783D4E1F1A301F6124FDBA20530E52A5057EAF3FB49AA7634717426F0A319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783807, "uuid": "3941127f-1aff-4b4d-b1e8-b77434c36b0c", "value": "12288:TUjyR5EgZ01COh4Ch/nj8goWtE/ya1cs3Iexm4cqrdgy+df7p+XlGyIHPvahB1zK:T15EgZ0jh4ChbAd/ya6sYexm4cqr2qlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783807, "uuid": "90bc9270-5f3c-4978-ace9-4735a34fec75", "value": 716100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783807, "uuid": "124cf78c-31e1-4f9f-87a9-bf2d1a331ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783807, "uuid": "5f77b0a3-a3fa-4661-a4b2-a5ed3004f291", "value": "exploit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a77b2e-e540-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710777688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777688, "uuid": "a2b37208-e85e-4d7f-a33b-9613a5b6ea26", "comment": "Malware payload (AgentTesla)", "value": "4656286f5599e9f1e541f763da280a02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777688, "uuid": "8222624d-13a6-4914-8fb2-e8234e08657d", "comment": "Malware payload (AgentTesla)", "value": "a9f1b1f099d72e3d3bb950a335b612a7e2d551e38bc8d72a9d3035453b3760ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777688, "uuid": "c45e7943-a4c1-48ec-b286-c3bb4266a0c5", "comment": "Malware payload (AgentTesla)", "value": "87d5333dc8d85f5c01cc97970ab01ec330d6c09d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710777688, "uuid": "02682512-f90d-4f38-abec-82879023442e", "comment": "Malware payload (AgentTesla)", "value": "0aec33d657b59437bd8e7cf5dbcddf689a483c50e89df141a1fb70b2f2b001e7dd90f76a698c349ff16ff4e69ef999f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777688, "uuid": "801e9b4d-8361-464a-ac30-28be1d2ea96a", "value": "T127069D33F6AB65A1D2A67B32E7AA0D000761F95F3737CA0A75C923DE092375E9841317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777688, "uuid": "b9c0b703-a31f-4fde-904c-1c9f53941a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777688, "uuid": "bf67b824-c4a6-43b9-a82e-bcb1afc16076", "value": "98304:rgG2w+u5vJ+TZJMaSoNoCO0lblyUK36CPbg:rF2w+u5g/MN2O8blyUy7Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710777688, "uuid": "0a852a64-e232-49d5-8f62-b53364530626", "value": 3817472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710777688, "uuid": "725aa641-0d0d-406f-8931-d253747618e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710777688, "uuid": "2d639803-b864-48b4-aeee-611dbf5bf73b", "value": "3182473663947752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec23e347-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771736, "uuid": "f04ab649-12fb-4562-a422-2307889636c5", "comment": "Malware payload (Gafgyt)", "value": "8b776556ded9b77912a5bf89db657073", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771736, "uuid": "c15bcfa4-0ce8-4005-8933-731ba4befb25", "comment": "Malware payload (Gafgyt)", "value": "aa49b8f64772fcc7b4687b7cec46232a13b14292d36e1c29184deb85b788f58c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771736, "uuid": "091e2e5f-e555-4ca9-842a-1838f842fc84", "comment": "Malware payload (Gafgyt)", "value": "75c5c43028c628c48d8acf01b52507f2eb965e9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771736, "uuid": "b4ea57a4-e637-4462-b0ee-8a6f98faa05e", "comment": "Malware payload (Gafgyt)", "value": "90068b36156f7a91b7231bad24487dc0ff8446c83c1be49e08f4fb07172b42977fd8dd10e79f7d77578635c78186cc33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771736, "uuid": "a3a646eb-1060-448b-9e67-f71cdcbb72b9", "value": "T1C4F34A09F6408B57C1E2277AE6DB434A33238B94A3E733155938ABF43FC67995E32911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771736, "uuid": "070d66cf-3747-4f96-bef3-d858f53bea85", "value": "3072:5CF0KJ9aRJ9skvZDFqhNHOlaTQvnPPnM/9BiRmlwfvRQlPN:5Z09aRJ9sklFXla0vnPfM/9Emlwfval1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771736, "uuid": "e063b7d3-7bd0-44f3-b45a-ccb6387ae197", "value": 165469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771736, "uuid": "ab63aed9-24c1-42e4-86b6-882dc151c193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771736, "uuid": "4fb5398e-f562-46db-b5c0-0f9e09a41f2a", "value": "8b776556ded9b77912a5bf89db657073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2cb1d8-e4c7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710725644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725644, "uuid": "85cf9168-d87c-475b-834d-f2455c159c74", "comment": "Malware payload", "value": "c260f3dd6c6f4adaeba61e44b5e44944", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725644, "uuid": "8399b373-61d9-410f-992b-2b01a5548b2a", "comment": "Malware payload", "value": "aa4eaaf2fe3d38945df8d92376eb6d8892bf069c828d6a2c0834ee2baef96965", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725644, "uuid": "7d9fb08a-89ea-4f79-9171-d0fba0481924", "comment": "Malware payload", "value": "adef858d36140452a6f2275c50de2d597b1d0700", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725644, "uuid": "abaef1cc-5205-420a-9c58-fc2e1d6374f6", "comment": "Malware payload", "value": "b23e37dee38e9a236b6022007d456360898fdd6fd4f69e05a1878dcd905313c31ac443f2cf82b8a683cccca60d2ef5c0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725644, "uuid": "40b240e6-35ae-4866-b4e0-aa6634c27f87", "value": "T185B6F187F75C5A2EC4774172CC6A5232E66E4F118A8397476848372D38B35E88F79BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725644, "uuid": "920e4edd-c547-4be5-9346-e3f5eac5d288", "value": "196608:1Yx/B4VfH1MIfe7taI67SUcdNtDMjL/BrvAGyLOhX+wOwLb7AE:o4h1lfe766VDM2GyLOwy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710725644, "uuid": "758cac47-7728-4f99-8e93-e6baa8531829", "value": 10504963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710725644, "uuid": "0df17a8f-3248-433f-b4aa-f29649388744", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725644, "uuid": "aafad781-ff9a-4d51-8dbc-691301b0b397", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e2711e-e506-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752773, "uuid": "09b4c168-dae7-4e90-8da1-15bf061518fc", "comment": "Malware payload (Mirai)", "value": "d883f1d4be4cb10a13990fb370a4ba0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752773, "uuid": "0a32cb3e-ecb4-4b25-9957-b762ca2e0bed", "comment": "Malware payload (Mirai)", "value": "aa94f15ec08ea35d64331ae20e08c433af37feb0deb6ae73253e4870199b4b9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752773, "uuid": "93189ab3-fe7f-42e4-b312-5ead18a5dcce", "comment": "Malware payload (Mirai)", "value": "880afe2fa6f6beed0340eba9155abe340acf5061", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752773, "uuid": "00a2835d-62b4-427e-a22f-990ae1ba8056", "comment": "Malware payload (Mirai)", "value": "bf010761197f8416a0b954008a0eb6d3014c69188dd6e6a0f3e51f18191b3e0ce0d7f08b108e0c937f0208e934a16bd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752773, "uuid": "acfd84a5-31ae-458d-9361-91f993a77194", "value": "T1BE63C60E6E219FBCFB5C873447B78E21A75833A626E1D245E15CE9011FB034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752773, "uuid": "27b86cda-3fa2-4948-b883-4c6071cc0388", "value": "1536:y1xZeojGvZuKrgFrmWRTB6H0tIoMX6bJwxGviAiJ5AT0ZSqaA:y1xZeojGvZu9FrfRTB6H0tIoMCDxT0ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752773, "uuid": "adea462c-b58e-49f5-833f-b9ccada25e4c", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752773, "uuid": "fc8e4c31-d0f5-45b7-8f79-6db4edccf995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752773, "uuid": "68ba6748-3f71-4613-ade5-c8e5ed6ce045", "value": "d883f1d4be4cb10a13990fb370a4ba0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2415bbb0-e503-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710751214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751214, "uuid": "72849763-3b8e-49e4-9597-1c61d54aea70", "comment": "Malware payload (RiseProStealer)", "value": "a657275b4b04d87b45832c0f7c05d383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751214, "uuid": "8953c81d-77fe-45b0-8eec-f02b1c661462", "comment": "Malware payload (RiseProStealer)", "value": "aac8661a76a3e499acc10645da7ddbf4bb42947da5d5b4da44f568a5644af51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751214, "uuid": "30cc2198-aa04-4399-b4b1-b88c0ae2a251", "comment": "Malware payload (RiseProStealer)", "value": "f77b97be743571ffba984dbed36437f3f2db1d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751214, "uuid": "391f19c4-a2ba-4165-9d13-b418338dc2cd", "comment": "Malware payload (RiseProStealer)", "value": "2923fa9809c88636a3d51f000ea1d49ef46692795abd3d9050b8def340370e957d4e75e0e9161304b0ff60df935a88cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751214, "uuid": "f45253d8-5248-4e8f-9f25-da31ce024049", "value": "T1DFE55BA2A50572CFD88E37788527CDC259AE4BB907205DC7DC6DA0BE7E63CC115BAC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751214, "uuid": "1e4f4a4e-4c82-489f-b7d7-6cb102d355b7", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751214, "uuid": "f480591a-a51d-4933-b13c-d828b6341a06", "value": "49152:4Hd198tp0l27Fd7iXaE8jk0RYk+hQdfr:4919vl2L7iXaE8IOqQpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751214, "uuid": "9b79bd0d-ea7e-4a3a-9223-1a205f23a86f", "value": 3186176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751214, "uuid": "1bfaea75-bb71-4253-9d68-8c5fbc5eea94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751214, "uuid": "658edc4c-bc40-47a5-a7b0-7315a4df7d88", "value": "a657275b4b04d87b45832c0f7c05d383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725c08f4-e519-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760795, "uuid": "27bdf404-6bd1-49a7-81dd-4b8eee6f8379", "comment": "Malware payload (Mirai)", "value": "2472c768ce4455e3df9563f07c2aa886", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760795, "uuid": "e1c6581c-6e40-462b-8677-e4e1863fbf43", "comment": "Malware payload (Mirai)", "value": "adbbf392524e0815429d0bff7630bf59c98faaeb2d0231738c324f8bad2d3016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760795, "uuid": "44fd9fa3-41ea-4508-a69d-25ed95ca2b0b", "comment": "Malware payload (Mirai)", "value": "a4a1d41b3838bfccab4c1dd6fe452d087ec51283", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760795, "uuid": "4d069794-84e0-4d8e-a0d8-1be5de376e97", "comment": "Malware payload (Mirai)", "value": "961914e52573bca2246c1599001a88073db454c2eb908cd8c353303d62edc03d275b2b01f126e3a248c6aa91fd3bb501", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760795, "uuid": "5b505bff-e884-4d1a-8d05-92f7bdf3c9ae", "value": "T18CF30A46F8819B15D5D256BAFF0E128E37231B78D3DE72039D246F347B8A86B0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760795, "uuid": "62bf5e09-9b66-4549-b87d-953f5184774d", "value": "3072:ZevQjdIQ1WJAMjNnxofvTatk1hf6IxUi/yUlMsTUuMFX:ovMdQhRufbat0hfyi6ZkUuEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760795, "uuid": "9d581d11-8a58-4901-8991-c4f695a5f159", "value": 168828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760795, "uuid": "bf28f8f7-639f-4d31-a56b-618d6b1f0159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760795, "uuid": "4c55e657-9ce4-45a8-82fb-1c992396a954", "value": "2472c768ce4455e3df9563f07c2aa886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe470978-e525-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710766183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766183, "uuid": "56e42cf7-ae25-4625-b7ae-20482bbad311", "comment": "Malware payload", "value": "677ed10821634321c08e94f7604a20cc", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766183, "uuid": "97d0d980-0f84-45c9-9436-e36d1631f9df", "comment": "Malware payload", "value": "adc226e020b5291cfa61e0bbb722b6bdaaa4837834c318110e71a0225f206fcc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766183, "uuid": "138eca8a-6c23-4058-a30f-7c63bf056a90", "comment": "Malware payload", "value": "8e5d96dc832d4205a4ff0e993af8935a95cc77a7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766183, "uuid": "e36a8e5a-67d2-4414-a7db-3e96e6f4e19e", "comment": "Malware payload", "value": "a04ecf0ea44bd92d39bcae1b0426a50009c496cb02e7578e843150e03fc7355df6bc9ec49cca7d38ae11d818b7b1e474", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766183, "uuid": "748c3ed4-def0-4200-86f6-6863161b96f2", "value": "T1B023F13AE3292940C8F4943C126D1793B586159C8B43FA772AC9790E5146EFB33AFD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766183, "uuid": "39001c6a-50b2-454c-bfc0-edc2c87fa69f", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/aG:tLq94YV7JMxXyd4x+gzexTiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766183, "uuid": "a19739b1-ab3b-4403-953c-603c037de195", "value": 49375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766183, "uuid": "bc71c183-7e12-47c5-aeb7-de62f0e44a74", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766183, "uuid": "050da165-b2f7-42ca-975a-a59462ae9fd1", "value": "ACH-2691-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9d8143-e533-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710772116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772116, "uuid": "20d324fa-c19d-47fc-bcc6-e310c42e0297", "comment": "Malware payload (Gafgyt)", "value": "58a31be3852be8c952e6ac09fe44fc6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772116, "uuid": "c62a2965-69c7-4e5d-8595-3037ddceecf1", "comment": "Malware payload (Gafgyt)", "value": "ae6ddf0591f4472cabc3a8563703e9406882fddd14cdb20ee74ab2dab31048cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772116, "uuid": "38b124e8-fc88-4aea-88ce-76f76b45a73d", "comment": "Malware payload (Gafgyt)", "value": "453b6c661b2caccff81f2cedb2e697e4e1f1055c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710772116, "uuid": "eb00bfc7-eb16-47ef-9063-732ca30fe72a", "comment": "Malware payload (Gafgyt)", "value": "862802af363bb27b37f9deab7665165dd06e9dc73492e6f385cbac7c9b89dbd01c5fae6cdd86cd1a7ea84ab831b687d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772116, "uuid": "7ed64e3a-3605-433a-9d37-7abd8a6f07c9", "value": "T12CA31A93F801EF66F40BE67604D74B24B630BBA24E532562732739A6AE721D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772116, "uuid": "4a5d5c13-af28-4f2b-800a-d65fc2ef2265", "value": "3072:JjRFQvZylQTIZgsnnkm+vyggUwKJfmOHVqXyvRTfQ:Jj7kZylQTrygBwKJfmOHVqXyvRTfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710772116, "uuid": "d44141a0-fc6d-4d37-a05a-b214835f469a", "value": 104756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710772116, "uuid": "d9dfeec2-1612-4934-b129-2e795ffc912c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710772116, "uuid": "a831942a-a4f3-4903-96af-2647ffa1dd33", "value": "58a31be3852be8c952e6ac09fe44fc6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82ace93-e4e9-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710740350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740350, "uuid": "b9bfb5e0-0e07-4221-8dc3-aca87b525459", "comment": "Malware payload (RedLineStealer)", "value": "1357117e85b2b969b8577a9c3c98f8d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740350, "uuid": "5f98630d-1046-4709-b777-aa30d63e862d", "comment": "Malware payload (RedLineStealer)", "value": "af1ed6e3e42d57c2d3f991c265fb46949febac797504fb3efefed761ec136c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740350, "uuid": "8dce3b04-292b-4a7c-8bb8-62c790f9ba4a", "comment": "Malware payload (RedLineStealer)", "value": "19c0770d0142358d7159f90bd91b1989951fe3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740350, "uuid": "6974bdb5-a198-4bb0-8ffa-618f2ac62b54", "comment": "Malware payload (RedLineStealer)", "value": "509c0967cb4476733a5c3eff610a32338111fefce49caabfb690d71cbc87f6a6a8d014d431cbddf7c43e53e37254b24b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740350, "uuid": "e702ae4c-ca83-4ca2-8581-5e05f23691c3", "value": "T10B35288775E2D183F9A79A30CF016651B2231AF28B26F5F68733845CEAE76544C2B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740350, "uuid": "240d45a4-6064-48b1-9936-85ba0ce10d9e", "value": "326a3b9e56fef1c01ce1bcca3cbeca8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740350, "uuid": "c9151636-da02-4fa1-913e-cc60141cd8d7", "value": "12288:CCc0Or8gKkdtlrv98cEGypBi61CpzFdI23xckqCPDCQiJH1nCcsH/Jp:UdtVa0prI23XJasH/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710740350, "uuid": "196e3cdd-e358-4222-baee-7c606aa418a2", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710740350, "uuid": "d415d112-71f6-40c6-b94a-715f4c51f67b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740350, "uuid": "9af7ea52-7b42-4fcc-8f31-5248599b51fb", "value": "1nj V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c675a09-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757429, "uuid": "1a2e1014-2e82-4507-bc27-249016ac4eff", "comment": "Malware payload (Mirai)", "value": "5f6bc651e930cf2cb0b97a45d9949b10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757429, "uuid": "cfd45a78-2545-491f-b0da-29d973c57b6c", "comment": "Malware payload (Mirai)", "value": "af313a0764fbc7233aaea71348d0e1276ab50a9316d6ed524d941f050083f208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757429, "uuid": "a1880caf-91a3-4976-bdb3-fae84a68aed7", "comment": "Malware payload (Mirai)", "value": "da3c6c09332931ad81a747b822419d01058ca659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757429, "uuid": "3ae701a1-b693-45fa-8521-3f22673560f8", "comment": "Malware payload (Mirai)", "value": "36fd5d3ef22dabba57e40782bef179c121c82426cc886e9695c5284a0a879318b2025e08f0e0a1956552cbe6cf9d0a04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757429, "uuid": "f91d0a74-c589-497a-ab77-584bb268fe7f", "value": "T19D632885B9829A16C6C1537BFA0E43CD372A63D8E2DD3213DD196F1137CB92B0E6B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757429, "uuid": "ff3dc2bb-c1ee-4d73-9944-627d9bdc24ca", "value": "1536:LUIhPMPsAJCusE+o6q/XuFxIRGeRkzJDfTa8UMK/vDzg:AIhPBA9sE+o3XKRzx8lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757429, "uuid": "da0f5ded-a661-4772-9780-0f060f1a3bd3", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757429, "uuid": "ebeacfd6-27e0-44df-b856-48fce9c94c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757429, "uuid": "e3a88210-cef1-4cf4-bacb-faea5b06dca4", "value": "5f6bc651e930cf2cb0b97a45d9949b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2c4fa6-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710769560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769560, "uuid": "d20e917c-1775-4f70-88f6-5facebbae9e3", "comment": "Malware payload (AsyncRAT)", "value": "49586eae3b62b9c3cd7d83ac4aef654f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769560, "uuid": "52c57d1c-34d1-4d98-9bba-16902326693b", "comment": "Malware payload (AsyncRAT)", "value": "b0171d1ac28c849c2e62a6bc039d3960c6fbfe1440946fc7a06007c6dc25d492", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769560, "uuid": "db924e2a-84c8-4017-8864-f03ab8d30495", "comment": "Malware payload (AsyncRAT)", "value": "21638d9debd4daa08e907ba83fee9bcb244f329b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769560, "uuid": "e002eabf-1de7-46d6-9690-86b9f4b43f7f", "comment": "Malware payload (AsyncRAT)", "value": "560062fe24cc3a535a6947ae17d01f6f94d5eec1ab55a72df427587e9e2e0242e9fbc369c0d6d3086fbb3e547bf9ce1d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769560, "uuid": "2878d097-89b1-4cb7-8cff-9b2e0cdc2214", "value": "T1FC94234F760962DE4BA6C1BD1DFDD425213888EE0727FA7DA3922E00D1B438555AFD23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769560, "uuid": "d8bfb162-94b1-4c87-9ac5-7174c54b9f94", "value": "6144:oK9WxBX20/02fL4Qfdp0nbrM9CB4c3rfgRaGEFIF0QlMigrBajLzyTo1hDTtTvfL:jg2QXfdSbrMhc3MDJ0CgSLcmSkDPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769560, "uuid": "8d1054af-3af0-47c7-9d90-764e77b825ca", "value": 427175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769560, "uuid": "ea85d1dd-8fc6-45cc-9944-4febf21bd80f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769560, "uuid": "a7ce38a5-3c3e-4b46-a3de-848ded9c5236", "value": "Invoice-AWB-Document.DOC_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2705ba7-e503-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710751561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751561, "uuid": "572aec85-a303-4fe0-b4a3-4f35ee7fc1e3", "comment": "Malware payload (AgentTesla)", "value": "546c12076a32fe5bfd7cd072d2e7f131", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751561, "uuid": "e0e94c61-ed14-44ba-84a8-6183a915c83e", "comment": "Malware payload (AgentTesla)", "value": "b03b43e3f2193e7bd413d0ba320af832ac8519d572b8e6f4115bfa2c94aea418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751561, "uuid": "5a1fa0ee-02ee-4b54-ac44-23ae6ff8cc01", "comment": "Malware payload (AgentTesla)", "value": "cec412912fe167f00c062d00755cd5082e990dda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751561, "uuid": "a20fc113-11f8-41ba-ba0e-437d27bbbeff", "comment": "Malware payload (AgentTesla)", "value": "8bd782cd51992c13ca4fec7c16b7fafd04928b60293143e9ac05f6976523c1bd158e5455e97d46e144c81ba4038e1690", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751561, "uuid": "c324dc7f-41ac-4205-8232-7442f4343008", "value": "T171738B6EE30F0915DF5596BB434A4B4A06FCB33DB38540B139AC977437AD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751561, "uuid": "32b6d1c9-831f-424c-a495-b4e7abe46789", "value": "1536:xCNFLQmoFsB8/5kfZ8xgnIXfBzN/BTf3rdN5SX8DBwgqKKbA0XCt4ag2LUM5PyZ+:0r2FsBtfZ8xgIXZBR/rdQqB7P0XCt4aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751561, "uuid": "4002b34a-0dbc-4f63-bcf5-2030da9a5d13", "value": 73691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751561, "uuid": "240b569e-4026-48a7-847a-92c44c8e08d8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751561, "uuid": "a63f269a-b79c-4a15-88a2-4ac8e4631fd9", "value": "546c12076a32fe5bfd7cd072d2e7f131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777b8836-e519-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710760803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760803, "uuid": "afc21d28-c4c7-4ad2-8004-4a2dd7b3ab2c", "comment": "Malware payload (Gafgyt)", "value": "011dcf0d37b41f84557b5d735311ca8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760803, "uuid": "58ce0249-a2db-4d72-9d3e-8b50da23668b", "comment": "Malware payload (Gafgyt)", "value": "b114dca80399a0e9d0f4eac79df53d72b5cd35d400f04ad0ea75c8bde93551d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760803, "uuid": "0909374a-15ef-4c14-a914-3825500936ff", "comment": "Malware payload (Gafgyt)", "value": "a99957d79d9549e90930460c956b33ee3ee4e4e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760803, "uuid": "a586bb73-06fe-4398-8d95-6ad6687c7e70", "comment": "Malware payload (Gafgyt)", "value": "19320daf069ac6565b3068bda4744ac063a39739b7747a5d969cb9bdbf50ae2c43da5b9b72287b6136e14f8bfc99c19a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760803, "uuid": "31494371-d45f-400a-aad4-4fee8c3176e4", "value": "T153242A45EA408F13C0D727B9FB9F424533339B64D7EB63069928ABB43B8779A4F62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760803, "uuid": "6012e375-9ab8-4b39-8a77-11f078789320", "value": "6144:zFb8qncTo8OaFWtWBnr2HG/N4KtHlneM/RW552q:6LTo8OaotWBnr2mVFPnX/E52q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760803, "uuid": "1ca68c99-86dc-487a-8b38-693b471503fa", "value": 216738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760803, "uuid": "47c5fa51-8f59-455f-8574-78a19f88c78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760803, "uuid": "bf63f9a8-08b0-48d5-af76-9ba151e847ca", "value": "011dcf0d37b41f84557b5d735311ca8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c993c5-e500-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710750231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750231, "uuid": "f1cf97b8-ec91-4ea5-9e3d-ab6496a6a4a2", "comment": "Malware payload (Formbook)", "value": "09661859ec762ef820913ce1d907fee9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750231, "uuid": "b02d661a-4af7-4313-a181-9935fc0eccde", "comment": "Malware payload (Formbook)", "value": "b18586139880ff62aaf6f00ffa5055b775f5bac96231c781754a93f08a717d55", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750231, "uuid": "5fd54596-e7bd-4b73-aa58-ab2dc8da1e2a", "comment": "Malware payload (Formbook)", "value": "eebab101819b8030d2dd4f2bf8c9bc22e07388ef", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750231, "uuid": "07f6a8c0-77f3-40d3-aa33-83e59e16de0f", "comment": "Malware payload (Formbook)", "value": "714939b82328af62748dfa8257d3298d0a31645e2daa067e2b5e93482c2595ae8a210818c159772d8f884cfde2e24962", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750231, "uuid": "c82d9f8c-83a9-4931-99bd-5ba05aeddea1", "value": "T163F43381C1A18CFA98767B14226537026323D5CD08FD3FB5EA14563EB798DB0866A1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750231, "uuid": "767b9707-777c-46e2-b4e9-996fa5a1e8ba", "value": "12288:efZtGVc+4vvpIZOZLfF3DdjHzxp4adg03RRuG5HQRsJlcpO2hSOvWKtSZtz:exUDwxIkLxDRxSulHmFg292tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710750231, "uuid": "23a0b747-96db-431b-9e2f-453e39cfc6c7", "value": 725295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710750231, "uuid": "e3f1f60c-6086-45a9-a305-35d958922daf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750231, "uuid": "c82411d1-0e8d-4a6b-8624-c7945b082ab1", "value": "DHL OVER DUE ACCOUNT NOTICE.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56942517-e504-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710751729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751729, "uuid": "04133534-c552-4f1c-8e6f-e7ea0729e2bc", "comment": "Malware payload", "value": "db82680804901d0a320aa759c86caaf1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751729, "uuid": "932920ff-9b82-41cb-bb50-95305db288eb", "comment": "Malware payload", "value": "b1a9a5434aad4019bb29dceb7047cd874af167c97a8c3658f17d713b968b3f03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751729, "uuid": "76cf7d4f-c451-496b-84b7-35f2b6f5695b", "comment": "Malware payload", "value": "9df0293b89be0fd61a0d158be853ecc3e93317b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751729, "uuid": "25ee0fd3-4783-4fc0-a21f-c0ed3864ad48", "comment": "Malware payload", "value": "61ae15e86094c52e59bf686331e4eaa94bf662735d1463eb67532883eb3873e91c8d56b9bf2265912218476543967310", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751729, "uuid": "c7529ee1-5131-4a7a-b6cb-2d9204efb444", "value": "T101E573B33DAD4AC2B70D735B5F4BE5E84E27CF270B825DE498C70588844A70B1A989DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751729, "uuid": "35ad4f65-b892-4918-8e27-ee76e6b6e62d", "value": "24576:MaTaxaRs2TOduu09XruaNPJbwMG2J5wDJoQz+lBOE4ZKZUSDa0I/IR70pRbbDQ4U:Msaas2TOcTP62XwDQYEyKzUySQkatr3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751729, "uuid": "bbbbd9e1-349f-4106-8d60-968f6e2c2369", "value": 3134969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751729, "uuid": "01364765-9f78-4df9-8e15-e34c1fc6bb6c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751729, "uuid": "82fa252f-86f8-47e0-974d-256bd2e37632", "value": "signed_order.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18da526-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767826, "uuid": "10351af3-ddf9-49a8-b9e6-c2bd6d98f86d", "comment": "Malware payload", "value": "8a0e29ab0781dfa6726efdd250f07b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767826, "uuid": "00a5da6e-4f89-42ca-a3e1-0f4f5f89b1b9", "comment": "Malware payload", "value": "b2584406da7f9c66b50a4e57070b15286c92022cb337bc25392697a5a3a32043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767826, "uuid": "c008b5ba-1b76-463c-ac8b-fa2945ce5128", "comment": "Malware payload", "value": "b6f362a8ac82388e17ba0cee4a0a75d1cfbbdc23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767826, "uuid": "dab5c6e8-50d4-4ad9-94a1-e91ca39af595", "comment": "Malware payload", "value": "c94407ec85a6750861ce230cf9fed0d112644e45b2b1ab49e1572d4011e0b09865621c609c946e41ef4d6ce710b90d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767826, "uuid": "fc103d71-5e02-466c-a373-7f11884642d9", "value": "T1B3B46C10E28DC1B1D44A187574A8927653723D1817BCAAF3AFE2FF18E5B32E07C75A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767826, "uuid": "775a56cb-ab8e-4444-babe-ec1fa16e21e1", "value": "3072:/FZyqVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYOosqkxQqoe:d4qVG/pJZzfFs4X+LOaysAHHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767826, "uuid": "a46ca6a7-cdae-43fb-b937-1de7162eb2ff", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767826, "uuid": "59eeff23-a7a8-43c6-be11-784b4bb1349e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767826, "uuid": "d7d18799-422b-4085-a42d-46999e9bd292", "value": "b2584406da7f9c66b50a4e57070b15286c92022cb337bc25392697a5a3a32043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723825bd-e554-11ee-a120-42010a9c002e", "comment": "Malware payload (Meterpreter)", "timestamp": 1710786135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786135, "uuid": "1023ee1d-9d23-4a26-bf2c-738ac4dd6d9a", "comment": "Malware payload (Meterpreter)", "value": "0c6f90d2ed763c4ea1c6b3a86e4d2bb4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786135, "uuid": "d4cd942f-25b5-49b4-9689-1e2008d540b8", "comment": "Malware payload (Meterpreter)", "value": "b27d6cb33d66dc4a062eeb3b4ed65e4534d9b83c5eb9f694c863a86a186b8096", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786135, "uuid": "f67a58e6-07fc-41c1-8f49-4eba865981e4", "comment": "Malware payload (Meterpreter)", "value": "9dee08ba535a1ccbd3150f4c3faa2a8d161aa83d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710786135, "uuid": "a67b6e58-4b26-4762-b405-23fb619defeb", "comment": "Malware payload (Meterpreter)", "value": "6333c75e1ff13a6e1840ec517c5902813dade3730174c439402bf4a7266004c8df3f1ddd4266e4058199dde30e9627d6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786135, "uuid": "de4d077c-7e77-4264-8016-80db32b03ea5", "value": "T1EEE175133B184DB6E87C0A7C56E7FDA761984E283F2B42B18D2803173A3322465B4A44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786135, "uuid": "6fe951b0-6869-4610-8e73-ab35215e3756", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786135, "uuid": "40509b51-e0a6-4e59-b259-4af43c3d0c94", "value": "24:eFGStrJ9u0/60GnZdkBQAVIaYNwKZqn/eNDMSCvOXpmB:is0tekBQlteJ/SD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710786135, "uuid": "63bee059-b849-414e-959d-bfd61f54f5f7", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710786135, "uuid": "d2c65752-dd2f-418b-9134-14d6b359f557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710786135, "uuid": "b89ed544-fa3e-4268-bb65-b266e24d2fe0", "value": "0c6f90d2ed763c4ea1c6b3a86e4d2bb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21d8c29-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727374, "uuid": "d8b8073d-a03c-4840-acc0-0847d00c0cef", "comment": "Malware payload (Mirai)", "value": "2fb9a7ee4194b4248c4b8a633d3b990c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727374, "uuid": "c7e5adeb-d438-492c-8731-f998648204a2", "comment": "Malware payload (Mirai)", "value": "b2ae4343a313d18a7d91adcc875780bd9fad220a0f2d3f20926e932fdbf6287e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727374, "uuid": "7d3e9f4c-d672-4535-a4ee-629f204c51e7", "comment": "Malware payload (Mirai)", "value": "0a5e035e45d60d26a21fa82db798f6d495851285", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727374, "uuid": "53834f59-c6fa-4834-9895-2db44a6132a4", "comment": "Malware payload (Mirai)", "value": "0c749a4f25956e9f4a77e2a9874636763e4e7c0d6f3e0f68e109b7146190cdf05933476ecfba144126bb94d555242d07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727374, "uuid": "1de29c6f-c557-422d-8666-128a11ff5bf5", "value": "T10B042A46EB404B13C0D627B5F6DF42453323ABA497EB73069528ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727374, "uuid": "8ffa4eda-3e3a-4073-b788-94062b3606e5", "value": "3072:/v/HE3+DE3egQEkvamZ+S70bRp1yPqZBF6S/hJjogM/R87XIT:/v/NE3grvamZ+SgbRbrBES/XMgM/R87i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727374, "uuid": "c19cc93e-0f39-48e8-acc7-ad8ec8c35e33", "value": 179773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727374, "uuid": "30e90e6a-880b-491b-8076-9f324bf6de34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727374, "uuid": "db4abb96-e88a-4c60-b719-c8890cc85e2c", "value": "bot.arm7-20240318-0202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b1cb1b-e4c7-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710725425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725425, "uuid": "2ae9023f-bdd7-4738-abf5-47577ee1c5da", "comment": "Malware payload (RiseProStealer)", "value": "0f0db38dbd9a2327b20856e521c41268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725425, "uuid": "d24e9e73-5947-4ba9-bf14-5170c01111e9", "comment": "Malware payload (RiseProStealer)", "value": "b39b838fc01f8b7921b9043cda00ad029a34abbf8abab3060420eb352e20ff2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725425, "uuid": "140e4e99-6fb1-4ece-b947-801b809e2757", "comment": "Malware payload (RiseProStealer)", "value": "ede6fe06b8b7a8744401c4b756a4e058299e618f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725425, "uuid": "739d3f42-556d-4689-aafd-1567963acaf4", "comment": "Malware payload (RiseProStealer)", "value": "d9337d23c5f1584d91d0dbf4154a327f539d9a688ca8c591bfe0045078d6cd3edc4df87d860ce387d3d1a0f44dade5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725425, "uuid": "fb8c7fa3-e646-4bd1-ac0c-fbe438b91931", "value": "T17EE55CA2A80577CFD48F57B8892BCD81695D0BB9431008D7A87E647EBE73CC126F5D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725425, "uuid": "650128fa-e3b9-4ac3-9106-f3e7474d9ab7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725425, "uuid": "fc0c56b2-2998-4aa6-be62-686a1ee53582", "value": "49152:IXN3u+RkDMYW02FoPza3fvkKN3oMg/hOS160VlU0hAS:QUTVKFoPz0fvku3oMgpOHy5hAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710725425, "uuid": "040f50aa-35aa-41aa-9521-981baad21455", "value": 3285504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710725425, "uuid": "a5642b06-b054-4fa0-85b8-d25120277c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725425, "uuid": "93cee6f0-d79c-4e23-b6cb-084c4dfd0413", "value": "SecuriteInfo.com.Win32.TrojanX-gen.20259.600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b32fe1-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771757, "uuid": "c79b6f1d-ad73-4417-a7bb-1813ccd30e45", "comment": "Malware payload (Gafgyt)", "value": "8ec10bd8d36d1d466655d36ae5d65a8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771757, "uuid": "da2346f6-c215-4963-b321-b5f949a09eee", "comment": "Malware payload (Gafgyt)", "value": "b3d4f11300240f7fb3228397d22024473947029e4a460e9bc8b8d2eddf5aec4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771757, "uuid": "b4c86f21-bea6-4105-9482-ff4dea591ed3", "comment": "Malware payload (Gafgyt)", "value": "338ca0ee6d552fc9c87edb398d48007888408cb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771757, "uuid": "8239fd84-28c2-4bd9-ac4c-568d1d8314f4", "comment": "Malware payload (Gafgyt)", "value": "b377c2e2816f824965c09cb9e722174197a2e1f7bf1444425a0c52efbc2e70c8d1c19a2fd70c6d365fa1ce7149943a0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771757, "uuid": "7c80b035-6ca6-4079-9f1a-4ed63c6c9d12", "value": "T16ED3B61ABB619EB7DC1FCE330AAA4601108D919612E97F6FB2B0C56CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771757, "uuid": "9f193fa2-7ee7-4b97-b829-743532441309", "value": "1536:bw9eTH+HTP6BgBTMd7ZiqtqSN4fupUvDHJIlKgkf1UmkfmgFxfC7SSvQ:bwLdTuhCupkqKv9Umk+gFxfKSSvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771757, "uuid": "73f88f61-96fb-4486-a541-7ce896bcb14b", "value": 132021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771757, "uuid": "3337bf93-fee8-447d-a4e8-0c8d7236af65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771757, "uuid": "51c191c1-5590-4e70-ab90-a0687cb192df", "value": "8ec10bd8d36d1d466655d36ae5d65a8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3bd001-e4ee-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710742559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742559, "uuid": "c26e9ffc-67f3-451b-82cd-9fbb8e21bc1b", "comment": "Malware payload (AgentTesla)", "value": "4167cc240390ed356a7e8386e129e8ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742559, "uuid": "0bc9cac1-e98d-442c-8f67-91ec36d6e3e9", "comment": "Malware payload (AgentTesla)", "value": "b4ec6d0f5be68ff008a9763573c9e30485bf16041e2dde0a39d73c4b7d7d81b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742559, "uuid": "38539242-4fff-4b8a-93c6-3019be7bf68b", "comment": "Malware payload (AgentTesla)", "value": "06edc2a8f0e0fc597b19ae116957801dc7362677", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742559, "uuid": "d0a38872-fafa-4506-8154-0859ff65dd84", "comment": "Malware payload (AgentTesla)", "value": "9d1385dcff50bf2c4c1dd51ff36e768297a4da45b1a25bbdeb771002e37024d5d84040cd9aa44bd0cff553bb8a793481", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742559, "uuid": "9773fed3-1054-42e1-a18f-608b4b6cd7fb", "value": "T1C7B602EDCF73879A01BA9C833D49F9B75615F2E9B4C8E372D00D51B4CA04ABA3447869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742559, "uuid": "91497ea9-a205-46e6-88a7-0d000fb5c207", "value": "384:Ox8CIsmsUIJ8XKLJQAHW7lSEp3oKufudEdjuSBbuU2z3w6H9FQXPXe7lQ9LVwtUQ:OxYhNIJDP27wcYrXxuSBvvCSXelQNOkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710742559, "uuid": "c71f650d-e960-4bf3-801b-bade779ef282", "value": 11428439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710742559, "uuid": "6b74f8a2-bcb6-4fc8-8d02-decad7449912", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742559, "uuid": "aaa3a6d5-f61a-44cf-a5a1-30551a1bb01b", "value": "lnvoice-1605700252.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9f938b-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779948, "uuid": "7ffa760a-96f1-4c88-a919-0a2ad2cbdf08", "comment": "Malware payload", "value": "3d4124de5f639b0bcca94207a4e8b55e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779948, "uuid": "1ea5cc4f-dbbb-4401-b6fd-99477a069bd3", "comment": "Malware payload", "value": "b4fad42d5ec42b12f6b333a03bfba1d80b93dc750e1169630bccd04607888cbc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779948, "uuid": "4307dcae-e94b-4705-8e06-8961f8fcb6b5", "comment": "Malware payload", "value": "850a50640db5daea310908137a4ea8efff65dab4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779948, "uuid": "0dfe5e94-2726-4386-98d4-bd39af226ce5", "comment": "Malware payload", "value": "a9a1e7323e45e4186f8b0a563c02791d6eadda09bb6000d376ad24136d11630168bc879e391c841391cfe0da199937da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779948, "uuid": "84774a7a-a170-49bc-845e-ca613b4c14c6", "value": "T1F5736C25F040D0F7C7A724B435729BAE6DB06D369012C983FB8A2DC9DE95047E92A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779948, "uuid": "79e43277-0937-4fb9-b376-b6e271642c91", "value": "60075dd09750e3ecec3e7017f6bb13ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779948, "uuid": "bf7cc883-23e8-49a8-a068-67fe65ca6d20", "value": "1536:VpyEDunHJ4PYS/iQuN5F541Y1/X272bHvZDNrolri34kxWE:zCnHMN/a/8+/82bPZDNclri34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779948, "uuid": "b82c11b4-38f8-4ec2-ac4c-d60f493f58e2", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779948, "uuid": "0bc05307-e986-4e53-8607-82f0229d3be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779948, "uuid": "fd9a0708-cf6a-4da3-ba2f-0ac3dee12ef5", "value": "SecuriteInfo.com.Win32.MalOb-FH.28566.16421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da04fb6b-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771706, "uuid": "f3dfd11a-5665-428c-94d8-74d72a6f3412", "comment": "Malware payload (Gafgyt)", "value": "deb7f9cf255b1f86a91a35429e15f7ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771706, "uuid": "874701f0-5628-4f83-ad05-b5b54ca2aa5b", "comment": "Malware payload (Gafgyt)", "value": "b5985bb5cfd91dd1eda6cf607eeec66781fd1522ba049a5e1f76b65b386a5596", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771706, "uuid": "c7e1bcf0-ea81-49a2-8b53-48f2ef3b2e99", "comment": "Malware payload (Gafgyt)", "value": "6230bf39522fe12111c14ec7575b847d81d09d7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771706, "uuid": "35b201ea-0d6e-4176-92ed-574702179928", "comment": "Malware payload (Gafgyt)", "value": "531dd3620a569049229233f2a10b7d9a077da8102ddf682cf522ca5e2f55ea737876ad9c806e91f5829ac68fc22926f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771706, "uuid": "0c5ac74c-1170-406f-aac5-898f5ed728f2", "value": "T1AD933A07A5A18EB7C086AAB135F659300B17B8915B1F2B867138A7F8474F5CEB40FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771706, "uuid": "a15b6162-890a-400c-b947-b59df07d731f", "value": "1536:1f8fkjoh/NSUMXn0KZthffsinm1XRQRCNHK4xa69mc4wVqYL5RRTc8:14kd7Z/si1ROqmmVwVqY1RRTc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771706, "uuid": "2b9165bd-5e5b-45ef-b535-a5258621c8ab", "value": 94793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771706, "uuid": "627e84ef-7910-4450-b889-05b971d464d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771706, "uuid": "5abfd1c5-6467-4ef4-a855-8e85eb251992", "value": "deb7f9cf255b1f86a91a35429e15f7ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5be641-e4ff-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710749537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749537, "uuid": "f88d5b9f-d1c1-48b4-a813-c5c2df905f5d", "comment": "Malware payload", "value": "49168fadfadb566468cfee3d6c643ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749537, "uuid": "64018500-ee9c-437f-9972-c9840087a7dd", "comment": "Malware payload", "value": "b5ab5454742b5670fa14f2079c933c0f43c4c8a651742807ed514fbafd66f9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749537, "uuid": "315b5586-0086-43cf-98f3-3432f14f3de5", "comment": "Malware payload", "value": "f0c06ff69dfa02335463a2cdfd3099ed6469acd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749537, "uuid": "d520954b-4140-4b7d-9b40-adac7f584671", "comment": "Malware payload", "value": "aa068e3e5da4026ddacf5774c4f3b8dadf14decce4bec3633e09796ea64dbca4ac6532b4d7be9062e75e66a56b205bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749537, "uuid": "2595202d-3057-4fff-a756-d84c36a65379", "value": "T18305230DB36D5643E8FA84F9082C709543BA227D11E5FA882CCD35D9EFE5F4A4921F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749537, "uuid": "112ce7d0-b065-4891-855a-77f5ae82a615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749537, "uuid": "728e3d7c-359b-4a01-9435-1557c648a21c", "value": "24576:XiWdlyj9OXUjfCNmlCnjrJolAxhPTaPd:X9dcj9XjarFePd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749537, "uuid": "8d33cae6-d385-417d-b3ae-d1884f1cc01c", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749537, "uuid": "f9d9ef93-96da-44d8-983b-16cd712fc39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749537, "uuid": "1aa2b59d-e827-4b7c-90de-0f217a89d6f0", "value": "lk7X0otmcvZysuQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a993189d-e4e3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710737694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737694, "uuid": "3b40d0c4-b4fd-4342-ade5-dfcd379a5b72", "comment": "Malware payload", "value": "c9193eb133d2f37402e3dec77be1300c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737694, "uuid": "5905a7b3-9f89-4b2b-8d89-2954df0a847f", "comment": "Malware payload", "value": "b5c182f64cd01e09b9806c1ce4763e384defcad28972d7f66d895eca54b0d8da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737694, "uuid": "719525a0-f6eb-4e1f-a14a-ddca01862b3f", "comment": "Malware payload", "value": "8a377f01bc2cc8c010865f23d74ad6c0faa1dc47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710737694, "uuid": "2202b388-4888-401a-b4ec-b7f68d044bc4", "comment": "Malware payload", "value": "1a4e71851c8c75f4739d724db2c2bd9b80c548e2bf1d3205d06ee4823fd6a39ef033257e375dd1d9ff648cf1de8d1da9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737694, "uuid": "6d7bc0e8-ddeb-43f5-87eb-c6d67d0a3909", "value": "T1D1C5E03253A52A3EC83D1174807E5F0C5BF0C4466582F7BBB965ACBF28737A2985D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737694, "uuid": "17e0cb3b-839b-4353-a394-9f8f90770d4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737694, "uuid": "188c9df8-713a-4030-9d5a-c303c88331a3", "value": "49152:Qd+q8q8q8qspsjpVpVp6DAB3nXLqtdx8sNXrJXjZ/P4bX4gvQX2Y:2DDDskbbEAB30/rJ1/wbPub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710737694, "uuid": "4ca79fd3-f0b7-43a7-a1e6-f369f4b466f5", "value": 2685440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710737694, "uuid": "38de7458-6751-4e34-8de5-d18f6c5baa2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710737694, "uuid": "ba444ba4-39f8-4517-be66-cbec54651589", "value": "c9193eb133d2f37402e3dec77be1300c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282022ba-e52c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710768830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768830, "uuid": "54108997-84c8-4453-b25f-3ab8d92e1cbb", "comment": "Malware payload", "value": "32becda5813e60e90f1e91914f393462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768830, "uuid": "a9528c5b-32eb-4b73-9af3-3fa7ab72dc42", "comment": "Malware payload", "value": "b8bf7301f9ceb8af9faadf2e120a621ee24a8616948e22d9e4c9ef9c31b69fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768830, "uuid": "60628417-f296-484e-b419-ae99ab8d5313", "comment": "Malware payload", "value": "d05f0b24ab62778cb01939a8c7105225da733a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710768830, "uuid": "036e97a7-cc33-45de-a6cb-005f29250da2", "comment": "Malware payload", "value": "360d82817f67fe4f697c8b9cb263cc3f801123b0e07fdfe99008435ff9885b9bdebb4f40f689c7e83bd09579c89534c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768830, "uuid": "0d831f7e-02a0-45eb-b3e5-4f55834e979b", "value": "T1ACF4BF07B353D986D9162AB482A5DEB013376D395E2892C97EC73D3FBC7A3C10D02699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768830, "uuid": "2526885e-cff7-4da4-88c2-d2965d06a0b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768830, "uuid": "fc8cfd96-3b18-41e7-b636-b39c433c5915", "value": "12288:0ef5/66DV5UK02ynWaAUvmvuuRg4TXNDWsq+70d:3RBivsj5mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710768830, "uuid": "9daf4f19-4a63-40a7-a539-921d4a062e02", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710768830, "uuid": "78a2cd13-aa8a-4add-8e46-e2df56e5858d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710768830, "uuid": "da5e3046-b8a7-47c9-bf67-e92e90f65584", "value": "SML.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ff0750-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710745775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745775, "uuid": "6eccea8e-6202-4958-8424-c86ac564109b", "comment": "Malware payload (RedLineStealer)", "value": "cc533d3daefd6e3a52bb51ba529723bb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745775, "uuid": "ab3c817f-5ba0-47d0-b298-7f8ce3c547f7", "comment": "Malware payload (RedLineStealer)", "value": "b999ab4ebfd36416962383b4da365d655ac4bc7cdff8d5431d881e6ee345ce91", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745775, "uuid": "d2e46a06-58e2-49dd-9397-945fe7c00418", "comment": "Malware payload (RedLineStealer)", "value": "f489430198e773cdfbc4691db0c9843964aa79e1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745775, "uuid": "8e52ce15-cb23-48ab-9d04-94e811ccac19", "comment": "Malware payload (RedLineStealer)", "value": "e60b5274387528ff98d34812df3cc4ffca6a2eef1eb041f7e22552daebf520414fe05d161bdc97c4d57693ea0da7a21d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745775, "uuid": "e62e7420-25dd-4401-b654-d426bd6c7dad", "value": "T1B3E412952E4BDDBEC4BF43F9403E7520A802AC69C8571A4F61DFB949A7BC290E477381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745775, "uuid": "07ae623b-1320-4fe2-9185-29db26d08f60", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745775, "uuid": "bf6de179-8cb8-452a-b5a8-bba37f437bf4", "value": "12288:hYV6MorX7qzuC3QHO9FQVHPF51jgc/Sg3QIRgDYtZQlL+Mg65+QyH/g36OJBGg:2BXu9HGaVH/R3QIRvC265+Y37h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745775, "uuid": "bbfcf712-3ff2-4ac5-9478-f78c08ab9276", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745775, "uuid": "cf0bf45f-e2b9-41d6-bdcd-ee2091fcfc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745775, "uuid": "be94c83a-f654-495b-ae84-81082f51ae9a", "value": "DHL00170223AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa8656f-e522-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710764513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764513, "uuid": "ba5c4357-6234-458f-b010-946043d65280", "comment": "Malware payload (AgentTesla)", "value": "6eafbeaf8c36bf144306cef983ffcf38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764513, "uuid": "3bace483-8b56-46b1-9f50-902572fbf042", "comment": "Malware payload (AgentTesla)", "value": "ba4af3b4f5226396984e1236c0557ab23bfd44c19b1d89a48eac9668fc7bd428", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764513, "uuid": "a582477a-7dec-43df-a666-ca01dec8697e", "comment": "Malware payload (AgentTesla)", "value": "db66c0d2235de29131cbab88b2a4a3d235c0165a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764513, "uuid": "eb1a9708-61aa-428d-a64a-922d91348f97", "comment": "Malware payload (AgentTesla)", "value": "551101462f5210d83ba964130cd1dd015b45bd79b0a6c76de34b74041ef8a8545089f8946d4f1d01b06547a2e64dcc1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764513, "uuid": "69f01007-cceb-4400-8833-61661294eb4b", "value": "T191259C0273D6C036FFAB92739B6AB20156BD7D250133852F13982DB9BD701B1267E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764513, "uuid": "31346cc0-2700-4303-a2e1-c47d686b6fb4", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764513, "uuid": "60abccc5-7ae4-4ee8-ac92-c6b96a5c11b0", "value": "24576:xAHnh+eWsN3skA4RV1Hom2KXMmHaJTCNZGfQZ6hMn5:Ih+ZkldoPK8YaJ++fthY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710764513, "uuid": "096d6869-0c1d-4f89-8a34-00d7fc62152b", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710764513, "uuid": "5786cf9f-be1a-4a95-b906-9edf14e8bf1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764513, "uuid": "5a797dec-c28a-4f30-a794-77b8fc18a501", "value": "TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d240eaf2-e4de-11ee-a120-42010a9c002e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1710735615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735615, "uuid": "1fc29ffb-ca78-4a8a-a42d-dc1743211a4b", "comment": "Malware payload (OrcusRAT)", "value": "25704a9ffe807caab1b7f0800f22692f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735615, "uuid": "36bd6add-9ebe-4e25-96ec-f136fd74c1ed", "comment": "Malware payload (OrcusRAT)", "value": "bb878d54b68e3be71f2e61cd0e3a8f554a401b49204f76332fad3f8d4960f668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735615, "uuid": "4b33960b-e09c-49f4-bda3-c27dff143856", "comment": "Malware payload (OrcusRAT)", "value": "61c2c9d62e14410a079746ab6c3272e3ba1e926d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735615, "uuid": "ed8504eb-9b32-4f4b-81b4-02e57540c408", "comment": "Malware payload (OrcusRAT)", "value": "b811699f0a3b4550b756d6b55d199a35891301d9286c96be5cb99024187aebd84b63ed656753e28fce8589093693e568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735615, "uuid": "8b4108f2-4eac-493b-b2f6-597e7fb316c2", "value": "T1482512305698D737E72E0AF8BA126015137C90315E02D7F7E898F972AA463E6DB3E117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735615, "uuid": "dc2938a2-c026-4f1b-940a-494ea0979a8b", "value": "12288:fn4noCPJgCmEAK/frrzBmx7ByirqLVnU93t8dLB0w9LAhDHzqO4tq9q/47QrcSNw:fn4JPRnDJmx8UUVnUpil9LAf4tWoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710735615, "uuid": "c75c1874-848d-432d-b20f-12475b48de69", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710735615, "uuid": "5f532f81-4a50-4597-ae73-9afbe5575a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735615, "uuid": "a0e4fc3f-f2e0-435c-a6a0-8548c614d26f", "value": "25704a9ffe807caab1b7f0800f22692f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2c4303-e54d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710783306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783306, "uuid": "143fd30f-6cf5-4963-ada0-e5f6918436e1", "comment": "Malware payload", "value": "7e53c3220a2c3a5261857a3bb1615c37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783306, "uuid": "c93dc201-f1f8-4efc-bef9-0e4c27975ad8", "comment": "Malware payload", "value": "bb9880d5b6ea08df49e2b4e50582626a8f16a42274acf363ec00015da02e9987", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783306, "uuid": "06eab1ad-6f42-4c73-8701-089442bcd671", "comment": "Malware payload", "value": "b3ea093b7fc0c6d3980d5e4cb20cbf6192581fd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710783306, "uuid": "c293c7f9-b6c0-4f26-b1c2-b524508d8c0a", "comment": "Malware payload", "value": "fc58519c90dc2969d5dbab771273bcc07ea7c048e4fe95106c0e7ecfef8bf28915c24646b3d0340ebcf37ad70f86709c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783306, "uuid": "02e7df38-36f4-496c-b7e7-b28a981f32b4", "value": "T19B734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783306, "uuid": "0d34a2d4-bf19-45de-85d7-9a841cdb045b", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Cj3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/Q3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710783306, "uuid": "81d95edc-01dc-4640-bc94-7a7725979e77", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710783306, "uuid": "e396de76-ce2f-4573-84af-dca790a38e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710783306, "uuid": "539bc305-edbf-4542-924d-3be6dce3cbf1", "value": "7e53c3220a2c3a5261857a3bb1615c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcba5cc0-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752383, "uuid": "a294f7d8-c7c1-45a8-be61-af58d1ce50cc", "comment": "Malware payload (Mirai)", "value": "cf69196ed8e69cd16d6c66674fce52bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752383, "uuid": "6e9e3f84-0ad4-4281-8071-2bfb0b3238ce", "comment": "Malware payload (Mirai)", "value": "bbccc0fd462e36045743408c9f2a178ac45cae373908ab48f2a6f1a20f1168bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752383, "uuid": "721a4cdb-fe34-41ca-9719-69d297b5bd4d", "comment": "Malware payload (Mirai)", "value": "f97c4c6e27a9a803216da6790d3a65c97f23f493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752383, "uuid": "f098cf76-4725-4ecc-b8a0-cd2cb420186e", "comment": "Malware payload (Mirai)", "value": "3302bea36ab493f260d82498d706d129d45c6dc8d57e05f334364f9037cc0dbe64597c1af4a7269306061c86ffbc5204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752383, "uuid": "eb62be30-2aa5-4814-a669-7c44f7c40202", "value": "T1C5730946B8818A16C5D413FBFD2E018D332667F8E2DF7212DD105F647BCA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752383, "uuid": "796a5f85-1912-4150-9840-3460a1aa37bc", "value": "1536:CNniNkfWjpqh8QzWIcZMoVbmk3iBPpZvN2S5i4YMTzGIIiYNfI/b4d42+:LkfWchhzWITkjiNoAi4oNfI/bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752383, "uuid": "0f5a08e1-fb73-4103-9087-b730f475d257", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752383, "uuid": "a592a405-259a-49ff-a17f-07f862452622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752383, "uuid": "26bce063-0344-40bf-a331-06de28e62139", "value": "cf69196ed8e69cd16d6c66674fce52bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a63301a-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753882, "uuid": "288e9afe-32ac-4b8f-a092-abf31d61456f", "comment": "Malware payload (Gafgyt)", "value": "4eb00fe39d24bc851c525c358bb44ef3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753882, "uuid": "f153e396-f75d-42c4-8eb9-f62fca4e2ac6", "comment": "Malware payload (Gafgyt)", "value": "bbe2c296f919cebdcd6abf37c8f2c3fc033d2c900e4bb38d1e37c940075049c0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753882, "uuid": "7ab9f3dd-5849-4f23-be8c-de081106dea6", "comment": "Malware payload (Gafgyt)", "value": "779d99c385608e72f8977cd0a31db973a14ea724", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753882, "uuid": "6ce42104-2803-40d5-bb6d-3f91ee9d8358", "comment": "Malware payload (Gafgyt)", "value": "86017b5f996222a8e9530b7cf1be913474f2e1dd46fce1e535444724032eccedcfe5acdecf7668914f9452a44640489c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753882, "uuid": "71dd126b-d618-4925-b658-0976940d6f0a", "value": "T1C104E91B6B618EB3D81ECD33029A1201108DDD6B55D97BAFB2B4E95CE76A84F05E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753882, "uuid": "87c20177-f7fe-4874-91e0-b93b050f0cce", "value": "3072:C0q19Qm7VpLRYetJ8add9Qzhsru8vdfi+KqLwZi+LUk:C0q19xVpOetJ8addQuJdfi+KqLwU+LUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753882, "uuid": "d8003f55-b044-4c88-ad2f-88c195f34d29", "value": 174954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753882, "uuid": "c315112c-0530-4b7c-8bae-81c233945345", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753882, "uuid": "4b7b8239-5a09-4447-a7ae-e789fc1caed0", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a7817c-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757869, "uuid": "80dcb3a6-85ff-4ffb-adff-7dba86699d56", "comment": "Malware payload (Mirai)", "value": "4810645e6bf33004e38b95386f4f902b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757869, "uuid": "a65124a5-fc9a-4240-a849-b7f8bbd0c787", "comment": "Malware payload (Mirai)", "value": "bd14e20c6922a8c379e7e26023000f42c2df1be1fc4036ddaeba0027ce6662c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757869, "uuid": "1d7ca8a5-e805-4d93-b2c1-252c49c42bd3", "comment": "Malware payload (Mirai)", "value": "10c8606f00dad00b720a2261e06de43713575d8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757869, "uuid": "4df2b2cc-2504-42b4-8634-3c9647c011d0", "comment": "Malware payload (Mirai)", "value": "0fa0dbddf980a6a3fabc6df655f91f93c9cb63d564867d51c4cf878e6762606a41ffa4e95d2e634d43eef2e8048c5794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757869, "uuid": "30f2bb2d-ce56-41ba-9be0-7b0680690b0d", "value": "T19E43AEA3C9BA1D18E04949B475345F3D6B63E949E28B1F9AD4A5C339A013EDCF8813F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757869, "uuid": "c564f710-28e5-4bb4-b9c2-898fe2897081", "value": "1536:2Ox2ziUDhqLrD+PxoORIMKvOc1oebQLCZod7Nze:2Ox2FsLrD+JHoveebQLx7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757869, "uuid": "653b71cb-4d07-4c36-8fd2-596392677c20", "value": 55680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757869, "uuid": "f0a24036-d6c4-4469-b990-4f19dbeae6ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757869, "uuid": "77bafb35-5fb3-42b8-93f5-12722f2ec507", "value": "4810645e6bf33004e38b95386f4f902b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36e59eb-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771722, "uuid": "519a2d6b-9450-4a57-9125-d6fa3f7f51e9", "comment": "Malware payload (Gafgyt)", "value": "4bcb13a2821ddd022e0486a47c6f0398", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771722, "uuid": "5f508c80-338a-459a-9153-0a97d4846fd7", "comment": "Malware payload (Gafgyt)", "value": "bd9b062c380789b14d64128be3e9343633ced76189bfc422157e2b51c1de465f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771722, "uuid": "03a85b77-4a71-4f42-9a86-11f48829d9af", "comment": "Malware payload (Gafgyt)", "value": "a8049dd35ea1780011615036948524d51d717bc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771722, "uuid": "2aeaf034-2eae-4e6b-93ea-291dfe6b77e0", "comment": "Malware payload (Gafgyt)", "value": "234e8acb034536ca2a3d23f00df816b15e0e67d9084d3db317ec7a66b980bff4eb94945d21817ad6fa03bcc61337c6f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771722, "uuid": "06d04c7a-3a97-4558-bc86-390f5c6aa8c3", "value": "T172935BC6F703CAF3C4430AB2029B9B660931B9BA5A2AAE45F35C7DF49F164C87116B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771722, "uuid": "6f4691bb-64b6-4997-b262-7a5dfe34bc4a", "value": "1536:+EczhCBSPcqVjeWDKSt83ie7WL+51VaXt1LGZ8pFJMZpimJIWVOCjXZRs9S:GhCBSPcqVjeWDJe+Cv8Xt1LGSzM6mCWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771722, "uuid": "343a9020-6815-43a6-80be-731cd22e5547", "value": 89233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771722, "uuid": "2dd205fd-094a-4fad-b25e-033922992d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771722, "uuid": "6a4ef40b-31e7-4e7e-9ff3-be57bb2712d2", "value": "4bcb13a2821ddd022e0486a47c6f0398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b933f6-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710763218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763218, "uuid": "1d0c3175-132c-40c5-8747-a09e2c6a81d2", "comment": "Malware payload (Mirai)", "value": "0dbd24ad99dcb38241633fa5a3317304", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763218, "uuid": "cb87e4ca-93c6-4279-9b90-6966b9d9c247", "comment": "Malware payload (Mirai)", "value": "be5ebbb035b0125931fff16f30c79af04632bc26f1dfa62fdaf5ad70f8d2d6c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763218, "uuid": "ac062eca-5740-4989-9a4a-3ff18cd742f9", "comment": "Malware payload (Mirai)", "value": "6d4fa0fdcec46231b49866f863c6281024a1a45d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763218, "uuid": "844e0d84-5632-4e1f-b038-3372ead1952a", "comment": "Malware payload (Mirai)", "value": "399766185cd0f07306ee3dd5b37b1cc0b054ebbad43d691e317b558a1ffa5a408163f61ca1d65d9aaa7a6367866b487e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763218, "uuid": "cae44130-028c-408b-b524-1c108124ba66", "value": "T1F724A61E6E228F7DF268873047B74A35A76D33D626E1D684E1ACC1145F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763218, "uuid": "59c9175c-7ad9-4159-9fa2-5f51231ae563", "value": "3072:FV1/4YituUh828H9dKepskVaoM5IgSYcwSYRVPmXs:FV1/Ji4Uh8249d8gaAg6/YrPmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763218, "uuid": "3d610b59-851f-446e-bcc0-bead5cc17a5a", "value": 210176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763218, "uuid": "574f85ac-6e26-43ce-ac0a-1ff0676c3a97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763218, "uuid": "5b2649ab-3eb1-4a64-a052-59f2a0e63755", "value": "0dbd24ad99dcb38241633fa5a3317304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51c376f-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710769550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769550, "uuid": "4d8e184c-e42f-472d-b68a-4ce151706f44", "comment": "Malware payload (AgentTesla)", "value": "37777b1f19e7f5ff9bb5ecf9213dc3ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769550, "uuid": "5ff11928-755e-4997-aedb-a7e02143b156", "comment": "Malware payload (AgentTesla)", "value": "be629a7b933524a2e5a2376124aeee2654857d77a0a0361a7d57a814dfedece0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769550, "uuid": "db66ebb7-421e-4a46-bfe1-8a2460cb1482", "comment": "Malware payload (AgentTesla)", "value": "76bafef11dcd69d2b6cae448216e4f15f298b0d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769550, "uuid": "e17c70f9-5b79-4727-aa17-184b85027118", "comment": "Malware payload (AgentTesla)", "value": "5f09b98bf66af31729a734aba1ba068a32cd964c23f11318ed459b4dd9eb6e1dfaafded57fea14ab3456465ee065c3f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769550, "uuid": "ac08e239-de66-46f5-82a2-52e63afb89d9", "value": "T1DBD4233917299A32C495633BBBF66480073AEB93650FD3AD5C6D24CC7F1AF809B32459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769550, "uuid": "608bb944-5b45-4415-ab75-b9bc7f502270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769550, "uuid": "0f8f29e3-cc63-431c-bc5d-087ec821e7c1", "value": "12288:64RGOJm9X+svYj/g+fM48lQRFMiWr8uwbL/7WD2iJVt6+dQiqgBtgRh:hAOJm9X+sgs+fD86fDuiL/7WSeTzQTgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769550, "uuid": "7d8be662-b9a4-4a62-a38d-ae6a58b402a7", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769550, "uuid": "20fd782e-70a0-4823-ba48-40ef43bf0b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769550, "uuid": "2a78fbf6-e4d8-43a1-b61e-3b7620c85d93", "value": "Faktura 2024_10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac74fd4-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710745615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745615, "uuid": "32cb61bf-6e67-4865-92c4-be4bc973c6d9", "comment": "Malware payload", "value": "e9796558d44f57b1331cf23e20634d03", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745615, "uuid": "1dc34ea9-d05f-48c6-b58c-097c942f810b", "comment": "Malware payload", "value": "bf17c23eee00ffc739e7199a48f3e519f2cec1e2882645b761d0bec9431796ae", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745615, "uuid": "b98251c8-cea0-46ed-bd2e-1d751b74e174", "comment": "Malware payload", "value": "bfcd862543970ed421f0a36567ade592f4df3489", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745615, "uuid": "68a7ba8d-25d9-4e1a-ab69-0c4c5476e291", "comment": "Malware payload", "value": "7f6bf5be7c5aea3b6b1f6580c8f7f1bc9b58079f774c31ac2116e4a5b85b51b6aac2d169e2071570d4817f72baa92bb6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745615, "uuid": "518d3009-f688-4c32-a654-8d1eb65f8c33", "value": "T150A2C0CFAD4B8C39F309D4F668C60A52A1D2A436B838A547313951D8CD74A6BAE03CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745615, "uuid": "f3c46e33-7d4e-4e39-8be1-e51e545b4fce", "value": "384:0M1+XtwS545OLAzpsbJQAKUdKKdKqW7E9YpvdDUlTdfp7RcGVUdowq7JHnTqYZIk:0M1raLysVQhUdnUFpvd+dfp7aG+Cwqpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745615, "uuid": "a263bb90-8b07-4af3-9f8b-06ff3d64fee7", "value": 22367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745615, "uuid": "f69296fa-9083-45eb-872a-13af5964283d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745615, "uuid": "c5bd0178-50dd-4b2e-b5e5-9a93a901ad3b", "value": "hjsj.GZSendYQ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8b2b95-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760414, "uuid": "d85bbcd5-a7c3-463c-9990-75580f67725e", "comment": "Malware payload (Mirai)", "value": "90215b57fc00af4f7e0d4dcffbdac1de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760414, "uuid": "a13602e0-14af-4b93-8ab9-c140e800ae4b", "comment": "Malware payload (Mirai)", "value": "bfe36f455a4faa82d7e3c8e47cfe5db7877afe3f219c279f21677b091e3d6fb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760414, "uuid": "a2a31b4f-f04c-457c-b590-016d4cfe8f22", "comment": "Malware payload (Mirai)", "value": "ec463f975d84e0ad51a9ce0ac4a4151f5ccd2170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760414, "uuid": "f09d19e9-eb10-404d-9b3e-963932280b02", "comment": "Malware payload (Mirai)", "value": "b79929c403c9713e234a48dfed9e94d5c31c1664d05084cbf3d17044591808aca4945585d11c27ee0a3b395a6a2aa913", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760414, "uuid": "1e700a4a-b4d5-4575-866a-496c5c161f5c", "value": "T1AFE31A45FC909F66C6D2267BFB4E42CD772A0768D3EE720399255F24378A85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760414, "uuid": "1fda4e62-662a-44bf-b2e5-2e98176e9749", "value": "1536:QT4Hqn19SOaXCap+6IRaBI9p+lqVoxONEePlZEJAD3jXTzW4QOfUOv9yHsTBOalG:7qz1aXn+/NPgJAPX+4dxYslX58M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760414, "uuid": "a653868a-8125-4dca-a67c-6fea48506f22", "value": 154336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760414, "uuid": "80b6c244-9329-413e-b091-9c05cf432d42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760414, "uuid": "c6a96bf9-0f8e-4c9c-ac04-f1b9a4f8f661", "value": "90215b57fc00af4f7e0d4dcffbdac1de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3f7a62-e538-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710773996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773996, "uuid": "5c9aae74-264d-4dd4-b937-4f6dbaf986aa", "comment": "Malware payload", "value": "607acc5a6b670bd144bf3897cda6b233", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773996, "uuid": "6cfbeab8-3d9d-4397-a6b7-479ffbbbd225", "comment": "Malware payload", "value": "c06da1d7ce6843074ae3a964dc8aa862151f2196c0e15964d3d9959a44ba89f8", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773996, "uuid": "7cc6ec0a-e820-48f4-95fe-eb59af6c1d12", "comment": "Malware payload", "value": "24a2fc93216adb3543ee555473b2f61f333384d2", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710773996, "uuid": "f1bcbbef-1e6d-4489-827f-960d0ae7b799", "comment": "Malware payload", "value": "ebd3b041c3fc6691c18e2cea6d499b61a9b3cffb6cc5a1b1cc00842f62247c46d739e35f90ef262ba119b13d5a340eb2", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773996, "uuid": "c3d5e3c7-4b75-40fb-9272-549da11ba5fd", "value": "T134937D45F3E241F7EAE10A7100A6712FE73966249724E8DBC34C3C829953AD59A7C3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773996, "uuid": "92bff230-8ef4-4b3b-8f2d-ac247b7d0213", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773996, "uuid": "c3f22e7f-a077-45b3-abe2-d35d46ffdc9c", "value": "1536:r7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfLx4fmSxL2MO2:nq6+ouCpk2mpcWJ0r+QNTBfLyfmSBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710773996, "uuid": "a0eb864a-3b16-4d30-9d97-09a28495d12e", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710773996, "uuid": "6b313c82-ac4f-4b7f-b712-39b33f69f676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710773996, "uuid": "5ab1af5b-f286-44c9-b75f-e1d01070606d", "value": "winserverupd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771128e1-e4fb-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710747918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747918, "uuid": "4068a9ab-63d3-4b46-99c7-89b2e2477317", "comment": "Malware payload (RiseProStealer)", "value": "208fd3daed1f18d0c6718e69bfcc9252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747918, "uuid": "71e48a99-1411-4f57-8518-cc4458fca109", "comment": "Malware payload (RiseProStealer)", "value": "c107765954316d87950abe6b88f486976bc46931fcdc4a1ff3e742a81856c2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747918, "uuid": "a6d240b4-0656-4094-a66f-d458174ef108", "comment": "Malware payload (RiseProStealer)", "value": "140c72c973f167bf55efaf07667aa285209b0426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747918, "uuid": "804d696b-610c-43da-914b-a628a88845aa", "comment": "Malware payload (RiseProStealer)", "value": "e8c6d1b18193d00887a463babf79b448411a8608988df521373d80e6d5e05d479fd4fc55555df4553656ff12952a6d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747918, "uuid": "e962cc90-58b3-433d-abb7-12405eecee84", "value": "T165E56C92B50A71CFE4BB27B8D46BCD426D6D06B5472908C3DC6CB47A7E63CC125B9C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747918, "uuid": "2f3c911d-75dc-474e-83e3-b9837fcdbe92", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747918, "uuid": "3f78600e-25fa-4da2-b214-9787c7cb75e0", "value": "49152:RCgaY2egfPZaFah22EYbl4zl2Di7jORic4abwS9DkwH:ogn2eYxaFU22EYbl4zl2DojOSabwSdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747918, "uuid": "5e0d16b5-a248-4a01-9a54-4f718ef01361", "value": 3209728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747918, "uuid": "0e1210ba-ab3d-4c93-b31e-149ddeb4c567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747918, "uuid": "7bba28d3-6416-49d0-9066-4a4f7f910968", "value": "208fd3daed1f18d0c6718e69bfcc9252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d79bb98-e53b-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1710775228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710775228, "uuid": "9f5d642c-90bc-4755-9d25-c22061e71af4", "comment": "Malware payload (SnakeKeylogger)", "value": "e3f761aaddc5dc46f6c6e92d611a59fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710775228, "uuid": "76efb1a4-236e-40f0-93eb-9e036a8f01cc", "comment": "Malware payload (SnakeKeylogger)", "value": "c1ecdc617db839e561aa5318e3458ce0f0db30386f8b9cb5586314b2e75a8a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710775228, "uuid": "8fecc1de-2695-4f61-af72-786d243688ac", "comment": "Malware payload (SnakeKeylogger)", "value": "81f7d3a2fef67f130a1a612f774fd749e02c0ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710775228, "uuid": "6f930d7c-b574-4387-97d8-ba1c3d4cfe3d", "comment": "Malware payload (SnakeKeylogger)", "value": "e5e910778f7085bd4a70b31a3d213803f80bf340549aa5bc3969785472155960951695b6c4ea2478f53828a5c3941c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710775228, "uuid": "100b197f-2a85-4ce3-8b2d-19c3fc25c54d", "value": "T18B053DD1F15088DAED6B09F1BD2BA53024977E9D94A4810C569EBB1B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710775228, "uuid": "c643e2ed-345e-4c6f-a145-2030c2c86657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710775228, "uuid": "68944b6b-bec7-42e6-a3c0-0e453e902f52", "value": "12288:jPgRh4JrZQvYs/hWBG4zbp2kyBburYh0gD9eLRUhMhzMH:j4JYcIo29yBb/hZZAmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710775228, "uuid": "fc95d401-d37d-4c71-91e8-1f0290381b2a", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710775228, "uuid": "a9297d31-d396-4a40-b139-cdc074c6ad67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710775228, "uuid": "eea83643-2e7c-4d2c-953f-337e505b6832", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703d7270-e4df-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710735880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735880, "uuid": "9f8c9647-8b9d-484d-93a4-782c1638ab2d", "comment": "Malware payload", "value": "23e61d8d0dea2f7f5f7eddc12898b194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735880, "uuid": "15f7aad8-d243-4035-9c76-dd46af348d49", "comment": "Malware payload", "value": "c26fdcc6643e594a140e511904bc2909df52714d1f50012d0a6ce904a4e74696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735880, "uuid": "9aeac1a6-f7da-44e6-9dfc-7f377df9ddab", "comment": "Malware payload", "value": "ddbdaf88758d028f29e49f5bab3053229ff9d4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710735880, "uuid": "4e44b8ea-d93e-40d3-bd55-3769dc85eb12", "comment": "Malware payload", "value": "277e50974323975784d4173a2b06c80ef4b82c91cacf3557118ab03ece2d27417a7b57c97169f95b9e8a447386127f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735880, "uuid": "f88be0c5-f965-48db-ba13-4b868756b6e4", "value": "T15276D042A3D140B0E5F767B0413BA7266B75FB15573A81CB63A0BE48AD307D1AE36393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735880, "uuid": "0e419730-c176-4b02-96ea-69e92944f50a", "value": "06bdd6b4df1690ce0efb3e427ec294cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735880, "uuid": "275aa5c2-3868-467e-a2c0-af615a2f826b", "value": "98304:oLIwFIHYvtAEkVuuL5BFkFDtA1z2m8cemom2eCbwdCZ:qSHCA1uuLyDrm8ceheWwdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710735880, "uuid": "453c3ad5-f9ee-498f-9bd1-37174d027a17", "value": 7768383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710735880, "uuid": "3aa50395-8540-4851-9953-03d1eba6dc6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710735880, "uuid": "f04c4b9b-6c40-4982-8dc2-3b085ecb218b", "value": "SecuriteInfo.com.TScope.Trojan.Delf.27946.25605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eeff59-e507-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710753229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753229, "uuid": "68395847-d322-43ba-ba94-0880c82325b6", "comment": "Malware payload", "value": "b6ec5c330b181ef926349448d8dd0705", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753229, "uuid": "3843ef44-eb63-4769-be69-e32bc55a4c76", "comment": "Malware payload", "value": "c3279fd7ad2753e3cd62c08a19fd4eef271610ce3000324f3edbea927d26fc6a", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753229, "uuid": "8496c5a6-3a97-43c6-9edf-0809df8df0c1", "comment": "Malware payload", "value": "9ff8ec1fc255c0b1d0935c51e2aafc1a229bb3fb", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753229, "uuid": "2590eaf5-cbbd-47e6-8861-d6f2610117a4", "comment": "Malware payload", "value": "69cbf458f0fd39e6b6efd4753345c9e5fb112a208d968fac14a2ee881f1da196f6d8062d46c9dfdfa7fdb555905f3718", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753229, "uuid": "df32405f-28e0-4c85-bdf7-3909bd52db89", "value": "T1F723F139E3292940C8F4983C526D0793B596119C8743FA777AC9790D5186EFA33AFD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753229, "uuid": "3e193546-c7c8-42f7-a4cc-fd281f34799e", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/9:tLq94YV7JMxXyd4x+gzexTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753229, "uuid": "0174643e-da01-4b07-81f8-10da344a02f6", "value": 49374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753229, "uuid": "1894d174-1645-4a39-be5b-43b6f3977f1a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753229, "uuid": "167bfd8d-188a-42d9-ae7d-676b529434b9", "value": "ACH-7519-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6b3f44-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757828, "uuid": "6406c3c3-cf14-448c-8eca-6bff6c3b2a69", "comment": "Malware payload (Mirai)", "value": "aefeb754da870dc8641f67f3c14b71b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757828, "uuid": "c48a68b4-2ef1-41f5-b3a1-c6cf2d3892fc", "comment": "Malware payload (Mirai)", "value": "c413b8b64322a8c2a0ca027dbd51ba6ed77c8bcfa64dcfef70cb6da1c33a5dc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757828, "uuid": "fa12cc75-118d-4bd8-845e-3369b43b7c59", "comment": "Malware payload (Mirai)", "value": "bfeff72042ea11324c447786cb9586c5c8e8b658", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757828, "uuid": "f4404c19-7ea2-4556-9ed1-e0a802b6354f", "comment": "Malware payload (Mirai)", "value": "0040b29d85838f49d4e347bb7157d669f8e1b076110c5bf9789ad504ee209be0498b0e21c3d309751b640afc77921949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757828, "uuid": "f921ce1b-65b9-483d-966e-36acda78a56c", "value": "T199436AC2D782C9F8EC4215B110376752AF31E83696B5F787E7A82A76EC13700A61739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757828, "uuid": "18a47c04-86b2-4bdd-83f1-b14359233495", "value": "1536:wJou5tEg986od9b7Q+wGQzrW6MwgRj6AtXNDXKl:w6ej986od9b7ZwyPwgRjdt9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757828, "uuid": "4f9fbcba-9852-45f6-9b50-70e79d8ce0d3", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757828, "uuid": "e21c9935-8c88-4e13-80e4-c20a6161bbcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757828, "uuid": "f2bd5d99-1c89-450b-ad93-315bcfbfd88d", "value": "aefeb754da870dc8641f67f3c14b71b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f03148-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763624, "uuid": "8e9885c3-01d0-41ce-ac79-810640830e3f", "comment": "Malware payload (Gafgyt)", "value": "7a1826891ecf3fad22cc9a5b9fed40e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763624, "uuid": "babc1cd3-d004-4dfb-9cf2-994f87f70630", "comment": "Malware payload (Gafgyt)", "value": "c42e6372b13b19f94d9aa28bae5cbe7e00c6c4fb43974dc58495977e102bc65f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763624, "uuid": "e654e742-9ef5-4101-aee8-b57b7dd1276a", "comment": "Malware payload (Gafgyt)", "value": "de45c5ac531e2ab6791319f953d04532c60fbe42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763624, "uuid": "fd4a495c-b0b2-4157-ad03-419e11373c84", "comment": "Malware payload (Gafgyt)", "value": "41e6034bdcfd3138892137b582494b36d8c72ae5a36867df49962693cae3470e2468c9a7dcbb4fc725b3a52a42ddfbc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763624, "uuid": "16aa575d-ac30-4bf2-9499-ab57d0b9d681", "value": "T1BC041A09D6408B17C1E2277AFB9B434B33239B94ABD7331656285FB03FC27996E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763624, "uuid": "d15c0017-d893-4dd9-9d6d-61b2060ea9c1", "value": "3072:wWJ2XrhIrTJhml+SN44jattKm3gUwK398W4rqTw5h0gV2SNpM/9XzP9mowhbRWzZ:wKSZjattKmQUwXvrr5h0E2SPM/9DP9mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763624, "uuid": "e230ca1c-d965-41ef-9919-736bf0d8feed", "value": 179628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763624, "uuid": "8ed1520a-5372-49f9-b266-1a65f7636c5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763624, "uuid": "a560ce7e-10ca-470b-ae8e-5003537a0d97", "value": "7a1826891ecf3fad22cc9a5b9fed40e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55b3d3f-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710767833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767833, "uuid": "21acd3d7-d7b7-4618-81dc-d971975aef71", "comment": "Malware payload (GuLoader)", "value": "93d1942c204022e792af256d0ccbe8e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767833, "uuid": "c0319b57-3ed1-40db-94f1-98cbd0fa16eb", "comment": "Malware payload (GuLoader)", "value": "c44904bfb8b44d8071f33359f824028597145f76bd1a6baf86d91679215e3c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767833, "uuid": "8f5b8cdc-c413-4c27-888f-78613efbbef2", "comment": "Malware payload (GuLoader)", "value": "76649fb41dc760d4c9ad8be23e239fcb7b0e2418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767833, "uuid": "57839633-ba72-40bb-aa79-9475f0bd4270", "comment": "Malware payload (GuLoader)", "value": "b9211b81e7929c1600cd0e010fc96d6aa198d5562eecee855391aef4e508dbaefb5347d1662bdb8637948d58d0e0050e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767833, "uuid": "c97a0abf-d0d9-401a-a759-5d1e976132e6", "value": "T13405230253534061F8E2C8B149B5E3A2D438BAD8D329D60E6B7425B9765FF62CE2533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767833, "uuid": "b6add2de-1652-4e4a-9174-51d80dd8c58b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767833, "uuid": "501bdcb7-5ff2-474c-a609-e738b9765888", "value": "12288:7qL1BIckrqvvW+ziaB/5FsfecWGClPW3ObwMB8aqEEbViGCyQRy1/6dzgA6zZxfV:A8ckmHN5Fo+GClPgBoZyQqNbbfNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767833, "uuid": "07d3679e-d31d-432c-9cd0-0089f0132a38", "value": 826296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767833, "uuid": "0e48b349-dd3f-4898-ac0e-eadd1c5ad4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767833, "uuid": "6cd5777e-9546-431f-a4c4-272c046a08df", "value": "cuenta para pago1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab7d764-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745776, "uuid": "b0e3c5c2-63a2-4fdc-b84c-f81b2ad5d1d3", "comment": "Malware payload (AgentTesla)", "value": "ac5961d86e95721920bbaa055049a2f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745776, "uuid": "ced7121b-9d02-41d5-9f6f-4a77f84a0aa2", "comment": "Malware payload (AgentTesla)", "value": "c47b5b5e01d11e26d7bf7b4c23ee682fabc71db90be27da4e69f3c5045dd7bef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745776, "uuid": "3ed83eb1-5f8f-4945-9687-75937136c080", "comment": "Malware payload (AgentTesla)", "value": "9db4e33efb83d9029e737d7105c6a16d0ff763a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745776, "uuid": "e96448dc-e8f2-4968-94bb-50e0b83abeed", "comment": "Malware payload (AgentTesla)", "value": "972ea55a642971f61926d7ae86e558ff1ab358e5aac937262812bec9bb19821c1e8a33b431076a999a05de94eba985b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745776, "uuid": "4854e771-c88b-4fed-838e-e493677aa1dc", "value": "T187F29E2133F8D545E549D9364ED6E1DB6B20FC43EE638B0BB6857B0F243A990C452B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745776, "uuid": "f8816a24-7339-40b8-8038-67a117c1f146", "value": "384:D1rexSDrIw6OeA+qpUpWrpEgDhvC4w8zLtCEcNTbHfFCF375JDOJJMUXZ:DIWsOe1G/DML83tC5l/cbDOJJM6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745776, "uuid": "de1e7027-30c5-4cea-8c69-1d51d80fce25", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745776, "uuid": "c605afc1-a5cd-4b22-b9cb-e9cf4c0a48e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745776, "uuid": "43eb3613-5097-4154-9052-d92225f5ede5", "value": "CA-OP2402406.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9cfe84-e53d-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710776411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776411, "uuid": "f3bfb082-a181-440f-89bc-5bccc068eabc", "comment": "Malware payload (RiseProStealer)", "value": "a47eead04af17f509b944a444558dbc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776411, "uuid": "86cbaaa5-9dee-4fe1-9a2e-e4e49922cec3", "comment": "Malware payload (RiseProStealer)", "value": "c48eb226b641b382fd4155f10c96aacc585c6e65814865cd762e88b8a5cffd14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776411, "uuid": "5fa5c86a-e3aa-43a0-9cc7-8df39de215ae", "comment": "Malware payload (RiseProStealer)", "value": "08bbc8a08f591b3fed91b45afb1b81221747f088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776411, "uuid": "0516e118-d94b-4ca7-a882-b07c30a49a44", "comment": "Malware payload (RiseProStealer)", "value": "8761931eb3f865f061a164da0e0a7395894dbea2d59852a4355995a04a9b9fd78bc82580f3fa587ead5d8b015e976e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776411, "uuid": "dd113533-eaea-4956-adfc-df670e74b1bc", "value": "T1F1A533819E72C5DCCCEA027107D9B74CAD7C8C0AD1A6942E784E7BEA2F35A476BD14C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776411, "uuid": "c506c126-bafd-46ae-935f-9b635f6b6a93", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776411, "uuid": "6933eba9-525d-47ca-b10a-f74550ab03cb", "value": "24576:rWqG7809+QZf3RtTdIoITU1m9s50hCoFE+B4nJ6aFk8F6SYc2SK8bUW6UmUspa:q7x9bpL0am25KFFcpk8F6SnrQIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710776411, "uuid": "9331f15a-cce4-4c27-93d0-85393e178e22", "value": 2068480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710776411, "uuid": "8bc9a10e-8aa5-4898-9923-5b08e0b4cbcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776411, "uuid": "20375b20-38f8-4acb-8368-c719997f1f4b", "value": "a47eead04af17f509b944a444558dbc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36de9d80-e4ce-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710728483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728483, "uuid": "6d5d6b77-f56d-498e-9198-54e8a462e29a", "comment": "Malware payload", "value": "95609b5a5bec0a5f5a0b6e8e4d8f1cba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728483, "uuid": "e3a61cfe-514a-4522-a9b9-6414bc8dd228", "comment": "Malware payload", "value": "c4d149787cd8d77e005d76a784006d3ce61c2c809aacaee102af556c414f161c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728483, "uuid": "436c79a1-b414-435d-ab54-4c7498fdbc45", "comment": "Malware payload", "value": "971f40eb392052a84e736831ff616d06ba09c640", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728483, "uuid": "b18d0368-da4f-4de5-825b-f343f770784d", "comment": "Malware payload", "value": "d856f4d9294b0d49465dd370f7c9e9cce5a0e868db9f8988760baf9558deabb376e2c39c013103672a6b5ab72bf568de", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710728483, "uuid": "0ae84d79-a449-448a-ac72-0595e3bc44de", "value": "T1B2B6F187F76C5A2EC4774172CC6A5232D66E4F118A8397476848372D38B35E88F79BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710728483, "uuid": "daf85863-8329-4545-bf65-7512533f5f6b", "value": "196608:1Yx/B4VfH1MIfe7taI67SUcdNtDMjL/BrvAGyLOhX+wqw0r7vFu:o4h1lfe766VDM2GyLOwbz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710728483, "uuid": "19c1ed9c-b027-465c-9f84-8d41791f561f", "value": 10504967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710728483, "uuid": "6468e6f4-05b1-4476-8a04-2d2dafb9a706", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710728483, "uuid": "902c544e-4b1a-4896-8551-45a1f95348bb", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c749d644-e4fd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710748911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748911, "uuid": "e2f1d5e5-774c-41b2-99ee-9bd6603df6dd", "comment": "Malware payload (Mirai)", "value": "846d21ae234dde2e5d9d8dc8759ec1ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748911, "uuid": "eb0070fc-8bf6-4f46-91ef-acb8d2d6f24a", "comment": "Malware payload (Mirai)", "value": "c4dcabcfbe4249d38069557b0aa42928dddf5ecc15bcafcfab47a3f10dcd8250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748911, "uuid": "60e8ce28-4258-4966-a994-6f00f75e3ad3", "comment": "Malware payload (Mirai)", "value": "f9861fa51fac9f0e8996f4e695e9cbeb953796bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748911, "uuid": "9a206b94-0d3d-4792-ac52-6a503376007d", "comment": "Malware payload (Mirai)", "value": "f00ec5248019dfd06154b4808d30e8511d239a96437cbd06bd4343481c95bc74aa075cc2895755a8fea4fcc387b823c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748911, "uuid": "dd33ee02-d5cd-4050-97e3-1c5fcabb4633", "value": "T12763C44ABF650FB7D8ABCD3309AA170125CCA51B25B97B357934D82CB50B24F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748911, "uuid": "f6e9934a-d7f9-484e-bda4-e7e25f9b7d14", "value": "768:sG5/Q80+/Wh2IAdUjTBy1ewe2OeDrt1w99ZYuaXi4nKZcBLwR:sOQ8z+EIAdOTypPOsTw/ZYuRZcaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710748911, "uuid": "23c1813b-ac64-4b15-a02c-bb95bc793742", "value": 68584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710748911, "uuid": "d9b21681-c72f-4e38-9bdc-6c68a32c88d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748911, "uuid": "7229161d-c8f7-4434-898c-81cc34d2341a", "value": "846d21ae234dde2e5d9d8dc8759ec1ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea755bf1-e570-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710798362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710798362, "uuid": "91ac7270-fd07-4edb-8845-9f80147eeaf0", "comment": "Malware payload", "value": "4ba67d3b9edeff8c27f96b948fe9ed9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710798362, "uuid": "fbe2f946-9334-4e6a-a750-32d4aef231b8", "comment": "Malware payload", "value": "c54dec8c6c088c7b13267214dbc9ecb2f1e7aa3883e5bc4abe80accc83d32131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710798362, "uuid": "f36cd424-7770-4822-95fe-bef13eaf5584", "comment": "Malware payload", "value": "d7bf171e91e6402ea34a5b26a21332d370a4ad1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710798362, "uuid": "080778df-ecf7-4eeb-9e40-f17c2360094f", "comment": "Malware payload", "value": "3f527fa0e3db068881301d2ee024fa1daee0e0d8a20176340ba63f5bb2282891084406a16d081914982aedff7f99c91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710798362, "uuid": "c0f4eaa4-c525-4951-adf2-20365d5fd250", "value": "T1CC168C1AF7D801E5E467C734C92AC732DAB1FC1A1735D24B0512F36A1E37A918FAB225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710798362, "uuid": "1e1d67e7-01e0-4d43-befe-7d9d61a655c7", "value": "485b182ba7ddc45d0208ae5f48f5ed13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710798362, "uuid": "9745e90c-5378-42f3-a708-d244fb399a64", "value": "49152:VYrrh2DnEUGrbPFpWnwssICYgFUCLEeMwLFVO8lRzKuo:V9QeIWwzJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710798362, "uuid": "f0753b33-d435-4bb7-949f-ea9a53e93162", "value": 4248288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710798362, "uuid": "0a9fa9a3-56e6-4809-bcf1-b7b354c5bb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710798362, "uuid": "65b3bd11-6953-43d6-be68-8faae38c2954", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea77e05-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710763231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763231, "uuid": "750c8d69-430f-4992-9353-16aaa407c385", "comment": "Malware payload (Mirai)", "value": "e9e5f4c4af3c3c0757950ed83bbe3f7a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763231, "uuid": "149f2f3d-4e70-4f90-a732-1eeaefb14002", "comment": "Malware payload (Mirai)", "value": "c5edf52f0e61dafa88879e09fa8952dcfc83bc45e0f6903dc1b9e431a44d0c6a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763231, "uuid": "383515cb-4e00-4a43-98c3-42e34a208a8e", "comment": "Malware payload (Mirai)", "value": "b5a884633642919ee563148326549a1f6bb8ea22", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763231, "uuid": "a5c663fb-bd8d-459e-b4d2-f43d3f5a4ad3", "comment": "Malware payload (Mirai)", "value": "8a8d75802051e151467f935b59ec9e56162bb386f93241216f244d24d2d80dbe8e28615aa32381b17dc032d56b29a46b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763231, "uuid": "7540c203-2889-4c66-b106-507c75d24c1b", "value": "T121F35C16B0C1C8FEC49AD1744F9BE237D9B2F4290138B66F27D4AF122E5EE605B5DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763231, "uuid": "c9a9f50b-f854-4783-921d-c3bb9390d045", "value": "3072:TXrzx1fRP3su2Xd6FnaaYETKpzpMob3rZPrWYiv/mLQYa:zrdHP87o5i3ZP0Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763231, "uuid": "3d2623fc-6694-4128-9ea2-0d1e0624a997", "value": 164072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763231, "uuid": "3a0f44a9-4fff-4883-a1b4-df87e05a5823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763231, "uuid": "1fef938a-a05e-4e57-bfdc-4bb8591f3fc4", "value": "e9e5f4c4af3c3c0757950ed83bbe3f7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9584084a-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710766008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766008, "uuid": "803b4200-5846-48f9-a124-144806ea1ef2", "comment": "Malware payload (Mirai)", "value": "55c89eb675e841f4c6e26c3a5cd6c3ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766008, "uuid": "e77bb880-c129-4b6f-b37c-0c8bb5e7584e", "comment": "Malware payload (Mirai)", "value": "c79e2a3562e3453cfc05d7f8c8a813c4f10df429ea1a893e840f15d44e504c58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766008, "uuid": "dc7b2a6d-c45c-4b83-96ef-c09ea082ca09", "comment": "Malware payload (Mirai)", "value": "8749bc7d9e3a70b4976f26b693f556ae1e79a1b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766008, "uuid": "c469728f-56b1-4174-a6ec-0efefb1903e4", "comment": "Malware payload (Mirai)", "value": "75ec63ebed1377d28e8f3b769253a88fe245bd452627c9bf63675182ac514e3729db4b1753f41f4cb3605ec5332b62a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766008, "uuid": "8dbe37fc-7820-4238-9173-77a1447d7a64", "value": "T17E53A50A2E618FEDF76C873047B74E219758239626E1D6C4D25CD9001FB438EA46FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766008, "uuid": "0743a17e-d676-4620-b80b-16aa748af27f", "value": "1536:IlAsHMoqB4B7whyh3Jv9WhFe8Wy9u4UjQHbuvBg:It399Eyh3x9WFe/y9u4ZHb2Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766008, "uuid": "0fddccfa-5713-4597-baad-208a8bcc4705", "value": 64184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766008, "uuid": "9e25db32-5117-4b2f-90b0-1b52ab3f9e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766008, "uuid": "e69fdc07-b8ca-48cf-90e0-a457c0ae4f2c", "value": "55c89eb675e841f4c6e26c3a5cd6c3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76ab898-e4ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710741690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741690, "uuid": "91837cff-105b-42d8-bf47-e0206b369559", "comment": "Malware payload (Gafgyt)", "value": "e76e5947ca505e9d016a7d753640409c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741690, "uuid": "3e0f34c4-f3f0-4aa5-ad2d-e7878d2bc344", "comment": "Malware payload (Gafgyt)", "value": "c79f4e252d40f41179ad8973e6b9bff0e910388b1a58e2de8dab8b42389196b7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741690, "uuid": "4d02f015-448e-4040-8afa-23368ded3f85", "comment": "Malware payload (Gafgyt)", "value": "9934c7b844d0e11d02c1965cd27b5574fc9155e7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710741690, "uuid": "cf926daa-b734-4139-8377-6ff85daefefe", "comment": "Malware payload (Gafgyt)", "value": "bb7d9ff1a9e8cbf3198f1049c872a0da3f6c588b6e6301a91efa7bfa3ff1075fe3f08a8fa07caf825cf3c496a16f3cad", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741690, "uuid": "ae6fe7fc-d9b7-418b-ac21-ad1f621032e7", "value": "T1F1B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741690, "uuid": "100a3a2b-f050-43c1-94f4-c831fb9030a9", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNOv5hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgL5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710741690, "uuid": "90beb1fd-06ab-4e9a-9742-850ebade28fc", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710741690, "uuid": "12a43fb6-ad97-4a3e-9ac8-9790e8e53f90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710741690, "uuid": "13189c38-ae8f-4c1b-8e99-129bf6cae83b", "value": "fuckjewishpeople.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0335373-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757435, "uuid": "516ddc36-3555-464c-96cf-e1fcbcfc5e0a", "comment": "Malware payload (Gafgyt)", "value": "ba3b7859c4c3012069078f541faa017d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757435, "uuid": "5fbfad99-efa8-49d4-a72b-8e8c4d5bce32", "comment": "Malware payload (Gafgyt)", "value": "c7c43e6a1cece9df8ef413bd84298f21a438ca8be89fe14c10d37e300ec3f98e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757435, "uuid": "eab874d8-9830-4f52-aaa9-240ae23b9653", "comment": "Malware payload (Gafgyt)", "value": "4fa96f7a26629cfc3a5ff5f779afb85ccd9f417a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757435, "uuid": "085eb836-ab88-4f61-b400-05b4b9cbd33f", "comment": "Malware payload (Gafgyt)", "value": "1b99c7b8484ec47273c74e8356bbd2c851e047e39cb2a272b10da7b87e5e60025565419ceb8afbc44583e34b6537550f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757435, "uuid": "d2c5f1b0-49a8-40a6-966f-c68eb3591a49", "value": "T163E34B05E6408B57C1E227BAE7CB434A33339B64A3EB33195538ABF43FC27995E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757435, "uuid": "61ea729f-1c95-44d3-9f90-d244269586d4", "value": "3072:MwRW2aB8fm97hmgqgOnxNhCTBETM/9tJhmxwySAQLhn:Md2aB8fm1hROn9CTBAM/9tJhmxwySPL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757435, "uuid": "b6a2bca3-d8ec-464a-a028-b577959516f8", "value": 156129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757435, "uuid": "577b7bc9-6c9a-4473-afef-a7afbf970535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757435, "uuid": "c3553265-c9f5-4ec6-b993-d6809293e417", "value": "ba3b7859c4c3012069078f541faa017d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5501e2-e526-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710766366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766366, "uuid": "57dd4280-8d24-4da0-91a7-c5124d164a25", "comment": "Malware payload (Mirai)", "value": "270cf09d41f71c7685e74ddbbf65d8bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766366, "uuid": "e698ca6d-a053-493f-bf27-dafa7a7ebe0e", "comment": "Malware payload (Mirai)", "value": "c7c600aecab141555eba5da004d5a7bd7ca7d5c5caa99b354bffbcc325ac1ae5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766366, "uuid": "90c1e884-6765-45ce-8fe4-54c029d69585", "comment": "Malware payload (Mirai)", "value": "12ea33ca841e392d85115e957804db13edd23530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766366, "uuid": "6d02b410-b509-457e-9246-0dd82976d825", "comment": "Malware payload (Mirai)", "value": "24eb9a464261ba8bdbcac86849c8325d04674758ca3818d1568972ca6435cb0a6ea7b45f0041d43970584f77968d2d88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766366, "uuid": "fa4142ae-b6be-4830-b3c3-82f066ab4877", "value": "T12563085AF9819F15D5D522BEFE0E018E33635B6CE3EE72129E205B1127CAA5B0F77402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766366, "uuid": "ebb4c508-9dcc-4640-8003-888aa07f71b6", "value": "1536:0TnP0ZWf0BfMTdSfPMVhpZQ3X0g5Bz2QZpRJElf09lt4ilr+Vih12a:EtfsfMxkKZQHVjz2QZpRJY4nr+Vq12a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766366, "uuid": "c4f57bc8-0c12-45c0-94ef-0b726bc946eb", "value": 73264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766366, "uuid": "f60f3ca1-a78e-40e2-b39e-d8830c290fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766366, "uuid": "4e81294c-87e7-4694-ab33-be638c144745", "value": "270cf09d41f71c7685e74ddbbf65d8bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef26ec56-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771741, "uuid": "a1710158-ea61-45ff-b564-e7637b3d2e1e", "comment": "Malware payload (Gafgyt)", "value": "f85c4ace7f1eddfa35b1b073841a986e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771741, "uuid": "9efc3d47-3a0c-4ce9-ab5c-f92895ecca07", "comment": "Malware payload (Gafgyt)", "value": "c8ba57f6f409e8e6de289a42fe3722834d5f0bc71c35a5aaa11c730fd181851c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771741, "uuid": "586a4b51-b81b-4be9-9bff-78c3a58c7531", "comment": "Malware payload (Gafgyt)", "value": "dfdabe8b4c1b940f9bea005277928ff147ee6305", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771741, "uuid": "ef280a00-a1f6-4ad7-93f7-9c339d158106", "comment": "Malware payload (Gafgyt)", "value": "8107de8fbefbe55321fa7ee2bcc61382bc8ede142ba346aafd9e70893cd162725dae4aab50a329145ed5eaf2d027a2d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771741, "uuid": "ef128512-5b6e-404d-92ea-05633f433f5b", "value": "T17DD3A52A7E12ABFFE2A8863107F35F70879521E237A19381E16CD7581E7528D1C5FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771741, "uuid": "b4e84bdc-2b73-4d3d-bdd7-015a6c36e411", "value": "3072:1pJXeMsKOxX3SyUElWYJOi3F57a4kkT+HyghvP93XdBZ8Uj2dUqQdEUmk+gFxfKI:hPydAdEUmk+gFxfKSSvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771741, "uuid": "45734fe4-49cd-4cb5-b52b-12befdefd295", "value": 131909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771741, "uuid": "0b4c9e73-43ac-4b05-bd92-033f25fac402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771741, "uuid": "cba6ed98-2763-41db-ae66-8be81767ba08", "value": "f85c4ace7f1eddfa35b1b073841a986e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167f2bbb-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763647, "uuid": "3fae68e4-7410-4f62-996f-d1e8418c70e6", "comment": "Malware payload (Gafgyt)", "value": "f692807bc9079609d5d483dca7033b5f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763647, "uuid": "4d12f1d4-a645-4123-899e-5bfd02d99391", "comment": "Malware payload (Gafgyt)", "value": "c9be755d13a9847c0a6b50cb55d2629b360cb331f48db043c1f44392769cfffc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763647, "uuid": "fa398732-716c-40df-9447-2fb6a2826c27", "comment": "Malware payload (Gafgyt)", "value": "d3530bb2f9fa05a898442eb2961da129727d7c6f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763647, "uuid": "8640fa19-22c9-4300-9ec6-177f955a5dca", "comment": "Malware payload (Gafgyt)", "value": "79974afa2168fa57998f6396ae066bbf08df4966a1292c8a7034b26be75ca27c98082326749101e7d36929cd52c062e3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763647, "uuid": "c2139bbf-8fe3-42fa-ab52-e2e04e2c6520", "value": "T186B35B27A151C5FBC48346B037CFA6916823F9FE0B66718737D87E682F228C99D59B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763647, "uuid": "883596cb-90f8-42f8-a301-b4c314d8dd19", "value": "3072:KcnDWxtWYPlxiKw/SE0Oe+6phavgaDtjoKty8wdOM:pQPmKw/J/6phavjDtjoKty8wdOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763647, "uuid": "6a3db86b-42a1-46c9-9057-5f2c7efa65ec", "value": 108737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763647, "uuid": "cf596959-590f-4764-9146-2056b6655492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763647, "uuid": "a25428cd-5d54-41cb-95e3-d36177469cfc", "value": "f692807bc9079609d5d483dca7033b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6490dd-e561-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710791896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791896, "uuid": "ec91f73f-e7e8-4714-a2a7-e70c83e27d57", "comment": "Malware payload", "value": "bbe8dac55e361a7c310951f890c6e2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791896, "uuid": "d44f9efb-8176-47c6-a41f-6f47f51a2c09", "comment": "Malware payload", "value": "c9cb2357f1c93a9f0e2dbd575c729c0a5afb18c30353ec689e13ebc4a7d2be72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791896, "uuid": "abc13b3a-fa7f-40f2-9ef7-0637de345f1e", "comment": "Malware payload", "value": "e9ca77c098fd7b37c40ae93c1afa71da3a95b982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791896, "uuid": "3f004c8f-14de-493d-a13a-ef72c29e0bed", "comment": "Malware payload", "value": "03c94f20d392e8bcbee0e302378e5bb2ba8d570cdfc6a928925c91d591f7357e7d419d9dfbab98f366e3d955ae1d4453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791896, "uuid": "c4f4ed5a-c778-4668-b43f-76842d29c25d", "value": "T1B105331BC7C93D37C45C45BF8BD6A0318FAD00C6A9EED3960B1568F3780B86C4A94AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791896, "uuid": "5d5230a9-5ac8-4c84-b10b-308ea0013d0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791896, "uuid": "35e4b9e6-2668-49d6-9448-66ba663b4add", "value": "12288:QXmxHERps2A5R2OsBftdBytnc5yG2NEanZ0HxRn0KWtfrDCM8suG+/n2+H8aiG0u:QX5Rg5A4+aKHXwfl8xG+P2+cqRJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710791896, "uuid": "4649af1f-e448-4691-b465-7d8c3c8f6e7e", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710791896, "uuid": "1720b2b6-9830-4484-8ff9-99426c6212b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791896, "uuid": "dba1c13f-c872-4d2c-acb8-61c7dc624842", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19442.13262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a0b51f-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757846, "uuid": "122e5dcf-b95c-4576-897a-de2ce25d394d", "comment": "Malware payload (Mirai)", "value": "7dd10abb62aa614f6e679a1a89082faa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757846, "uuid": "7300baf9-19a8-4904-828d-67b2edcd4975", "comment": "Malware payload (Mirai)", "value": "ca9df674907f9efadd2bf07ad1a07a53dc77f13e4ade2b7ae3031ea335995a51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757846, "uuid": "80888573-e87a-4a0c-bb4f-3bb7eb9916fe", "comment": "Malware payload (Mirai)", "value": "77039b896aaa34694557029483e693b84bc89e58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757846, "uuid": "6e63aaf9-ac0a-47fa-8b5b-5f2a60d354f8", "comment": "Malware payload (Mirai)", "value": "0cd24b55b3fc3745fa234c8601f0b963466499c8e2e7325a273df2408c0a73a48911b169e25f4110f7dde27335af1b08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757846, "uuid": "ebc9c872-e882-4717-8d68-a0fd4abfa42d", "value": "T1C393D60ABF600EF7E86FCD3B46A91B45348C650622A93FB57934D928FA4A14F45E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757846, "uuid": "a8903cbd-91dc-4d38-a9fd-c5d60e90306f", "value": "1536:nX3At60QNmvCLF9URZaPjzjk0Oy6+mSJZM41ldV864lZ:XQt60AmvsF9UzaPjc+mSJTVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757846, "uuid": "3af6abc3-c7ec-4c08-a425-954bd79024aa", "value": 89500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757846, "uuid": "39361f11-4653-4f2d-885f-f0cde5f599f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757846, "uuid": "df9b1871-a5d4-453b-adc9-ed738426f099", "value": "7dd10abb62aa614f6e679a1a89082faa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c990dad-e56d-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710796809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710796809, "uuid": "dbc5c332-dd54-4bb5-8e4e-4d6605ca9a2b", "comment": "Malware payload (Stop)", "value": "3b9e9e130d52fe95c8be82aa4b8feb74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710796809, "uuid": "74976377-da65-485e-a031-caed0cd9bd7f", "comment": "Malware payload (Stop)", "value": "caeecccfee0962fbe3d4fb4ab336bf3d1230b12ad0821ff66f7a2cabc289c954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710796809, "uuid": "9b2760c3-b02d-42a5-b09e-0f8fd665bc11", "comment": "Malware payload (Stop)", "value": "1cad525ecc17fb320bd8256e9cd106b989f97354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710796809, "uuid": "3c0d99af-a429-4637-aee1-8bec8423dd3a", "comment": "Malware payload (Stop)", "value": "8b11f2c338f5db3e7d01a32816f52c025512a4895d6659be5049b977ebfccf5b3afb7429e9ff1fd83d5830445317a7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710796809, "uuid": "bf7c96f8-bc9b-4b78-9ea8-ad796dda00aa", "value": "T18805E05372D1FCB1E46287315E6D99ED372EFC668E215B5723483E0F28701A1CA63B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710796809, "uuid": "9014cb46-8de5-46cb-b1fc-78cb66927367", "value": "3be88ab49aaf585748f8a6da6141b9cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710796809, "uuid": "732937b8-037f-438b-9596-bc235659aa93", "value": "12288:k4s2A/R5gv2bJ4GECR556Y9JlObra93zWsiQJjXEymLAhYz9lw/WH4+6mHtAF:Ev/Re2qWZfnobU3as37Qz9lU+ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710796809, "uuid": "5789162f-e23b-4613-8562-427c86d9f5f8", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710796809, "uuid": "556a0722-a3e1-468a-87a6-07c414ca7d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710796809, "uuid": "a85ab27c-809c-4359-a95c-1463c4c25a5f", "value": "3b9e9e130d52fe95c8be82aa4b8feb74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92664063-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710766002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766002, "uuid": "e25a5ad4-ae95-486e-9861-c467e31f1d17", "comment": "Malware payload (Mirai)", "value": "b74a9f3e758fe803df5b32c9c5315d48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766002, "uuid": "c6e212f7-8420-4af0-9d2d-13a7b1d771ff", "comment": "Malware payload (Mirai)", "value": "caf508214cc61d2e106e014b25b9ffc0ede49c9a212833a99cf16512fb1abb59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766002, "uuid": "dbefe688-9903-43bf-810d-3b127e089e00", "comment": "Malware payload (Mirai)", "value": "b077d52088a55e93831408739ec5ac12230713d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710766002, "uuid": "804840b2-34b5-4d41-86b2-c2bdf86eccdd", "comment": "Malware payload (Mirai)", "value": "ea23c6818dc8b13576311af6ce5153bc3f4bf590ebf62a6aed4dbbfbe9fd14f90ac9243a0667364296029dd61613f7a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766002, "uuid": "c1a0a201-afac-4d1d-a94c-b73285727b56", "value": "T150331984B9C1AA16C6D553BBFE0E42CE3726639CF3DE3203DD252F5127CA92B096B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766002, "uuid": "313aa3e2-91f8-4340-875f-3bb001fcf151", "value": "768:xFQd95D+spWdNS6KldmhH1KTlIuQqk0Q3wUSt+p3sB3Tlcs2XhbBw504NJI:DQDMdcMhH1L5aUA+pcBDloXhdZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710766002, "uuid": "2601fd46-fdeb-494f-94be-d2be01a632b0", "value": 50508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710766002, "uuid": "58f0f3a5-d63c-4ac9-a1f9-3e79bbe88bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710766002, "uuid": "d3314218-534d-44e0-8853-2adeb75240fa", "value": "b74a9f3e758fe803df5b32c9c5315d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cf1fd8-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752378, "uuid": "94e44417-d316-4d7b-b147-2d699d4fed0e", "comment": "Malware payload (Mirai)", "value": "0c5ee15f6e08c13109e19f112a9532a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752378, "uuid": "0cd602ac-f8ba-4d21-bb15-ad5683f1e99b", "comment": "Malware payload (Mirai)", "value": "caf5c6ba9e1b309b3a7913d8877e87d6243f51372b5db3965fb467e7c4a0265d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752378, "uuid": "00ba1bd5-5324-43a2-80b7-97f68337e7c2", "comment": "Malware payload (Mirai)", "value": "f34afb3728803e2a78cafadd49002451f4899b2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752378, "uuid": "45fff187-5953-4c76-99a5-eb11e95453dd", "comment": "Malware payload (Mirai)", "value": "5b9fd04dc58f1fc12a7a6a41bde40f604ff3b7ac90fbb21823795414df98c5b18f8f1d9f162e5c00a29b5f388f9bb512", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752378, "uuid": "df1e304e-8409-43ff-afde-b2d28c2af48c", "value": "T13C33F1BACAAA161CC7F8007D42FF968E10E3569C9C9883E2FBD1E135AC15A04795C76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752378, "uuid": "093702ae-4173-4a25-9b52-75f8c2b6bffa", "value": "1536:ephgIQ5RppHQZ2ZuGh9z55y7BMIux0z/hMAoUmnouy8oyn:gqRpBs+hkmIq0z/7oFoutF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752378, "uuid": "7ec14760-b821-43aa-b44b-7e5730b91a90", "value": 55092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752378, "uuid": "aac5d192-f15b-4bdc-833a-af2667f8bab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752378, "uuid": "137fd14c-da66-4c79-b1a1-00818aca671a", "value": "0c5ee15f6e08c13109e19f112a9532a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501db103-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753865, "uuid": "ee53b89a-8c93-4f2f-bce3-d3563ca7d333", "comment": "Malware payload (Gafgyt)", "value": "22a27b9414017085a75b35d76af0c7d5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753865, "uuid": "771c8e7b-31a1-4d4f-9ff6-8947ef6743a4", "comment": "Malware payload (Gafgyt)", "value": "cb834a03320228f02f17642d56763aa60359e77170ed9a43817f736b778cc1e2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753865, "uuid": "9a8d209a-446a-4856-bf01-35de45531368", "comment": "Malware payload (Gafgyt)", "value": "22330af8a847ce9765f30ba985660aa19a3ea0c8", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753865, "uuid": "947c1651-2a27-4b4d-a5a1-4736ee7532fe", "comment": "Malware payload (Gafgyt)", "value": "7e64958314d2a9ab53f3ee6c27b6edacc57827300a1dbba992e1b704fb7aa3824d25a34ecb2cfe880a1f5aead1cab59b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753865, "uuid": "d44575c0-1267-47a5-b36c-68bf9dadaec3", "value": "T162C33BD7D942C5B3D40209F2226B624A4622FF3B485A5AE6FB1D3CB49F318C97225FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753865, "uuid": "351a7be2-f3a0-4e92-83f6-5dd792c4ab50", "value": "3072:lUj9Do/JaaYMQpfe7oetJ8add9QzTsczjr2Jg4NKcXeGcgqGK:lUQQBe7oetJ8addQVf2Jg4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753865, "uuid": "010aef46-86af-4c62-b397-902e73986045", "value": 125342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753865, "uuid": "21c3c3f7-c5e4-4016-a49d-e8b806dc62b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753865, "uuid": "502a0392-813d-4dd7-aea0-8b37a815b5fa", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ec1ff1-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710769573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769573, "uuid": "86b717fa-d79a-40b0-8cec-88b68e6bb2f3", "comment": "Malware payload (RemcosRAT)", "value": "ee251303e24e3b669dd955c7307b91af", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769573, "uuid": "b7b54e40-d377-4e10-a432-d3852214ebd9", "comment": "Malware payload (RemcosRAT)", "value": "cc63179b856a404321c61ce50ac407a9980b39ee328e4fed1498547c12aee268", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769573, "uuid": "cce42cdc-90de-4d97-bb59-1bbb48e9b803", "comment": "Malware payload (RemcosRAT)", "value": "df5510159c9be319f9c4055507a6b6e87e88dde7", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769573, "uuid": "83782689-4b14-485e-ab4d-5a2b4ecca5c7", "comment": "Malware payload (RemcosRAT)", "value": "a2b3d3bf4ee729c662cb03dab7c6540cd43c08d61c12da4ffb953e8259f67a96594d44f32f9cf7f91d1721a3aae6a7c3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769573, "uuid": "810f2b24-4a14-4fbf-9e68-341e8486c30f", "value": "T134053306DE7E96F2C7A14E56B6A20295DB73249C0772D588C3E13D3088DA77C4F6432B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769573, "uuid": "d3f649bb-798f-4b9f-a68b-32f724cbaf69", "value": "24576:rdr398n7r2NY6gQ7lkD2PI4WQxQ6H/XkK17M6:rdr39Q8Y6giuOhxQ6H/XzM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769573, "uuid": "29e78e22-f796-4016-8dc4-6adf70f7516d", "value": 864028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769573, "uuid": "85d395c8-01b7-4897-9044-af28306ab709", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769573, "uuid": "633cb4c7-7d3f-4bf6-ac93-aaf7b2640ebf", "value": "Quotation List_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b632c8-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763612, "uuid": "49b2ddfe-0c16-4f97-98b0-b1b99f038fa8", "comment": "Malware payload (Gafgyt)", "value": "2684af18acce0a13a0844e6651f7860e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763612, "uuid": "26277135-24f3-4642-a292-2ab6eef609a0", "comment": "Malware payload (Gafgyt)", "value": "ccb0f01e1865416dfe1fbf8a970c400c5d364052c784b58f4425912fd75654ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763612, "uuid": "4e6e9e5a-4fe0-4eb4-ac3c-c2982cc83db3", "comment": "Malware payload (Gafgyt)", "value": "7647a92248a6b102d2d31afebf07e391165e1a7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763612, "uuid": "a289632b-0803-4eae-bf16-d67d1eae43a4", "comment": "Malware payload (Gafgyt)", "value": "47c3b5fb8f5482e6b04c6954664037e391be11b6ed7180060b3494d8691264c0d70e26d547860599711ca16c759e1550", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763612, "uuid": "7ec858ae-d34e-48e4-ae9a-e7a9f492dec6", "value": "T1C6932949D503C7B3C4430AB151DF5A9A1722FB664AEF49A6B71B3FB49B12AF43106F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763612, "uuid": "4758f3af-80a4-42ba-925c-5abd0a6e847d", "value": "1536:nk3xlMY2Rn63kAP5KyWQ6nRlEwscCnMCYeZALc5hQGW1TlKKXbPM37K8PN2UrYe:sxJ2RnbM5etnRpsJMCYeYc5hQbbE37KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763612, "uuid": "f89f6dbf-ddf3-4e01-8430-d1bc05095f49", "value": 96126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763612, "uuid": "6db15079-ffd3-45c1-8e94-bfae580a05a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763612, "uuid": "2ea3bd12-e8e3-47b2-86e2-26851b0014c9", "value": "2684af18acce0a13a0844e6651f7860e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbd2b4a-e505-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752388, "uuid": "e4275deb-e4c1-487c-9fa3-15f267ebb057", "comment": "Malware payload (Mirai)", "value": "97685e68ccd5f1976264c1463490709c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752388, "uuid": "b901229c-bdeb-48bc-b48e-8df0583cdff7", "comment": "Malware payload (Mirai)", "value": "ccf380538bfe3db81050d2dac70413f673e2d59a6ad89b419da334b3df69232a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752388, "uuid": "899e81db-e899-4e1c-a773-b8b7b7c13f16", "comment": "Malware payload (Mirai)", "value": "35f0e4b8c4e42776d1426e233ad5c5fb5796257a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752388, "uuid": "bb7b501c-ca7f-4742-8a5a-d71066cf3173", "comment": "Malware payload (Mirai)", "value": "8b9fac99fb7e87fa35be8c70ba8b827ae1854f9247779b4a2278963e1a6084562c9a77f8b90dd56deca69c1e8ac3845b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752388, "uuid": "5d29ea88-8f92-4b66-b132-906bb6f5c48c", "value": "T17833F136C6CAF986D23EC4BB88EFFE031565A74A5988A25F77442050B57AB22603C7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752388, "uuid": "3c4d8f18-ce8d-43e3-b0d4-f866859e3e4d", "value": "1536:P22GK3j8VmX3upRS774fvzoPHtdZZ1IS23Wnouy8Gy+:e25jGjpw7CvwvCS23mouta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752388, "uuid": "560b6502-77d1-4753-8f24-58c16ef02bbd", "value": 52936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752388, "uuid": "32611589-f778-44f6-8499-22e3f72e83b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752388, "uuid": "c1a9de74-5fc7-4b61-ac03-46033d1b555f", "value": "97685e68ccd5f1976264c1463490709c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c09a0ed-e53d-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710776112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776112, "uuid": "be3214ed-3e24-4fe1-bf4b-b7440d6f8a6f", "comment": "Malware payload (QuasarRAT)", "value": "14b036a6e1c0f541d4aaa14342a71c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776112, "uuid": "808ddec8-ab66-424f-b209-f431ed39e911", "comment": "Malware payload (QuasarRAT)", "value": "cd13e8e17d43db2d95dda9eec6cff2237b6a5eb1f180c8550555740e09fdaccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776112, "uuid": "a7dd7fe8-79c2-471f-956f-422f41f0e89c", "comment": "Malware payload (QuasarRAT)", "value": "b09151c7b91da3259dda75891f9c6990a09ffaf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776112, "uuid": "c892d32e-4f4a-43d5-94ba-e2d8f3bde990", "comment": "Malware payload (QuasarRAT)", "value": "918ccfbf8c81dec17dd26e4c9525cc2baa4a00993382fa1eba6516831a0cf6a1ca03e6f899accdbb61a03e9d320edf2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776112, "uuid": "c5c9a3bd-7bc2-4843-939e-95d0e54486c9", "value": "T146E54A1437F85E23E1BBE273D5B0041267F0EC2AB363FB5B6191677A1C93B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776112, "uuid": "eee61c0d-d06c-4c95-8191-18907548343e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776112, "uuid": "7e43b0fd-1754-4365-a7d9-a6e1ada1a5e0", "value": "49152:7vjz92YpaQI6oPZlhP3Reybewod9Yu1JJHoGdHTHHB72eh2NT:7vX92YpaQI6oPZlhP3Yybewod9YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710776112, "uuid": "61875eca-8e6a-4047-8679-e8f91e5fd719", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710776112, "uuid": "7227d483-d892-4cae-a0ca-d3a919653106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776112, "uuid": "82da1117-e362-43af-b064-fc103ef6fd65", "value": "14b036a6e1c0f541d4aaa14342a71c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c832af4d-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710745477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745477, "uuid": "9c081632-021c-44ad-9529-524e0b6eacd5", "comment": "Malware payload (njrat)", "value": "6175e14e465756c626ccc0f398fcdcb0", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745477, "uuid": "72f700f0-5931-4e0c-9109-17d2d09e82df", "comment": "Malware payload (njrat)", "value": "cefa4ebf82b3d077a68ce1933be3dc6e9cadce8bc27671a5fcd76ee2f4d04977", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745477, "uuid": "e62aac42-f307-4b8c-994a-96572948124c", "comment": "Malware payload (njrat)", "value": "2631afe67cc6f6a10d97c59e258ee74c1a84a303", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745477, "uuid": "6b5743ca-ce0b-473c-88ab-31341b034cd7", "comment": "Malware payload (njrat)", "value": "748056fbba3780459e0a28d933bfc715871c68a418d21dfa535437041228940a477e3f2a9ad76da5f1a542fa50ddbfd2", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745477, "uuid": "3f4c1ec1-f2f8-4218-a10b-4feaafca51ac", "value": "T17DE17E6D8D85BA77DF218F3FD23C04F7AB16A8E50CCDDB5E1890D7A91284D4B560A1E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745477, "uuid": "10f43977-1d52-440a-b940-7ce19ad2fc00", "value": "96:ZEKr9NP11Kba73X7T7LnCurDUIZKGpmJdKar23GMOCyOwkU3KEWTq9c:xrXP/KCbT7LRDn+JG3Gpu27WTKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745477, "uuid": "698d1014-202d-4c9f-9866-8c059737c07c", "value": 6974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745477, "uuid": "248d3c20-0a41-4c74-ba74-b3eba53a1e3d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745477, "uuid": "ec497604-763d-4bc7-b818-fa26bdf6f472", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86379d73-e525-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710765982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765982, "uuid": "47a883bd-5219-4f3d-8a60-46eb04239f66", "comment": "Malware payload", "value": "0f3222ca72303a95d70f06f0e238eb25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765982, "uuid": "b890c4ff-ee96-48b4-8afc-12bf7f36cb8f", "comment": "Malware payload", "value": "cf63413b55c3d688154c22157ac12b29ce0cecec869ae44d74640d2816d51064", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765982, "uuid": "2db45f42-a142-4ea0-9d91-3d3183dbea78", "comment": "Malware payload", "value": "a6083918bf73f1a7b54ff6fc2623a155eec011f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765982, "uuid": "62de25d4-b63c-4065-b8ba-b387f21a78d0", "comment": "Malware payload", "value": "77ef69d75a0e8fdc149e3de6b8ef16944764e851208e939e054f3f9ebd5052b3ed59e6b5220d245caaa3861fc6e13c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765982, "uuid": "0dbf4644-0451-48d0-b684-ccdfe472e012", "value": "T1FD332935B979192BC4D8A97A35F74758F1F5164A38F8CA1E7C720E4EBB20910621B3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765982, "uuid": "b58a17d4-4362-4cef-bca7-ff11b0f571a0", "value": "768:cN7MTPn18iXOv2hXubzbYQ7MCO5PxOYn3MhSOQO+lvLYHU5eZZu8:cVO9P+vyCzbY+MCox53QH6leUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765982, "uuid": "b70a099e-e9ec-4bf0-817c-4b28f74e15f1", "value": 52340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765982, "uuid": "c6a4766a-b525-42ed-aa58-c4845a04fe96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765982, "uuid": "40b4d86d-f6aa-4b61-bca3-48e5f03f83c0", "value": "0f3222ca72303a95d70f06f0e238eb25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208983bc-e4f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710743048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743048, "uuid": "057218b1-8492-4add-ad09-aa4f00b4bb1e", "comment": "Malware payload (Mirai)", "value": "d25ba991ae938e6b74f37cb55007845c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743048, "uuid": "95cc8eec-5b53-4549-960d-0c9898dc7418", "comment": "Malware payload (Mirai)", "value": "cf938cc4e543245309ae4182487e0d6643827541ba11e9848f689adc15267477", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743048, "uuid": "914375ff-c2bc-4961-895d-4c7e8d5b61c0", "comment": "Malware payload (Mirai)", "value": "b231ca99f4ee227d3f7f9e197b5468fb5f679d13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710743048, "uuid": "7d99ab6d-613c-4f7a-9c63-51aea2f10af4", "comment": "Malware payload (Mirai)", "value": "df313c9f256262f4b530cf5995219f30c341030844cea0467b6a82872f9849d65df9aea4b38eff5ddaff355e02253eab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743048, "uuid": "1188c96d-812c-44b4-ad8f-df2184ab03a8", "value": "T14F73029BA3187955C8B028B3C4254C50BF474DE4D8EA75E3E835D4EB139B18BC267B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743048, "uuid": "8a0b95cc-3301-4d13-93da-267e240a90f2", "value": "1536:JcsfZDtnurnoi/NO135TPtR2ekOEtRyRQAQLdge6e9Cm/hF:Jc29ioi/89VQEGNLdge6eYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710743048, "uuid": "98f23faf-9456-4be6-98e2-112041944c5b", "value": 80596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710743048, "uuid": "5ef3c428-cd3c-45a8-9c6a-9b2e5e023a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710743048, "uuid": "82f16a6c-b455-4e32-bf90-df2cba4860de", "value": "d25ba991ae938e6b74f37cb55007845c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7a8203-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767845, "uuid": "bf143e54-7cc5-4521-be1d-c9caa7c31ec1", "comment": "Malware payload", "value": "0190a49f09dc90c7dc61959581be1e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767845, "uuid": "197f4d26-fe51-4f99-b653-935c10fb8cd3", "comment": "Malware payload", "value": "cfa3c71c41d7a69fdfa223a92ec677067613c69b2b2627d760cda587725bfbf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767845, "uuid": "d8f7152f-fce0-45d7-9b6d-d4848746b78c", "comment": "Malware payload", "value": "af5d8cfa73b77d96d3a489f5961cdab87c8339be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767845, "uuid": "09e4c666-dbaf-4cf2-866a-0ae739b2ceaf", "comment": "Malware payload", "value": "d268b211a7be49c122d4d02531ff960bcaa28b12cf0bb2af69022f67bec25fbf7093d444c0cb663ccc888811b015d380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767845, "uuid": "38518357-e34e-4e77-a5b4-873adc8ad583", "value": "T136F4232096826061F0E1D4B11FF7F753D93599E8C222EA1E1B711A79398DB02CB3637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767845, "uuid": "3f6f7a36-043a-498d-a760-c13f4019a719", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767845, "uuid": "9f9b59cd-f26a-4361-b466-ff193d16fcd4", "value": "12288:LqLg193/433+TE58vkyFfgN5B8B/5FsfecVB0kh3ObwMB8aqEEbViGCyQRy1/6dy:Qg193w5uRa5BO5Fo9BbBoZyQqNbbfN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767845, "uuid": "2dac5677-bdc7-45f6-bc99-8703ba6cfb96", "value": 786800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767845, "uuid": "5655ea06-2a91-4b9f-b01b-4167f5e0a24a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767845, "uuid": "3d446a85-53b2-40cd-b3ee-ec652be25ac6", "value": "Grundforbedre39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d619f4ac-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767834, "uuid": "91ad785c-857c-4d1b-a8f9-9ca0c73795a3", "comment": "Malware payload", "value": "0cb08733be50d8a3c7685beb4aa1a65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767834, "uuid": "d3bdc627-d7f6-4e0e-8db9-de532a8ac99e", "comment": "Malware payload", "value": "d028e3b4d6ebc62c3c23bdb8d7e09f1dc85acda7547f9dea476ea8e3023e81f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767834, "uuid": "b7ee8848-9cfc-4811-9952-3057f9eede35", "comment": "Malware payload", "value": "0baa67453d45c82ebcae84d57124b2bd237795d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767834, "uuid": "1aa4f9fc-80b9-41e6-bcb2-b1bd9ba2511a", "comment": "Malware payload", "value": "4881db48881f4ae2930487c80edca877ce82d6ed9e343ceb2be5083288063c49bd995ba57e5dec42b78898d76cf731da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767834, "uuid": "308a41fa-d0bc-424e-9aad-5ec78a22039c", "value": "T13D4423C507DAC20AD0B15DBE254E1067A57EEF6FAB0C1343BD19FBB15184A720B0D69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767834, "uuid": "9069f9c1-8feb-4dda-ac63-062ac8a919fa", "value": "6144:WIpyokk3Wqs0dNY68zsm8ZAac8YVDi2n6+/2dGzA1gPabqa8arHPSe:WrOjdNZ8zsmyeVn6yA1SaO4rPSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767834, "uuid": "868ae9be-14af-4916-a867-5ec668251fb6", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767834, "uuid": "c39edfde-4b78-421d-9d6e-71e53f75386d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767834, "uuid": "7607b83e-a1e6-4adf-a016-e4a49e6d9ca5", "value": "d028e3b4d6ebc62c3c23bdb8d7e09f1dc85acda7547f9dea476ea8e3023e81f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88c13fa-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751947, "uuid": "214182d2-8f19-4043-aebb-eb8d8e2e5b23", "comment": "Malware payload (Mirai)", "value": "ee641dd77dcefa6bcb7c9044c5e7e5bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751947, "uuid": "e22d7bbf-9020-4b5c-b86f-52cedba4bcae", "comment": "Malware payload (Mirai)", "value": "d0a66787130a1c40808d7bee13ed3509fd3b11058c1cd92e7b42b8dd9f31a77a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751947, "uuid": "fa9b2f05-30f7-46e9-8438-bc612ab29777", "comment": "Malware payload (Mirai)", "value": "8b94cf66cb5641c2cdc16e4ccb651635729bdeee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751947, "uuid": "1419f8c6-f775-43a3-8371-35b17994ecbb", "comment": "Malware payload (Mirai)", "value": "777bdacfde80808ac03606ada88c1ec3aa9a9bbcc85241210e1a98b6d02b254a0f357b356b5685152e4c2281d55c0394", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751947, "uuid": "d2c847e9-70e5-48a2-80a8-8a4f60aa5d36", "value": "T13C03F12265D1D5B0FBA1903CB50EDA976B620378E5922327684027B7F94E850F5BC2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751947, "uuid": "2a1cedf0-4ab7-4dd3-baa2-8ebd2df29fff", "value": "768:jYcILPKwH0LiOqz0vLIJuHAqma4MCya3gs3UozHL:jYcGKs0LiDCLng+48aFzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751947, "uuid": "666a35e8-328f-4026-8572-e4de3746481c", "value": 40292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751947, "uuid": "74c66fdc-73f8-4534-ae35-16c0c2c96188", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751947, "uuid": "4b1b521c-3303-4052-b83d-a62ade05ebc6", "value": "ee641dd77dcefa6bcb7c9044c5e7e5bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d688bb-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710767835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767835, "uuid": "c8790b65-eec9-4c7e-a26d-d6142e39908a", "comment": "Malware payload (Formbook)", "value": "728b83244a275ef0e29cb00aa0c6692c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767835, "uuid": "a88fa37e-33f9-450e-b5d0-2045f9bbfce4", "comment": "Malware payload (Formbook)", "value": "d0b94b855d2f24add1edf6b3a6ecae24e4366f181a1ccd0bcd3b27e94de95bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767835, "uuid": "30654979-4fc0-4764-bc94-66fa4e9820a3", "comment": "Malware payload (Formbook)", "value": "8f744b5564e78ab054bc685bd12483c1ffd9de4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767835, "uuid": "c358ffba-9230-4203-8b89-51535fbcaa5a", "comment": "Malware payload (Formbook)", "value": "4503c33b9fe6a30eadee14077b0e1bda0a2b8393cc63bcbab3c216cf2b42f1a712d19fd3b7a82238d11b8b879d84d3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767835, "uuid": "a9ad23bd-8b87-4cc3-bd87-84262855e637", "value": "T1EF04AF36D642C071E2B212B5F6BD1B7B483D0E353295A0AAA3E215E06EE05E5F53D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767835, "uuid": "9776164f-8fa4-4c15-8be4-f779de0a422c", "value": "3072:CtzMC+k7U9fY/0/13Uay9AGYKolYE6upZ44YW5Q/T74PMu57c:o4HZU96RKolYLKm4oYPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767835, "uuid": "8f04062f-9a64-4dc7-931f-61ee0aebe48b", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767835, "uuid": "273ea498-fdaa-4e02-82c4-a9e598614dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767835, "uuid": "a93164fa-a190-473d-8916-2556875c97c4", "value": "d0b94b855d2f24add1edf6b3a6ecae24e4366f181a1ccd0bcd3b27e94de95bc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f69778-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779942, "uuid": "b209921b-d730-44c1-bb80-e9290944a542", "comment": "Malware payload", "value": "e05963ff5c32f1c82345ae91aa22e487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779942, "uuid": "0b4fd4a5-6f2f-487e-8411-97f7581a2fe1", "comment": "Malware payload", "value": "d1a761e0d924e97c06e18448ebc0f97e9cf70073df7ef364a9b0a8f1d0a0a9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779942, "uuid": "c899a965-af43-4ba3-bb2f-d179fc8d8775", "comment": "Malware payload", "value": "eabb4818661941bfce3299005cff155c13e673c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779942, "uuid": "b0b6ef0b-0eca-40db-b374-2b3ecf9fe42c", "comment": "Malware payload", "value": "8c3363d2f3ea8cd936a9b9de64c1ccea1e7f4d3156318fb42ed7a8cd0974b451e589ac0668e5f8381436c72baddd8372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779942, "uuid": "4a4103ed-546e-47c7-bcb1-0843716a0c81", "value": "T164345B1FF6C0A957EAE206710A77A379F3BBC28923A13E474A046F7934536D28E059C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779942, "uuid": "dca83428-1dab-42fe-a2a0-209e1fc0027d", "value": "768:AllvrIMbQ5LN6RRWT++aACd4dZShMQCjfW2zvEY7:y1rXbaLcRR2NagZMwDvEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779942, "uuid": "ed348e60-4b6f-44aa-999a-a6eafed3fa26", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779942, "uuid": "b66bc029-63fd-4bc6-9d70-9d5ee1c307ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779942, "uuid": "4e4ad07a-702d-4ea7-be6c-07f2caa745ac", "value": "SecuriteInfo.com.Win32.Evo-gen.31765.8487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ec8dd2-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710767864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767864, "uuid": "010dc8cf-1a58-430f-b96c-369cb61cad2c", "comment": "Malware payload (GuLoader)", "value": "40f2e33203ca34bde4ff393cd29460ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767864, "uuid": "94702065-0a8d-4a1d-afbc-6989cb31e874", "comment": "Malware payload (GuLoader)", "value": "d21df5305629a7f20a524ef0969ad316678db119dcd6dbfa3732bf5b30ccd282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767864, "uuid": "6d58f631-407f-49e1-8999-c607708dd82a", "comment": "Malware payload (GuLoader)", "value": "854f2c562142f487ee80c703b314a4e4e9fd3192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767864, "uuid": "f904f528-8df9-4b8c-83c9-036ace6bb143", "comment": "Malware payload (GuLoader)", "value": "84857027d2c714d3d555b08b5bd38bae56b6d01c394988092f147f85091bd00d0bcc0f2a72cbb969568232cef33681cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767864, "uuid": "77199a32-e2ee-4077-a305-04ed90a246c1", "value": "T10F841310B3B1D6A7DCA20F336E3753639A769C239965131B234129EDAD732426E1F31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767864, "uuid": "7207d5aa-119f-4a39-b6db-9f33f71e1060", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767864, "uuid": "8cacbd1c-d142-4e03-b1c4-b458c2d82df3", "value": "6144:5XCKG5HEV9D0BUoulznBzrezPLBqt3BvNa4DmBVLmQrrPVp5+blFfBSgwN:5Xc22BUouBnVrezPaRvN/mDLmgrNp+pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767864, "uuid": "7cbace5d-f173-44ef-ad75-cfedc6862bd3", "value": 372007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767864, "uuid": "4eb3d824-1cee-47b7-9fb4-e61ef8fca543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767864, "uuid": "d0177dcc-1a2a-453a-8eb2-e93fc3cd685c", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e087891a-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710767851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767851, "uuid": "6f91a4dd-0eb8-476a-935b-f18b70ba6e19", "comment": "Malware payload (njrat)", "value": "724ac474c4fcaa1df6da3f9245ac9c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767851, "uuid": "23482ea2-5a26-484a-a8bc-f6fb8f10fe03", "comment": "Malware payload (njrat)", "value": "d223088dd0d29e76253a5cfcbf1cfaf05312285f2f2f60aeafc6e8a96efcbcde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767851, "uuid": "d036245e-dfe3-409c-b77a-fc8837e198bc", "comment": "Malware payload (njrat)", "value": "c68cc50c2bd9e44c87fbca76c4ebd0c7b9942b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767851, "uuid": "aee81705-767b-4096-809e-14f5273864c8", "comment": "Malware payload (njrat)", "value": "2f913f6b525d887c52ece2a861ef5aa855d3000ebf7bb00bec27b307cfb731dd93229e0fb0d834989358188e60103497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767851, "uuid": "7cd0da81-3cb7-44c0-86a4-974fa3aa4783", "value": "T1E08412AED174C7EAC6A73E364F342A2511F96E3D31609BC7B72082953DED265861E3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767851, "uuid": "d7991b10-5842-4525-9372-e5b2e77d357e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767851, "uuid": "73cc2218-7687-4aec-ad43-9f2475f6c62b", "value": "6144:ONeZyO6KKoPz70NjFXAokZnpWRClI/4HGJ/xCQN7lfIVDw9SbcpIJGgD:ONl5KKwMUZpWiIgHGJjTfaDsSgpIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767851, "uuid": "a809acc7-c8f7-4802-9d63-5312200387f4", "value": 403933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767851, "uuid": "07524fda-2dc6-4762-bee6-bd78f023dafd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767851, "uuid": "568e9946-3b6c-466a-a3d6-b996a18c86f6", "value": "New-Swift-Reference-BWT2810173-ALL ROUND TT YEH271863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141ba06e-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710757630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757630, "uuid": "d23cc9c6-b4f5-4271-9e39-96ff506da817", "comment": "Malware payload (AgentTesla)", "value": "6ee5f69f5b56ec364ba8582a63e27d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757630, "uuid": "b3ec92ab-cf3f-4397-9c9a-c848b4834e18", "comment": "Malware payload (AgentTesla)", "value": "d2b7803600c528285bfca80adec85460612c69c83585b9c79a3d4b988a4d4b89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757630, "uuid": "503acaef-01fc-4f88-9b8c-d16aac221a0d", "comment": "Malware payload (AgentTesla)", "value": "aca44bd69ef966a58a1ea5ee71d1b0e2684f6ded", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757630, "uuid": "ea5c4d5f-8c6c-4806-8931-0cc3903dae8e", "comment": "Malware payload (AgentTesla)", "value": "ce6daab71d27c35e3b0c6367989981034425b556101a3cb551f2ba2ed713e55d121c4c8a08b305f2334e1496655b5e4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757630, "uuid": "42228265-5254-489f-912e-2efdb3a9ff6a", "value": "T1DBD4234403E0EB72D8DB97B9A4BB020027561BFBA269E74CDF17A5946E67770C60CD23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757630, "uuid": "4c401a6f-027f-4f2d-ae44-e815224fffc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757630, "uuid": "c42ad807-60c3-48d1-9d62-1307db6ed052", "value": "12288:7TTDAXoQGUPWdJZT0bgx8xwRmstseIhCY5URxlOBxl9R4AgRh+:7TA4jaWdJSbgF1tseIhOLcxlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757630, "uuid": "0b77a283-8714-4574-ad58-e5e85461859b", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757630, "uuid": "81378f82-e570-4cba-9965-2c185f11d37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757630, "uuid": "1af99913-cf9b-4b34-b0b3-da78c23b4546", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc42a33-e561-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710791899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791899, "uuid": "a1733bec-2157-48bd-82fc-1f46f6401c2f", "comment": "Malware payload", "value": "e5b2dd1a6145107701f02280778466c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791899, "uuid": "a58debc9-6c02-434f-85fe-68d2ba8e4f84", "comment": "Malware payload", "value": "d3c6dc624952d8ce8c0e04565a7dcba15abe40dfbe76a686e9bd4b3bdda14f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791899, "uuid": "c6c065c8-b673-4142-ad54-afec7c71133d", "comment": "Malware payload", "value": "8edf0b720915c3b47a6cb51614ef64f0d30f8eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710791899, "uuid": "1fa0afd1-aae6-4ce7-959e-c5235a26d874", "comment": "Malware payload", "value": "5fca4b78657fed3cf7f0bec86e6e96529b320d0c6e2db86d52037583732284dce905d8cf18b87d688716475f3ec20bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791899, "uuid": "f5d369e9-6bfb-4a94-85b8-933702ab5cdf", "value": "T12A458D0733E6C0E8DE6790F2CA295223E772741517289BDF64E05A2DDF93EA11B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791899, "uuid": "ab837271-e14b-4142-858e-f532addfd45f", "value": "b66b962f1654841b6655c9e59651771a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791899, "uuid": "b20b1eac-05b5-420e-a270-7db32d435905", "value": "24576:ZcWvEkqZRLJ1bVUqk1ovjVX3EBLgeWEckj/EJq8rp1mibDk1c+Lqp9:ZcWMPZRLJ1bVUP1ovjVX3EBLgerckbJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710791899, "uuid": "18df34ee-02db-4183-9d74-bd0932fed879", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710791899, "uuid": "4dd28b0b-b2bb-4a58-9bc3-06720ba1c07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710791899, "uuid": "00cf7ee1-72ec-4a2d-a3d2-d93dca1d43f4", "value": "SecuriteInfo.com.Trojan.DownLoader26.36051.24407.3348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f0555b-e518-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710760373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760373, "uuid": "bf98db43-6afe-4b53-a13c-732f3039f9ec", "comment": "Malware payload (Mirai)", "value": "dc9399ce3b1c51065caf03490364ec34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760373, "uuid": "f0222031-968f-45bd-bb76-95a176489eac", "comment": "Malware payload (Mirai)", "value": "d3e7cd0106bff3375014502916a2acd3c1a6d62adb8694d1327d6dfe7f9d67f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760373, "uuid": "c4ad6fd0-77c2-4cbe-9222-fca637e714a2", "comment": "Malware payload (Mirai)", "value": "6c336a978511602dacfaa29cbdeefd2d7cb54be2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710760373, "uuid": "3b26c608-87f1-4dc9-ad1b-be53ead9d2b3", "comment": "Malware payload (Mirai)", "value": "c9d9b92fd202a9d3271bc5fde4bfe1811a2fb61b6c3726c6310de1f7aa76625baf5e326ed7cf48dd12b361ead13da894", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760373, "uuid": "1d9f5a6f-060d-4a88-9b0a-9948290385cc", "value": "T10A41F21A6F901F33DD76CC36054B275136CC942F716A63916334E960BD3E605A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760373, "uuid": "bc85f3bd-6bd0-46e7-92a9-dc57fa11bf98", "value": "48:kff20nuDW3l6df9HOScTLmPkOTwW8IFSXZ:kffNnuq8f9uS4LmrTwJPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710760373, "uuid": "f4425dba-73a4-4b71-a132-3be225406b9b", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710760373, "uuid": "40c3d265-d243-40e1-885f-c265dba14d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710760373, "uuid": "eeff53f0-d85e-4de9-815a-54fb3cb466cd", "value": "dc9399ce3b1c51065caf03490364ec34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab968eb-e4cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710727388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727388, "uuid": "42d7cff3-358b-4c24-999b-031bd456ffcc", "comment": "Malware payload (Mirai)", "value": "181135abb4ad4199941e857d42e433af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727388, "uuid": "4f7db359-cc66-42ac-ab10-1133b7df249d", "comment": "Malware payload (Mirai)", "value": "d41c81fd895a79760911566f40e5e3b6eb9a6343dfc75b60727e404869bc89e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727388, "uuid": "83b06db5-ecac-43fa-a620-8d79fade9b55", "comment": "Malware payload (Mirai)", "value": "4f0f10db85f3dc9e2c1abac16e18b127249dcb5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710727388, "uuid": "5988752c-73ed-45f9-9bbb-8afd1ed563a2", "comment": "Malware payload (Mirai)", "value": "f5b4e4fcefa9319d74c0460281c4fe1180cfdcecabd2955d2769fb2375477ec8e27f64dd505f6199dba58ddd9a6ff89a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727388, "uuid": "145a4d09-e73d-42dd-84ca-a6fb55a6dfa2", "value": "T13004885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727388, "uuid": "a9ee4720-0683-44a0-b0d3-c9db0d696eef", "value": "1536:gF2ivn3vfjrBwzvK4DNNJBSBSO1WGxe8GWsfNyJTfxIhTiO0RmH31Q:gzv/ejZNJBSBSuW4GWTXITkRmH3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710727388, "uuid": "378208fc-dff6-409d-a7c2-0b7710382cee", "value": 173764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710727388, "uuid": "c3c79ca9-cfc6-4dfc-b865-8e732fe22846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710727388, "uuid": "13d4f186-1a84-4637-80a0-4ecc2cf18a4f", "value": "bot.mips-20240318-0203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d251a961-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710767828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767828, "uuid": "a663ce85-ebc8-44e2-ae5e-c52b3add7d2b", "comment": "Malware payload (Formbook)", "value": "6b3d6565f98f00436cf229258a5ac2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767828, "uuid": "dcb1047b-b5c2-4c31-bc42-e6737e82de4e", "comment": "Malware payload (Formbook)", "value": "d48e76a16a20d4af37091f9dea89ce3fa2341e273a3898ac1b8b398c2a5793d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767828, "uuid": "71863238-b1a5-422a-83e7-85712347c7f2", "comment": "Malware payload (Formbook)", "value": "6fd6b3e765c4e2d6c262e48f3da8040f2f72e41c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767828, "uuid": "bc2afadf-b016-4519-8c0d-d964b0d050d9", "comment": "Malware payload (Formbook)", "value": "0d894826e87123c5f4bd63641d0504a3ab4e9da961342a071a32b11c5d84ec59276e9e4240bd01960a3720ec1a80bd0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767828, "uuid": "ddf17f05-045f-433f-bbbb-04c073f65ae8", "value": "T158E42310E6CE8AA0D7BC7FF148A086B8037176256474DB3B6A48E5CDAB757EC475202F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767828, "uuid": "de93855e-636c-4557-86e5-f73073e3f72d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767828, "uuid": "cb0337fa-cfd8-4694-9d98-61bb698cb38b", "value": "12288:EsJTENl3j9cLW29yuRN0wC3RHyGCRcB66IvtBlai0y8Ui31zO:txENlT2620eC4NRvvBlalqiFzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767828, "uuid": "81f98e06-e128-4601-b209-24f2f607f819", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767828, "uuid": "0cc3dcc4-2f5e-462e-8e4d-8d5143f64071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767828, "uuid": "58548f72-991f-451f-aee9-554ca477fde8", "value": "BANK DETAILS CORRECTIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d76edbe-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710745754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745754, "uuid": "b00d3ea2-5bca-46b4-882b-64fbdae2d3b8", "comment": "Malware payload (AgentTesla)", "value": "fa5e8312ff06b4743ead18bc6251e0e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745754, "uuid": "320be841-aa29-4eac-835a-7b8a41e1c07a", "comment": "Malware payload (AgentTesla)", "value": "d55b373e0639d13bd90f2d5c43b28edb01d0b0331b22f4630fe0f76578f9ce3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745754, "uuid": "e752aa42-300b-4ff6-9efb-37e25febff3f", "comment": "Malware payload (AgentTesla)", "value": "d644fcfa569197e0bf8100d8cdf45dcad9029185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745754, "uuid": "d498745a-e146-4264-b313-a1e2e0c63239", "comment": "Malware payload (AgentTesla)", "value": "6f4e8a3f1f9757a4c913701027ce1a0e3c1bebe5ca73c89fc17f56892b23ea82ae7bf662cb6b178f702b8584f53bdf53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745754, "uuid": "88f89ff4-76c7-4137-a893-bc037de8c539", "value": "T129D42229750CE6A0C8944B388BF596A30FF2B3561805E3E536C4B88E9DD3BD04B1C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745754, "uuid": "e8018d84-b47d-4c18-b906-afcc4b6b52a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745754, "uuid": "b41dd548-f86d-4d67-9333-253db848a14e", "value": "12288:VgRhF75wHgqcMKqrHFtHM36tNXgl4WEFj4SthjO3ooUNGeF3SkR:uTEcMKsl+KtNXgl4WEaSt20h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745754, "uuid": "cc0e541b-67ca-476a-88ad-7bda5ff162cb", "value": 648200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745754, "uuid": "272d2db5-53c0-4e77-9fdf-3d05af52b0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745754, "uuid": "62b01b07-06ed-4b17-9e2b-01e9b2eb82b6", "value": "DHL - 1ST PAYMENT REMINDER - 1003671162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e90a8e3-e50b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710754802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754802, "uuid": "d491dc64-d8f8-47c5-8853-f4afb538a6e7", "comment": "Malware payload (Mirai)", "value": "cd917296dc451e1af54fb03b70acd323", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754802, "uuid": "1a596090-03c7-4645-826b-6f13ed049962", "comment": "Malware payload (Mirai)", "value": "d55f58023d66f881267cd1030b0763fad08243f883943d4513a1eb27e806de07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754802, "uuid": "c800eb6b-8038-4ecb-953e-5a4407310cd6", "comment": "Malware payload (Mirai)", "value": "7627f7e233a2df5850e2144ed5880e4b4c013782", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754802, "uuid": "f97edf26-816f-4b4d-abd3-812e78fb32ea", "comment": "Malware payload (Mirai)", "value": "9f894bb9e80fb9c1cebaa10fd109bb12bea5fe985a7896c39ef7d43667c56217c89efd5e0b3fd0c050264735b431da7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754802, "uuid": "57a57c4b-408e-47be-b50a-268676b4afb7", "value": "T12DB32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754802, "uuid": "67cea822-b048-4f6d-9603-b699f1cc3cd8", "value": "3072:Uvc29uyIcxE/sZxw+OquKZmm/QcuLmH26PNb:Uvl9jIg4sZxjOv4mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710754802, "uuid": "e69d0c00-1b85-42dc-8b3a-1d5d8fc52c22", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710754802, "uuid": "549420e2-fd20-4479-940e-ea7e89d9801a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754802, "uuid": "f06ec54b-0a6d-4ce0-9f1c-7d35e436db69", "value": "cd917296dc451e1af54fb03b70acd323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59b1788-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710767860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767860, "uuid": "f051b068-b384-498d-a97b-1d65b7c118e0", "comment": "Malware payload (AgentTesla)", "value": "bb80c0e0f926158bd1176dedde40b175", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767860, "uuid": "74d3442c-9389-40cd-aacc-2acfb6cb007d", "comment": "Malware payload (AgentTesla)", "value": "d5df0f56b1209034e89de624a5ad652d070035c15f24d6b3559c34540c725b9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767860, "uuid": "5c9b0870-4a96-4861-99c0-0d28636b2df3", "comment": "Malware payload (AgentTesla)", "value": "8e8705ee2bd9690dd99c115be037a33c14f582d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767860, "uuid": "7cbc264c-a47a-4dfa-a4f4-54b6be81e787", "comment": "Malware payload (AgentTesla)", "value": "acfd984c95ea156e7612c8e40f505621d2e8f4778021993784ae3ae8c08677c902a387e562fe2f563689eb741cbd83f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767860, "uuid": "c0667008-b312-49ec-a645-4559addc58f4", "value": "T1E005120331F88F05C07D83F99562668427B6B95E3262E31E5E85B1DE9D977C08A4EBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767860, "uuid": "28f0dd01-c281-4a04-8044-394378da1312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767860, "uuid": "e1fd9aeb-c7e8-4c82-8739-3f13cf02376f", "value": "12288:HCsLAMhHwgG3hh5qaYXDuCNE17NCKwNpJuRe9GMYRx/TvA/x6b0VeeaMZcxq2XIc:Pohh5qlzjC17UKwNpJHqWIMeZ40qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767860, "uuid": "7412679d-c169-42c4-bb5b-bfa37259d687", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767860, "uuid": "f736189f-4442-4e7e-8b7d-e9125194595e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767860, "uuid": "ce292cdc-919d-4efc-8b1b-9c140a06ebdb", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d1cac1-e4fd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710748900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748900, "uuid": "ea68a5ed-8271-433a-87bb-2981967071e9", "comment": "Malware payload (Mirai)", "value": "6aa7606c149b10027361103ab33ef6b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748900, "uuid": "403a461e-3427-4d97-a339-ac2f043c6c0c", "comment": "Malware payload (Mirai)", "value": "d5fbb3f5306ac67c3c3c8593ec7781ac17190c103f0c3f09e27631e39aff8da5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748900, "uuid": "ba768757-7e38-403e-9ccd-622e14c4982e", "comment": "Malware payload (Mirai)", "value": "6814aa9d30366030e3f46af7d656c5dea31dafd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748900, "uuid": "b8497f56-f636-4163-af95-ca06f4d0a548", "comment": "Malware payload (Mirai)", "value": "0909c2d53d35faa7a84bbedf11d967c4a550becf3ec6db03f2b205a6baae2d190d8dc81ac2aab7b49c81acb01ca004f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748900, "uuid": "2568ae5f-a51e-4cbf-9c93-8cd3d71ee77a", "value": "T137333981B9829A13C5D023BBF66E428D373563B8E2DF32179E226F51378A91F1D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748900, "uuid": "acd4f1de-efee-40d9-989f-388daa607412", "value": "768:lve6dIvQ7Ri7PmhmUyG+jVWpbs7/zyXPo3eObIsCtaEwR8X:Q66vFUyob5X+s/aRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710748900, "uuid": "959f2c3f-359e-48e5-b0be-e4059e1e840e", "value": 50780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710748900, "uuid": "7e04170a-84ec-4c56-b3f8-3c62161b289a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748900, "uuid": "741dbe30-c1ab-478f-8f9f-9f85a53ceda1", "value": "6aa7606c149b10027361103ab33ef6b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fee22e-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749318, "uuid": "ad910d03-46a8-4e52-80c4-f05a1bf3f5e3", "comment": "Malware payload (Mirai)", "value": "af829129bef2ef03facc61c2cde26824", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749318, "uuid": "0c7dab81-b728-4c8f-b39f-fd2cb37d751a", "comment": "Malware payload (Mirai)", "value": "d5fd2cf16b1b611b28f812c7278d7d303141895758f7d69a3df8e58dc034f783", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749318, "uuid": "ad74ddc8-6e20-4b4a-b80e-2de8177ba7ba", "comment": "Malware payload (Mirai)", "value": "ae2d7d2f322e67e50fc3b67c9fcf5726cd0ae1f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749318, "uuid": "000e6c45-6058-4b1f-ad0a-a9b522086534", "comment": "Malware payload (Mirai)", "value": "8888f23587db1844a1a6299ab6af3ee3f991d038374014c156b4a1314acc046b91778c1adc493f78a6befbc694606280", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749318, "uuid": "7d90ab67-d9dc-4814-9cf4-a20b436750ea", "value": "T1B0031993B8825A6BC1E013B6A66E529D3361B3B8C2CF721BCE105B147BC951F1D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749318, "uuid": "a7ec6207-44b8-45f5-8208-e32051806ff2", "value": "768:qCDfEbZjq5vEU8ohci6P5rKfXiqr6l5LLDgmmUnoBfwR:FqqlE/KCcXbQLLpmU5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749318, "uuid": "7150c76c-3bfd-49fa-a067-30a12a6a429d", "value": 39292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749318, "uuid": "68007b9f-f744-49d2-b3f2-c12f8cb49f92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749318, "uuid": "71c92848-42ab-435e-8705-3473d820202a", "value": "af829129bef2ef03facc61c2cde26824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e467d0d0-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710745524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745524, "uuid": "d8103a7d-6e70-472b-ab21-42b48be8d074", "comment": "Malware payload (GuLoader)", "value": "d7ed416758a816a5bd9764b8bcfd8775", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745524, "uuid": "ca5bab8c-4682-4f72-97da-3a7e7bdc7fd2", "comment": "Malware payload (GuLoader)", "value": "d614be58650b8f2e066ec79d4ebe97ab9c8885f2403acdfcd6353edf5abac534", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745524, "uuid": "bfffaaba-a933-46ff-861a-19bb6c04bb9e", "comment": "Malware payload (GuLoader)", "value": "fe2d4cc6b73ed3f35000822cf25328d662495f7b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745524, "uuid": "9f32791a-8b8a-4700-9df0-3d50c8afbf60", "comment": "Malware payload (GuLoader)", "value": "01e133045f91404c13c2485b8562c09db894a65ae71b809096c6149f25aa4070deef4da5e378feac3e8430f0066d5c0d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745524, "uuid": "9e33db0f-ab18-4106-9020-3681be3f2537", "value": "T1D044E6A3CF0A26190F8A2FC5AC61C95286FB41B531161479EEEDC7DDA183DACC2FC915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745524, "uuid": "f53cf217-3df9-468a-a7cc-bac86774bb35", "value": "6144:NbKtYtINI5Mk6fqMKYJwMHy0J4iwLwhB2UcJXkcY9CdLzHxYRvbFjtkohMNOr2z3:hqV3hlvWNajW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745524, "uuid": "7d6ecdde-dbab-40be-a363-8f15241a31cd", "value": 267518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745524, "uuid": "90628460-12d6-46c9-9aa6-17b4eb1ff893", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745524, "uuid": "d2307abf-f338-4bf2-acff-1e8c81fb1aa7", "value": "PO#SI106-2402-05.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9117a94-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710767839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767839, "uuid": "57b31e30-696c-4442-93a4-6b1c6feef215", "comment": "Malware payload (Formbook)", "value": "e2eda8c49ab184de6d3b030bd499e4d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767839, "uuid": "681adb4d-2cda-4fab-90bf-fc4f60f9c59a", "comment": "Malware payload (Formbook)", "value": "d68a5d440931df383de62e3436f5f485ecd75b552e8b78065706a8c880828378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767839, "uuid": "f999de30-1deb-4cbe-a7a1-27ea55d1da42", "comment": "Malware payload (Formbook)", "value": "2747c8421270d9630708f343b98fb2012dc38003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767839, "uuid": "aedce3f2-0f10-4ca4-be6a-8e9babffedd5", "comment": "Malware payload (Formbook)", "value": "65f91d7d917562a4da827aacc856573a1358a240ca4cb1776e67d36d68a88d1891d4337125152b94e643f38c697d3d95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767839, "uuid": "fd30b0a4-4fda-4a07-a68d-f89631bdb653", "value": "T1B9052201BAC9A755D76447F322FA90118BB12E872470D50E6C9073CF4A37FC5ABA2B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767839, "uuid": "54fd5a78-449a-49e9-9f8a-f041e7629166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767839, "uuid": "489116de-f9e6-4b23-a99c-5a97d81e4cb1", "value": "12288:jQAqsJTENl3zRaMrOQ9aMG8fwarcbNJC//a9SvW09a9f7bkWb1eVY20egIJFW9dO:kAPxENlFaMrvEkYarcJJs/amBQN16Yzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767839, "uuid": "09d7126c-20d7-4776-9b49-c03a5940aabd", "value": 841224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767839, "uuid": "73dc294e-5953-4512-8c6c-0ca2d4db069a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767839, "uuid": "4716846d-cdbe-497a-892f-dd4e363018f2", "value": "duGqHKp0OUXaX1D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d67f53-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751893, "uuid": "d4519d14-c48b-4b94-ae65-63638471fb9c", "comment": "Malware payload (Mirai)", "value": "05e4502ac94d5a47eca65d2df74f447c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751893, "uuid": "8ab28c14-ae49-4cb5-afaf-0adf5c6b34e2", "comment": "Malware payload (Mirai)", "value": "d78efa17a030b24fd3a72ad3fdcf99991acc1049f8b507321e0f789694aeddfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751893, "uuid": "7fa3c762-8934-4258-99bd-807859d40c2d", "comment": "Malware payload (Mirai)", "value": "c851ae9521e7a7da4500dbe3d85c135b22fc558e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751893, "uuid": "5ee2f138-5a55-409c-9f9d-efd69674415b", "comment": "Malware payload (Mirai)", "value": "df8b65cefeb6cd7ef07e0da56d79918c8c55d1095494802ed55c0eb8d391f1f9dc93ddfd8819e30c3d07950efd142204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751893, "uuid": "1ee7429e-c489-4d20-be17-ea5cb5bd3f46", "value": "T1C7136BA28CA41E14E185C535B8360F32F357A910654B6FBF16A6833D8887DADF2463A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751893, "uuid": "136999cf-61ce-4338-809b-16ba607771dc", "value": "768:svHLLck6cB6/ALceV/36cDK5AiC1kVK35S5aUoko++eCdgNJJfiwbuqI:svH8YM/hU/loBK35S0DkoeCdRwSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751893, "uuid": "c1e67f9b-bf1c-4b66-8d07-e9b1ae26ad0b", "value": 42476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751893, "uuid": "8e7b0e63-8963-4ff8-8f6d-bc0ad5f55bcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751893, "uuid": "b6b1a450-d92e-40f5-bedf-1ce76aef96d6", "value": "05e4502ac94d5a47eca65d2df74f447c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0666be-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765938, "uuid": "6d4b312b-dae5-40c8-b8d4-b80537c39d5c", "comment": "Malware payload (Mirai)", "value": "c71bde846e16e2683ea245edec2e87c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765938, "uuid": "b43b297d-f1f9-45cb-8fd0-e99b26f3015f", "comment": "Malware payload (Mirai)", "value": "d87c8f4aa975dc7e03925db8d2026947910e0e99bcf3ccd3cc5263ec8e114b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765938, "uuid": "b4bc6366-fcc2-4641-ad5f-da4ba3b519db", "comment": "Malware payload (Mirai)", "value": "ebe3f8d9664e0ba6032c2c6b4dec21a2aa646a5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765938, "uuid": "8177356a-7817-43d0-b796-9d00282993ff", "comment": "Malware payload (Mirai)", "value": "3161369c225ac0eefeed76c35cec9d9d3e76a04153b4c38b56aa3f1c9fbabd06785ecc5f995e763534d437239ca65fec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765938, "uuid": "f60b227b-eb2d-4ac4-99f6-95f7b43f5435", "value": "T193230841732C0543C2A25EB0393F47D1E7ABAE9132E4F288750FAB4AC5B5E335546E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765938, "uuid": "cf5a46c0-a6a8-410c-bac3-fe413324cfab", "value": "768:YwMw/1cU4QLDj6XVNrsiyL9fKmioJ7I7wbpJ1fz2SXw+jOMFJWSJIsQBl:aU9DQNIL9f2dS8LatFYBs2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765938, "uuid": "be12b821-f18a-462b-8e66-2c212d6568b4", "value": 46524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765938, "uuid": "ab4be8f8-6ba4-4d39-ad96-1c25d9508a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765938, "uuid": "f9561ada-3029-402f-ba7e-b59904278908", "value": "c71bde846e16e2683ea245edec2e87c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda5b854-e506-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710752760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752760, "uuid": "786f866a-d8db-416e-9781-c6e5f59ef0ce", "comment": "Malware payload (Mirai)", "value": "422df7819d37eb5e79f3fa8db8d6ec4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752760, "uuid": "d15a0b7b-6de9-41a6-8196-fbe184269bf6", "comment": "Malware payload (Mirai)", "value": "d9c96fffcf9f27f941ff823108bc6cb69ab468f06927c6bb796e1a4db998388a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752760, "uuid": "0ec9e400-9b15-470c-8c94-12207538551d", "comment": "Malware payload (Mirai)", "value": "bda1c51732f0c319594fabb142a5981452eb383a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752760, "uuid": "88255f80-8ee6-479a-9199-135536a02070", "comment": "Malware payload (Mirai)", "value": "65cc4cdd947033c8fe84abfd15a67a24b35d4c0796204e6a1d90118da5a37c176c5b5cdeeb12ac61a4d712546ddbda7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752760, "uuid": "ac305753-0ebf-4d4f-8571-2cbb77775812", "value": "T171838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752760, "uuid": "1993f135-ba82-4936-8e1d-131577783122", "value": "1536:LsMhLMLiQ8lHvBoaAopJpLwA9Z5lsiad42+:LsMhLaeZvBkA9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752760, "uuid": "f1c5bc40-a3e6-407a-8518-aad8b37b1de0", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752760, "uuid": "7b3f354e-200e-4588-adac-726f815f8e95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752760, "uuid": "5681a741-a0d9-42a8-a485-d74694d86faa", "value": "422df7819d37eb5e79f3fa8db8d6ec4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b59f8d-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763211, "uuid": "a767f86e-7c00-426a-b732-3156482f24b0", "comment": "Malware payload (Gafgyt)", "value": "a54200f57df191df286bfbfb19ced909", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763211, "uuid": "74d290a3-826f-45a3-abf8-5e5975e7807e", "comment": "Malware payload (Gafgyt)", "value": "d9f122cf542b68cb1df6e58827813ee8486ab6a5a807e20897be8596ccda495e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763211, "uuid": "e69ae8ff-c69b-4f93-9f6d-123c4c58e385", "comment": "Malware payload (Gafgyt)", "value": "f52d1a816280630c3e276737f752f066dd236d84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763211, "uuid": "ef7ff64c-c5d0-43f6-9340-e99a771d6d46", "comment": "Malware payload (Gafgyt)", "value": "7fc59525a16a5dacc59e17459bd65f4ee1adc1f7a913bbe6b3f69da24e1af441f6d410b4ecd91839d129969f3cca3c8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763211, "uuid": "cfb77636-d40e-4206-9a9a-ac1690d76953", "value": "T1D4B31ADBA30C0743E4DF97F81F673BF447D9B6A212AA15866009BE8047E3B781522F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763211, "uuid": "e0f82a50-0681-457a-947d-440846369dcc", "value": "3072:N/VTKmXCkN8M5hri3WZKLJ+K7uTLWUKGM:N/xKmy88M5hrYLJ+K7uTLWUKGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763211, "uuid": "026bfd3b-ebaf-40d6-b118-aceac1b5cef8", "value": 113118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763211, "uuid": "5b09a54c-4aec-45a6-a2c8-10ed6608e74f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763211, "uuid": "cc37206e-e43d-42aa-85c8-f9c98c5fee8f", "value": "a54200f57df191df286bfbfb19ced909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d897e5-e57b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710803059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803059, "uuid": "93d661c8-e4cd-4b6e-a8e3-32eefb59c4f5", "comment": "Malware payload", "value": "e3255b216748070e4bc397405fdf6fad", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803059, "uuid": "214d5e75-8d4d-453b-bebc-20579b800011", "comment": "Malware payload", "value": "da08f38fa649643f410f14811c7e3cec28c7aaf5b98ab06bae942695e15a30c6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803059, "uuid": "54086bc6-447e-4955-a7db-df7be0290fd2", "comment": "Malware payload", "value": "aac9ba5c1a98faa2f03a20cc39b6afdb72f3a2d4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803059, "uuid": "86d8aa5c-f629-4b1c-a124-67b19b73c667", "comment": "Malware payload", "value": "2316557d9f30811a56e788903673f35963b86b7356bcec0f66163cdb47ff42dbd3ae8042ea5bf2b27da250c8f7fac810", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803059, "uuid": "1f4aa006-ee60-414a-80de-3cba965c1895", "value": "T19F168C11EBD405E4E56BCA30C92E8732E6B1FC5A4731838B0558F35B2E73AD64F6B621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803059, "uuid": "d21bea5b-bf16-49bd-82ad-8b1b6000c21f", "value": "27e7881a950beeee69cf3c3d28dcfb8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803059, "uuid": "56306bfd-b2eb-4997-af8a-e60720f95caa", "value": "49152:/FL8Xf6qIED5X0MJEJsaoSo5dqqlg+egF0ty6H4NhGKjmuU5JN:69n4ojqV00Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710803059, "uuid": "d2f058af-253f-437b-b0b6-93b08c3b4b6c", "value": 4242432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710803059, "uuid": "2f49c682-4110-48f8-ab8c-5815df984810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803059, "uuid": "f8b63e7e-10ad-4a4d-bbe7-0da3a56c2a73", "value": "e3255b216748070e4bc397405fdf6fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3008f4-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757696, "uuid": "8f8e255f-fe0f-4530-ba0a-87f86625fa5b", "comment": "Malware payload (Mirai)", "value": "3ac4f3cfc042e0cc7d840f6d8757c2c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757696, "uuid": "1e542c9e-9abf-4d52-8a3f-d0dd90ec10b3", "comment": "Malware payload (Mirai)", "value": "da6e95410bfe517e856c5edf23b9d2a8d11c033d9810de86fad25d4d340ec6e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757696, "uuid": "8b4b19c5-8512-4a3c-aad8-69c1b305492b", "comment": "Malware payload (Mirai)", "value": "e291582da820262afc0167745ba74a61351a0460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757696, "uuid": "d6385ab8-2b46-4295-960c-ed162aa0649d", "comment": "Malware payload (Mirai)", "value": "a1f275caf6d48d42395579b401f94f0613324eee1f4d0d87bceab3d7e51f7377e5e93dee8267847793ac99a41efb221f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757696, "uuid": "9af571ad-5c07-426a-bc90-5b630755249a", "value": "T1FC03F14AC54B5B93CE943D3EAC07C7018EC224BABBCF3AB966142660D76DDA794851B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757696, "uuid": "9d670481-ae9e-4ba2-8c72-0bf5987cc34f", "value": "768:p/8ZO7nwr/HB3CacdVpXH52IBnyYDicjkRnLR06JaYRkevh2vTeCzEV2S1:p/8ZvrvlCpdnXH52qnywlARnL+67kSQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757696, "uuid": "f9731c07-76ca-4b9d-bc2b-2f9e8a1996a1", "value": 39916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757696, "uuid": "f555ce8b-1f2a-4bcc-98c4-b68d039cc076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757696, "uuid": "d1f940cb-fd17-4098-a6e0-1a736d43bd05", "value": "SecuriteInfo.com.Linux.Siggen.9999.7234.19563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fc1df4-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749303, "uuid": "2624bcd1-b6e1-4dff-b92c-7579f2ff7a65", "comment": "Malware payload (Mirai)", "value": "accb5e1a266fe3cc9682c82458a4fb5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749303, "uuid": "91eaa0fd-1d85-496e-8d97-a5406b467b0d", "comment": "Malware payload (Mirai)", "value": "db87244819df5a8dece57458fc4acfe11ff9bda944ff0a467433eb59e304dd32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749303, "uuid": "024f9c6d-7cca-4b6a-915f-b63e07e53f05", "comment": "Malware payload (Mirai)", "value": "140fbb2f858def8e1f62fbbfe00ac318d45939ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749303, "uuid": "d5c9dc8d-826d-4460-8da6-3d5994039354", "comment": "Malware payload (Mirai)", "value": "98eee7497bda7529af7cfb2756e779d5f702d4854837add61f38f7f6f7da6b973ed280703a198e703142339cdee2cc9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749303, "uuid": "f90d39a9-51c9-4e0c-b996-2918622f087f", "value": "T1F43329C8D987D9F8DC5115712027FB368676F03B101DEAA7E79CAA23BC49B81D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749303, "uuid": "6e5bd1bb-5f82-487e-91cf-72733196076f", "value": "1536:BAmkKnnAvjccy7ZeDm4EJd+67ZtP/2Bj6NYc2dZKQDfs:ORKnAvjcV7ZIEJdxZtP/2taXSHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749303, "uuid": "1fea659a-bcf6-4b0d-8c4e-26827a4aef55", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749303, "uuid": "55039596-3e6f-4c50-93d0-db6fc888996e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749303, "uuid": "edf0c752-7b52-4999-b653-d43378091315", "value": "accb5e1a266fe3cc9682c82458a4fb5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac661da-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710747038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747038, "uuid": "2594121d-57b7-4bd9-82fe-886d8c0afa4c", "comment": "Malware payload (Formbook)", "value": "8fc6d28d6aaa3d42d47907fdd15525c5", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747038, "uuid": "d2a23e57-31f3-47e4-b4f2-62715dcdd452", "comment": "Malware payload (Formbook)", "value": "dbbc943775cef80dc40c35392e895c1ce2e29945d9ffd418c6cc348373cbbbf0", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747038, "uuid": "79d87bdd-7f27-4557-bd9b-cc861857afe3", "comment": "Malware payload (Formbook)", "value": "8ada7823cf05d5df50ac521e1c61389b706946c9", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747038, "uuid": "1cbf3380-5219-432a-9766-80a962dfb776", "comment": "Malware payload (Formbook)", "value": "b3c18099da249deb5d19d775df86d39911cb73641776417700b1aa9edcb22c602035d4f58a0b4ae6cf9bc9ecbdecc043", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747038, "uuid": "c6aaced3-6e39-461f-aeef-40abf1ae8d70", "value": "T13AD423A1D24F3BC26845925B1A9FEC0F33E174095A3DB9DEDB37B0160DC946A71063AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747038, "uuid": "fe388457-6f78-4222-b699-40f957ba9df0", "value": "12288:WJlc9Qzr/cKXSZ0pliB3Ar/QKqN13WHWZGa4rbuO+7L1pw:T9QzX/aBv6buDfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747038, "uuid": "815c89b6-c578-4416-96f4-f7e9b4b5d89b", "value": 629685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747038, "uuid": "500c7c35-b6af-4edd-bef2-b16a8f0fee45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747038, "uuid": "5c1940eb-89b4-40e0-a3a2-689679667058", "value": "Payment TT Copy.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00fe7f2-e53d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710776333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776333, "uuid": "3587011f-d4e8-48c3-9aae-3dedd0e2dbb2", "comment": "Malware payload", "value": "8eceb7c397191111ea7ad432b7efaef6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776333, "uuid": "0dee0167-6a26-46fe-b0e8-934f1d2e7448", "comment": "Malware payload", "value": "dc6a325d755ff44faf4f2ee7647617480a9d7a5c720ba0558dc25c415e820f97", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776333, "uuid": "9408f0e2-ffee-410f-8fc5-a9aa792d6d70", "comment": "Malware payload", "value": "e0befa3c414bb11ed2d51fa10dc3b19c0a56d90f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710776333, "uuid": "3b867a22-dfe5-4ce4-a245-2135e25cea6d", "comment": "Malware payload", "value": "9602e1ad2fd466109847aeca86d0eae8e5fa1ad3daaf08bbc11e395809a4c43e578174529386d26e99d09b48dca03eae", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776333, "uuid": "e768b82d-dae5-449f-9f95-a4cbca2603fe", "value": "T1EF023B9BAC9349A94BD3BB02D54F0A00CABC987BDC6A9101FFFC5315A798454B1B435C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776333, "uuid": "9d48938b-5366-4ab2-9cea-2f407723e57a", "value": "96:OksV609KPnxrcvUceCyNuS68ps+9Owlm9UQYve8oPVQC6sKYR7pO8UUwE6xMWfhL:OksV6+UcP45m9vt1RR7pO896NpGLJ9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710776333, "uuid": "69fcbb3b-4c9b-49cb-adac-1da27f3d04fd", "value": 8320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710776333, "uuid": "d13cd1cf-649e-45ff-8b60-667f5844f658", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710776333, "uuid": "108a4038-3a54-4dc4-848a-21c7d6ee3d7a", "value": "Eneans3varlig.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f398637e-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771749, "uuid": "90e970d7-239f-4d6a-94d0-7440eff29f7e", "comment": "Malware payload (Gafgyt)", "value": "8cbd71df2949fb2883d1a8c9c60c934f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771749, "uuid": "0090c916-f595-40a4-9a25-f7a1a1819687", "comment": "Malware payload (Gafgyt)", "value": "dc80486a0741647f78298f052feb02dd54f3e93a65c4d10c926bbbc137b24c61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771749, "uuid": "8d0de5cd-3e67-4d15-8c44-f3cfaa13e71a", "comment": "Malware payload (Gafgyt)", "value": "0208ba8e3b5e6ffec7f2281b0158c2078932490c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771749, "uuid": "370db046-7d22-457d-bf73-6c9c987def25", "comment": "Malware payload (Gafgyt)", "value": "ce23412d978d8fa97ee8b16ab766241dd98870f65aabfbf3352f6094c722b3aa5be431dfe6e67031f21dfac9471f47bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771749, "uuid": "d431d462-eef0-47fb-ba59-9e4209145be6", "value": "T1C2A31A41F9518727C3D327B6EB9E479D3B351694A7D733026A38AEB42BC17C82E36520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771749, "uuid": "4e7b5711-31e5-4492-aeb3-2a5e938495db", "value": "3072:k2nJ+zEPzb9Tt0n9K7vqRvmPiqQ4bvWhxwQ:6zEP39p09K72mPiqQ4bvWhxwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771749, "uuid": "b0b4434c-7603-4355-ad4b-801ee5e05730", "value": 106226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771749, "uuid": "42ce4b0f-75fd-4ea8-b836-7aef2fde27a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771749, "uuid": "f3077cc3-32d2-43b1-844b-3f5b378fa2c4", "value": "8cbd71df2949fb2883d1a8c9c60c934f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a7b159-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763194, "uuid": "29d216f6-d0b1-4c86-b26c-9434516e60fc", "comment": "Malware payload (Gafgyt)", "value": "22564b6bc08b4634a2435fcb0cc6df33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763194, "uuid": "e0a1e26b-16b3-40be-8102-fa05e7fd601a", "comment": "Malware payload (Gafgyt)", "value": "deb5c945c6200b5ea52accae9befa276a31f5b182c105eb345f3fc7035c79158", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763194, "uuid": "1e0d0bf3-a846-41eb-bffa-aef158c28ae7", "comment": "Malware payload (Gafgyt)", "value": "03a8a7bf971ed4c4e20aeef13c939584abce0465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763194, "uuid": "3a5c57b7-b86a-4351-8282-5585f7b083a0", "comment": "Malware payload (Gafgyt)", "value": "6417bef6787ee5dc5d4591774d5e509a1b06417d4e32345335b1ed374cce12d635434681dec87e69a93f6ac002a8521b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763194, "uuid": "81ee318f-9644-4ef8-af9d-277408309932", "value": "T1AAD31A05D4509B23C2D2577AFF9E464F37225BE4AB9B332256296EB02FC279D2E3D410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763194, "uuid": "200f0c89-e5ec-4811-b079-245f893112b3", "value": "3072:ymQxoHQIuTBhmCImlYaAFft/0rAHpFUtN5hl52Jx3Ejip0smyhQaS+pg7J:yqmlYaAFfGtN5hl52Joi5myhQaSGg7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763194, "uuid": "cc86d1b8-0873-4e3d-a52e-d15a23d9802d", "value": 138771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763194, "uuid": "c4d85638-d954-4014-8b1d-e2f94e045d1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763194, "uuid": "4429dbdc-8a93-4b32-ad95-c333d3fc612f", "value": "22564b6bc08b4634a2435fcb0cc6df33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e271075-e4c2-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710723314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723314, "uuid": "4c7874de-cee6-4c4e-a0f6-39a7c453c570", "comment": "Malware payload (RemcosRAT)", "value": "44bcc36bdb51f83393b7738141b574f7", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723314, "uuid": "4f37f350-b663-4bda-8cbc-be2f9f036ecf", "comment": "Malware payload (RemcosRAT)", "value": "df098fdcb2febe5e377c3f25a4e97006e6befd2168dcb90353ff497659b5f4e2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723314, "uuid": "c50a1335-9951-4861-9ec0-e441343506be", "comment": "Malware payload (RemcosRAT)", "value": "cc0ff5768f886d2dd51a17eb1e0c0c2e9142e041", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710723314, "uuid": "349b0d2f-d368-49f4-82e4-6f98ad1e63d5", "comment": "Malware payload (RemcosRAT)", "value": "254ee6d0280aead20f2ee5a8c3889466fdace958a60774d5eb826b811d9cc34f5027ceec89a2c45a50cb6e1a3434fd85", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723314, "uuid": "1a9def37-0294-42ab-a627-90aa7615b8a6", "value": "T173C561AB2FAD17865304739B97AFE9151A17CCEC07C62F8C92C39CC94419BA72950E4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723314, "uuid": "a3d76da7-ccb5-43d3-a991-fbd5d345918f", "value": "24576:Iej4//ttlV4+HAIgigtO4/X8wft73Q382mrZDcot/:IY8zlTA1P8wdEIZHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710723314, "uuid": "ecc2f809-d404-41b7-b5fa-aa863ff6d93b", "value": 2569083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710723314, "uuid": "1d398649-de04-4d0f-96bd-c7fb80365ff7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710723314, "uuid": "3612ee30-3a4f-4522-8119-325c3a4efb1b", "value": "Swift15032022.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7293062-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767862, "uuid": "2bc0cb56-81e4-4adb-ad3c-030fd90a518e", "comment": "Malware payload", "value": "0d1c169cbb1251d987bf3e6db85bad55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767862, "uuid": "cb4a34cf-53d2-4b47-b78e-b204db76f74f", "comment": "Malware payload", "value": "df3433b74307990e6fb053b5892cded366140d3da8f5ff8b5e0a6b5ccaad6839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767862, "uuid": "23e8ee23-615c-4313-84ad-bd6168bb6c0e", "comment": "Malware payload", "value": "f759fbe89ceca9312cbd39e78ab174beb984ed72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767862, "uuid": "d459339d-0ab6-4100-9221-a156a12ca0df", "comment": "Malware payload", "value": "dee9dcf32de215698db5ec73f6cea34f94adf8d24b2be860c58fae67a3442c438f1ad5bad197e8de39ac91952c20b0db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767862, "uuid": "f19d71a6-3d93-4a31-a5bb-523aac388f63", "value": "T12F941282BE9085B3C354A4BAD0D35BA59379BD24805359A7B7C4FF2F7433A058382F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767862, "uuid": "7a1ba272-08c5-432a-8a8a-a3d41a1b064b", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767862, "uuid": "f518551e-1c8c-424d-b35c-359a4c706861", "value": "12288:BOLZn5yG1PsuwO4hJyN2Z5bDeOH0+1Mce:yh5p87yN2vX1U+Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767862, "uuid": "830c5470-fd60-497a-b081-974ae4c5bfb7", "value": 438760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767862, "uuid": "357f4914-ced2-4e42-a687-9c960dde1d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767862, "uuid": "6a2791e7-9715-4a00-b16f-bc3a87a19b26", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823a7080-e50b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710754808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754808, "uuid": "ca5825fb-21be-4b70-9418-e4ebe8d32eb2", "comment": "Malware payload (Gafgyt)", "value": "ec5a23dc37d4d98ccd9ca65a91c3fc4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754808, "uuid": "02aad3b0-a3c9-41ed-8444-af7f9bea5827", "comment": "Malware payload (Gafgyt)", "value": "dfcc90b4416ccac46a96b3e1d52d59b1715098b13645b933b7b9b21fb8ee05d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754808, "uuid": "2aae99a9-5110-498c-9b14-76993e06c497", "comment": "Malware payload (Gafgyt)", "value": "506c9887e972dc8f401adc85ba1588922530ebcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754808, "uuid": "59f5df65-aca8-4a77-8625-cc8ad775d377", "comment": "Malware payload (Gafgyt)", "value": "da6ce3a2c186d59a0eb9e09344bbd8869578285aff3f9c3ab0d6b1fe3ce445eaa37a2758760e025e3a68d6b94ddb9392", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754808, "uuid": "b553ce34-d9a0-4788-8809-a3eb24017b8d", "value": "T195D3E730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754808, "uuid": "beaa8448-9838-45ef-8ca5-b4e39283a92c", "value": "3072:+DShVLkDZ6waCAdcl3bYJOmP46aQyfPluesNb:VhVeZ6zcl3boOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710754808, "uuid": "6a70aa7a-cf1b-401a-ada7-a760a6a0dba9", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710754808, "uuid": "f5204711-79b7-4909-8083-90b1cbc4e63d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754808, "uuid": "6ff75248-a25a-4319-bec7-11a3819a58fc", "value": "ec5a23dc37d4d98ccd9ca65a91c3fc4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d039e8-e522-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710764527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764527, "uuid": "0b1f735b-8c17-46cd-bdb3-a0020d9e62ac", "comment": "Malware payload (Formbook)", "value": "f2ee7bf59b3d4b3b97de028e9019fdb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764527, "uuid": "2585db3d-be36-4988-9350-35599ddb5670", "comment": "Malware payload (Formbook)", "value": "e02090cd2eb0b654d0013fe4a8db53ee67fe570d25f5d3b520edc382bc84fb4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764527, "uuid": "02926e5d-1eca-45c5-b7ae-59c89c1814fb", "comment": "Malware payload (Formbook)", "value": "123d905cbd55fa087ec83e0d29c5d222739c7cff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764527, "uuid": "a9a7c947-dba8-4abe-ad81-18c54d1eedc7", "comment": "Malware payload (Formbook)", "value": "1479c2513f419a22439cb3d91b65ae4cd89547e1de6f2757d6ca487afaf3125ac3a87d26f594baa8810cd8e75bfc3401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764527, "uuid": "64c3c050-8088-429d-9017-97b45edb292c", "value": "T19C451212BBC24472D06319336A64BB216A3D7D301F66CEDF67D1AD2CDA306C1D631B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764527, "uuid": "d9f07adb-6700-47de-bf91-68a8fc4890ad", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764527, "uuid": "960c9f25-8f4d-4b3e-9e45-245c31f5f098", "value": "24576:jTbBv5rUDWxz4N1/TmgyBKWIwjmL6THBvWFGa6mPcyGJzQmrD4Fr:9BtgTmEpwRdnoGBQ2Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710764527, "uuid": "fb1db648-535a-4341-a999-18cdac916834", "value": 1211894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710764527, "uuid": "6e22686b-b96f-4c9a-ae44-bd59dfd51ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764527, "uuid": "fc7676b3-24e0-4312-a591-90089fec54f4", "value": "Final Shipping Samples and Lables.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf88e4c-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757860, "uuid": "856aa04e-c8ec-466c-81f8-8d2561655744", "comment": "Malware payload (Mirai)", "value": "1d58c91b170c400973cb950c791c688c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757860, "uuid": "54612893-3355-494c-8df4-dbf895adf0bc", "comment": "Malware payload (Mirai)", "value": "e06c2e3b9858b3f527080bd61de4b1ba7212b88a096c9388b48793b379487884", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757860, "uuid": "a94e3f8f-0710-4f94-b6f0-55055e9dcc7c", "comment": "Malware payload (Mirai)", "value": "3384850d2d28745a10747d6c1a7fd4a8f2f0ac56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757860, "uuid": "249b056d-9679-48c0-b00c-0ca269c986d8", "comment": "Malware payload (Mirai)", "value": "dcc2e46a2d5a8736fa74d25d4837bda3834cbccb0a968fc9635c60d1f840e903a8972a53bcbe6adf031bd156d5922cea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757860, "uuid": "17d0e5b1-446f-4d7c-84e0-5f01951dec7c", "value": "T18583B61A2F618FADF76C833447B74E21A35833D623D1D685E15CE9011F6034EA46FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757860, "uuid": "33d8d3c0-7884-4bc3-a7c4-055fc8b42013", "value": "1536:miHJduyCLgve8x4kTkYuzdaS+z6e5ZdKxOufPJy+5n/veSOBqKOn:n6se8x4kT4EwP4+5/EDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757860, "uuid": "7dc286c2-5a3e-40e1-bf5c-3ffc630e7fbf", "value": 88668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757860, "uuid": "e8c38018-46ae-438a-beb8-596a66504cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757860, "uuid": "b0cc1363-2f09-4d91-8790-ecc3ed9fd022", "value": "1d58c91b170c400973cb950c791c688c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b260f0-e578-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710801782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710801782, "uuid": "9f774243-cb8a-4565-b6d0-dcfacda64914", "comment": "Malware payload", "value": "ac64a8cc8e645102752ead6ce64a485b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710801782, "uuid": "fad548d8-2c47-4771-9d73-8d35c8105417", "comment": "Malware payload", "value": "e097b2b126e88b7112c8748e5dd87251142ab7502a3fc1911aba16d6dba4b6c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710801782, "uuid": "2f8831a2-0d63-48a3-8c02-be3bb28ff61f", "comment": "Malware payload", "value": "20173b4f8fbed2eac94ca17c3dc77dfa43eefebf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710801782, "uuid": "57160462-0064-407b-bcd4-220b54e4fbd8", "comment": "Malware payload", "value": "a8e6031e3783f9a891d159bab2e147011dc70f6508c21c37e582cf8bcbd4ea2cf4f5879a99d7eb7fc4b256d20ef6e1de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "EQNEDT32", "colour": "#36BD12", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710801782, "uuid": "673a4a21-fc22-4d36-b7d0-7cdfa37cc326", "value": "T1DA33DF0A7242C455C097EE788DDAC1E76325BC62AE56870B3185F34F6E3D6C29E2770E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710801782, "uuid": "b240514d-16c0-4deb-a8ce-903f96072352", "value": "768:JXyBP0uYb0+rWI+toxeIZaCSnwLPzRtjkJPHqygJ2qro4E3Gh6:JX68uYb0+rf+1IZTXrRt4J1gk/PGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710801782, "uuid": "b8356a99-b7dd-4902-9213-2c8b1b739bdb", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710801782, "uuid": "64920dae-c713-4a9d-9fc4-4ff8715a8fdc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710801782, "uuid": "e986f967-a1f4-46a9-85c9-fd4bca224b75", "value": "e097b2b126e88b7112c8748e5dd87251142ab7502a3fc1911aba16d6dba4b6c8.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959f9592-e50b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710754841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754841, "uuid": "5f6c2cb5-8664-45f7-91c6-3d1f265e43a0", "comment": "Malware payload (Gafgyt)", "value": "7aec32b8429ad74ab7ed4eecff6dfacf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754841, "uuid": "ce0f19a6-7b6e-4478-ab0b-66dc3e91e177", "comment": "Malware payload (Gafgyt)", "value": "e0f275d1aaa934cb1df760b954d000ed3799aa909583995ce1702ffb2449b0a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754841, "uuid": "7d16972a-696e-4776-8895-3a06a54361c5", "comment": "Malware payload (Gafgyt)", "value": "4ac3f1480d91662839eef9f6d04aadf158584d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754841, "uuid": "b7ba4368-d193-44ac-99fd-a9abd34f6a08", "comment": "Malware payload (Gafgyt)", "value": "e953493d877b00642f18d91fadb2423a2cec531fa122e571660ced31ed2c0924dc905d1e231d85de1188749078ff4600", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754841, "uuid": "304a025a-d728-49c8-a6dc-d2a8154e5005", "value": "T1AAC3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754841, "uuid": "b5c9e4c3-851f-49d2-b506-8152b1cf7540", "value": "3072:FDcYVLWKlAQTv+mYnbpl2m7/L7QsvmGugiNb:WYVxlAk9YnbH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710754841, "uuid": "647cea33-7b70-4daa-8c9e-53f46c4ab674", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710754841, "uuid": "311f5e88-b2cc-43bd-bba0-15b01ba4ec2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754841, "uuid": "7ecc8695-6757-4805-bbcb-40ee2a3b2959", "value": "7aec32b8429ad74ab7ed4eecff6dfacf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7746b1ec-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710745770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745770, "uuid": "f5891303-30b6-4769-aad5-e2b0f201e235", "comment": "Malware payload (GuLoader)", "value": "661125400935a8e49af5c3e623510c41", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745770, "uuid": "c29e85df-50c0-4bb7-b6ff-aa5b0a20b180", "comment": "Malware payload (GuLoader)", "value": "e156c4e8e53c6b93166fea54fb521d9eb8bc74143ad52697a28809f5639205cf", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745770, "uuid": "15b70a1f-27f7-4ca6-810f-28b7ca8249c9", "comment": "Malware payload (GuLoader)", "value": "243966d2588d2bed628de929faf3712b0dd57dbc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745770, "uuid": "863614db-8386-4edb-a37c-d62ae08838e2", "comment": "Malware payload (GuLoader)", "value": "9cbdb08c247ea3f803d1d7e28b443c177163d3d8a1bb5fae9c5a3d1c17794a1e6ab70bb3606e097ace81cf4486122160", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745770, "uuid": "6b4b337a-4312-4a29-8304-70ff4ecfc2e4", "value": "T13BE423C9A3CDDDABD2430A73A5F2AFF2D43EF52822DA060747546B3DB270681EC511A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745770, "uuid": "0e6805c1-b7d3-421a-84e0-207f5fe28c55", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745770, "uuid": "caff32e1-4eb2-4e98-9f9a-5b385d3cdf5f", "value": "12288:kq3Jx5eWUU771ONhglOHQQ08yHUKh4y/1zAUEwL2YDMGUNO/QhH1CRjU0u3FZWTq:nJDUU774hglvQOHU44y/10UE6RMGDIVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745770, "uuid": "75ce9a7d-e6a1-4a06-b20e-10ad5c10bdcb", "value": 678112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745770, "uuid": "8e227afa-50a8-4922-9c33-0a3620c8324d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745770, "uuid": "c75598eb-568c-4554-880c-3ba78fa578de", "value": "DHL Booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de430419-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767848, "uuid": "67b9cf2c-4e02-4146-9bb5-e6ba15069c3b", "comment": "Malware payload", "value": "edf4ff0bc5da6dabd5e7b78113d73bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767848, "uuid": "8a121901-1434-4644-9bea-9ddd2e493b0b", "comment": "Malware payload", "value": "e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767848, "uuid": "05850bea-9bac-499d-978a-9cd2999203a7", "comment": "Malware payload", "value": "af49d2935b75627f6f748256f10c555d54040f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767848, "uuid": "e23e2e3e-b62c-4cac-985b-3c6e3d0815c1", "comment": "Malware payload", "value": "19ffd310cf9696b173cf45abef96b7beb61d117f20fc5a03e603e439763e3440b8dffecb5632d21577ec3d995afcfb41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767848, "uuid": "cca3aa92-c271-4544-a5c0-f9d361adf768", "value": "T1D213D0983E4FB942D2850C382A03EEBABD52FD444D09268BB5B47B4BBCB1F96455CC46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767848, "uuid": "3547561c-80c7-43d7-b3cd-eb7429351302", "value": "98cd465c2ab2841f9fd90d5e847563f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767848, "uuid": "80cfb684-9f37-41fc-8bf6-4940186680d7", "value": "768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767848, "uuid": "0058d823-c9df-4444-b3a0-6a3977dafc7a", "value": 42966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767848, "uuid": "95309ad0-85ec-4806-9d2d-820d187830cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767848, "uuid": "264ac757-3046-4fb3-b7fe-d73147d07f74", "value": "mail.txt .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe12f87-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710771743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771743, "uuid": "2417f7d8-be99-4993-b1a3-a3265f673700", "comment": "Malware payload (RemcosRAT)", "value": "f7c281ad8f95308eda627147f019d7be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771743, "uuid": "0ee7ab2e-6d8b-4738-8c6e-24454a62ad41", "comment": "Malware payload (RemcosRAT)", "value": "e1cb41543e7c1f4fb4809f85e8c2e95b8e8cfdfe1c10cabdfdf66d0f6833d24b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771743, "uuid": "0b28a562-af53-48f3-9331-3a608f9aa16f", "comment": "Malware payload (RemcosRAT)", "value": "bb95cc4d23e676f2bab42dfdae9c6c99d7387790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771743, "uuid": "75db0e97-40f4-42dc-850c-89057a2e5165", "comment": "Malware payload (RemcosRAT)", "value": "100730fb14f6c742667c893fcfce8a6ec419a264b476c9cc9eb27c53e71967f75f5e13126d880233a8c5c0ee0479434c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771743, "uuid": "770491b0-c6c9-42ae-8a0d-8a303b83fa96", "value": "T1B783A34BBB1C57AED79D8AF2B87A03304268EF931545AD59BDC8FD2E047234C29136D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771743, "uuid": "4bacf818-55ba-4ebe-b739-d266c522a3bb", "value": "768:afHUka4Sj0D+Fc0Q3m3CJV1jpugzPbPhcO35Rls9uQjr:ws4Sj0D+Fc0Q3m30Vxpug3d57s9Pjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771743, "uuid": "36a870c9-8039-4dd0-bb17-01016dfc5a7b", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771743, "uuid": "c2237c35-af4c-4d7c-bd0e-b6e3ed813ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771743, "uuid": "a4ac121b-991f-43b1-b012-0e145bf10b20", "value": "INQUIRY#84790-MARCH24_Products_materials.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99368b9e-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710757424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757424, "uuid": "2aefa10e-e9fc-4017-a0e2-09ec49fca4d3", "comment": "Malware payload (Gafgyt)", "value": "039363df29b780f10d9479ed026f9e26", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757424, "uuid": "9fe30a52-e29c-4df1-a250-aab1da01a4ad", "comment": "Malware payload (Gafgyt)", "value": "e1ef1ec5242547b4031aa5d4ac6c579d2d138a71b78449825129a55f80621a8c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757424, "uuid": "d9e50e48-b506-4edc-8fa8-bc56efcb97ae", "comment": "Malware payload (Gafgyt)", "value": "6c2e47c21e87f6a63c221fdd73d2299444af86ee", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757424, "uuid": "bb0de97f-7f8c-4662-b455-6e5a5c21eea8", "comment": "Malware payload (Gafgyt)", "value": "cc90d39329a9239a097b3f3594f254012884613c5ed64d74d0c42809b572aa768d07cbc102aa232b70474f759eb021dd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757424, "uuid": "fd751896-e45b-4f1e-aa99-37b290a81b7b", "value": "T134935A27A551C67FC08753F96BDBE5219423B8390F33720A73D4BDA92B1A8C82D9D742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757424, "uuid": "1fe63ec1-5d03-4d39-83f9-620b13ce7c90", "value": "1536:a/7jP5XCc+Johy0qlM5TaOm+tRrz1y653R3o/PZSlUMmoIDddoqlCoIxz:aj1Cc+6EHGTaOBrzAo5oHgNmrDddoOCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757424, "uuid": "b3647da1-3f3b-44d9-b49f-ac281f27ec74", "value": 92273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757424, "uuid": "25899590-48a7-45b4-be27-d9c6abf9a85b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757424, "uuid": "e493e41d-610c-4586-bb4e-2b55442603f1", "value": "039363df29b780f10d9479ed026f9e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92c23fb-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771731, "uuid": "41e77cea-3fcf-4ac4-b615-969534cb0486", "comment": "Malware payload (Gafgyt)", "value": "570d3a675f78e73844334b0f4cb28ad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771731, "uuid": "aebbd033-4e45-4dd9-9ac5-d82c246e7bb2", "comment": "Malware payload (Gafgyt)", "value": "e459503eb2d44a7d64c6815be03e56c4cee130b8581eb21bab90fcf9beaf1f5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771731, "uuid": "cdd14c84-c828-48e3-a2ef-488e7ca10817", "comment": "Malware payload (Gafgyt)", "value": "cd1f53ffa71964d8b103ab17fb4c4f16ab2ad4dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771731, "uuid": "1c6fbad4-00ef-4d8f-8e88-852c00c727c9", "comment": "Malware payload (Gafgyt)", "value": "13a570c307fa50392e2912acc6467c6556bbdef39d8f26f118b65266e14719eca1f32b63cd0e9b224d89afc2de4a69b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771731, "uuid": "793a047b-9433-4ddb-b001-348c58b2bdb6", "value": "T1CDB32A277B230F23C0C9547102E31732AAB5C79938B95397B9E07DAC6F1A9843917BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771731, "uuid": "711be3f1-71b9-4253-a348-2a676eae524e", "value": "1536:FC1lYIR5909hRNM5wCmtht0aT6e94cmJ4HFqXjevRegwQ:+YpRN8uP6TcmOHFqXyvRbwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771731, "uuid": "50fd5729-ab87-4ee7-8630-f189c678a5ee", "value": 113106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771731, "uuid": "37ed6319-bd19-43b6-ba28-5aa629e68d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771731, "uuid": "08cc116b-0570-49cd-b86d-2e4186a23f8d", "value": "570d3a675f78e73844334b0f4cb28ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc58692-e500-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710750237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750237, "uuid": "a728a76e-fae9-443c-afac-5ff6ed58c8b0", "comment": "Malware payload (Formbook)", "value": "842ad1d1101392fc2d7ce158f3ebaec7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750237, "uuid": "81fec1a8-2275-4f85-ba0d-99ad08828f12", "comment": "Malware payload (Formbook)", "value": "e54350487bda76835619ccc44ff79db38db5183f544efbf33159cfd707bcdb75", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750237, "uuid": "1ac4c32b-04e2-44e3-98f3-3e0106f677cd", "comment": "Malware payload (Formbook)", "value": "219f9b72379ce21250351c9d8ee628fc157f740f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750237, "uuid": "3dd9d4de-2e63-445a-ac25-3db905f9fb4e", "comment": "Malware payload (Formbook)", "value": "900d7649c75c6f0180f8072f3604e00de8822dd8895b1291b1e4203711ab3ee9422352ed7572bd0c7f51dd92da23a84e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750237, "uuid": "556e93f6-b48d-42fb-91c9-18c0faa0436c", "value": "T12BF42216B2AC8943E57885F82D2840505BF7229651B7CBC81CDF70DEE7E2F698960F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750237, "uuid": "dfc12c40-11ed-41d7-87e4-fc0494d50fff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750237, "uuid": "deae03db-fa62-4f8a-a6a2-9aa64889d1ac", "value": "12288:cip5ELUDK2tTinH9uLE3gX01+/A8dUQ0JFSFB2eLdtZQP0eXrkR:ci3k4bs9/3gE1+/xUQ0JF8taPdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710750237, "uuid": "2d9a5932-94fa-4566-91fc-3863e7909e84", "value": 776712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710750237, "uuid": "5ffd639a-9ef8-454d-85b4-c32d3d553d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750237, "uuid": "50827880-8697-460c-8ebf-2780f0a0d12a", "value": "iU3WGoA77BdiFdA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43f0f91-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710767831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767831, "uuid": "289f98d9-9703-4adc-a510-29b5702a929a", "comment": "Malware payload (Formbook)", "value": "f99376151aef2c2ef90b182fbb9edba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767831, "uuid": "675d7b69-d9a3-4e44-a008-945366b2554c", "comment": "Malware payload (Formbook)", "value": "e56d9b36c8e463e2da078ca4ba1755d78a1eddeb356d81b00b6d804f78b3de07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767831, "uuid": "f6d6620c-d605-4f0d-a315-d81b94f28540", "comment": "Malware payload (Formbook)", "value": "c2d7ba6ce2e7f9e8f649f16cf8697a69774ce4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767831, "uuid": "7391b390-dae3-47d1-a272-cec93811708e", "comment": "Malware payload (Formbook)", "value": "9148fbafdcaaf30af47ce5d67b763c7ffcc65f46f8b9df7d6c9bda2a48efce4c6342ac90b02a34be90eb5d686fef722a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767831, "uuid": "2da77206-e9fa-4770-a78c-f10942ec9903", "value": "T104845C42AFE4C52BD07F23B5A0F2075A47B8E486B12BEB8F4D8515F91C937426E11B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767831, "uuid": "b925c890-5aa5-4cb9-b1f7-f0daad6ca75a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767831, "uuid": "1c6e97e6-f82d-4c11-95ab-40ced494e92b", "value": "6144:/qSEtSq31J4o2Bg/31wnjuDTtJ6rjaOjMC/nH5tX6hoS:/qpSc1OOGys/92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767831, "uuid": "f0af7e2d-05bc-4418-871b-7dc4b2f4f349", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767831, "uuid": "d8d24d48-5a22-4ffe-828d-2013bddc0f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767831, "uuid": "e873e915-8ac1-41e2-a42d-c913599b2014", "value": "Confirmaci\u00f3n de factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ce975e-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767840, "uuid": "6fb5fcbd-16e4-4257-bbd8-7fe2c62b19e8", "comment": "Malware payload", "value": "f671843cfde5c734ce07aa5a35e32934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767840, "uuid": "6ab6d84f-46c0-4073-9de5-af94d50edbd1", "comment": "Malware payload", "value": "e57ce68c59b39ce145bbeec16942a48068fcaa26f6ff7d7a2c16b0d947d17873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767840, "uuid": "6108126b-7ede-496b-a408-7504557029d8", "comment": "Malware payload", "value": "717d3b853415bd2f1645f7edcd0944b438e3d01a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767840, "uuid": "4f607119-2832-4b14-b8ce-97783cbf9a88", "comment": "Malware payload", "value": "290ef20b05b54a5183190f8bd1ff7a1046099d5bac8677ccc011d1bfc03a5fc41b5e3764eccbf18ed6e4277dc8ba6b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767840, "uuid": "b78072c0-6dcd-4ff0-812a-02bfcb51d00c", "value": "T116642A51BF04D652C41D1BF6CAFBA43983B24CA1150199336721BE6F3DBEF82B8295B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767840, "uuid": "9d62bc37-926f-4b2c-9b95-202ee831aa70", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767840, "uuid": "10adf6a8-adaf-4daa-a728-34b0b2153da0", "value": "3072:14lLpkXGED6iNuVIJMyeLZGofkUQmk6gWX8PsjpWDe/hz:epkXGU5KsUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767840, "uuid": "e7f94079-ab7a-4eaf-99b3-dec36c856b0a", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767840, "uuid": "e371ab81-70e9-4099-962a-3b8422bc1b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767840, "uuid": "6e4fd138-38f7-44b5-b559-7789f65c8aef", "value": "e57ce68c59b39ce145bbeec16942a48068fcaa26f6ff7d7a2c16b0d947d17873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0eae9e0-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749276, "uuid": "a6da25bd-af69-4763-b954-798cb3de1562", "comment": "Malware payload (Mirai)", "value": "32e76fdccf42bb28abf826c47002c621", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749276, "uuid": "ba0613d2-f099-4cc8-854c-db88457194ec", "comment": "Malware payload (Mirai)", "value": "e5b5e0865422c2cddad7203f7f67802dcbafc84ea8397cd4e3ba32607d4c462e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749276, "uuid": "d8e17e9f-5e87-4147-bbeb-541f9e429600", "comment": "Malware payload (Mirai)", "value": "95d987a7fc88a1bb204fba7afa2928f68ed2b440", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749276, "uuid": "9f8fd796-a728-4571-a815-16b89a6e5f74", "comment": "Malware payload (Mirai)", "value": "ad4c122c1afc59f54ea90e31b18473ff3631aa16b77b221ac0eaea40beeda4487121c99dcedc5bd2e99d193ee45eb618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749276, "uuid": "9c7bb968-5c8e-44e7-b468-7df8bc71d861", "value": "T1861319B51609F26CEEE51078F49331E925520F1C37DCE2C3619385A5FEB0B88B956E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749276, "uuid": "fdfe02f3-7722-4ac0-86a6-fb215f18a054", "value": "768:N9GB9P0/AYNBLYYaVkU/UlUSD+frkLITYZlg:LGBOpb4eVqfrug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749276, "uuid": "13f8dbc3-7776-4d2b-8e9f-c4e8174d23d7", "value": 42688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749276, "uuid": "141dfa34-a348-4e8a-aa6c-0aad809b0c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749276, "uuid": "9ec7195c-9448-4456-98a1-e4c7f76fed1d", "value": "32e76fdccf42bb28abf826c47002c621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b33c099-e50b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710754823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754823, "uuid": "3d61b88a-a433-4aa5-9ce3-a1dd9f8f9fc7", "comment": "Malware payload (Gafgyt)", "value": "7b4b3f2b021bc6f86cbb9be78fef5984", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754823, "uuid": "20513bb5-de38-4d18-b832-3654d3637ec9", "comment": "Malware payload (Gafgyt)", "value": "e5c8e1221192c0350d0b10a3e5a20043203bea14fa08430b92dac8b759fde9f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754823, "uuid": "c7d26eb4-a781-4a91-9e88-88491ffd371b", "comment": "Malware payload (Gafgyt)", "value": "88f313e1ed4a3ecf0cd45f15734b861f62cf7678", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710754823, "uuid": "326ff1b7-10a9-45e2-969a-44ad0f6b2a83", "comment": "Malware payload (Gafgyt)", "value": "a44189948ecf94455ecbe57395dced0723241ce6f50009ceb11d03ac796cad61255925019b6eab6e1120b8e05db72546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754823, "uuid": "a897f219-3687-449c-ac58-558cc85ca073", "value": "T1D4D33A1748618EB2C0009DB225A726200757BE774A9F26DAF53D79E0977B8CF612EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754823, "uuid": "6c2e4f6e-a97a-4d2c-a92e-a9d458dfd3e3", "value": "3072:IZmUNdClTo/vXetJ8add9QzhsvvFyzKQ5CGBgBFU:IZRGGvXetJ8addQivFyzKQ5BBgBFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710754823, "uuid": "cb0455b2-0cfb-42c8-a97d-cb468411db7f", "value": 133893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710754823, "uuid": "3d99e745-45b2-4a67-a917-1a5f700033bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710754823, "uuid": "79978772-f87f-42cd-915d-09bb4a86e264", "value": "7b4b3f2b021bc6f86cbb9be78fef5984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a14888-e4f3-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710744620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744620, "uuid": "6f39b80d-c0d1-4711-bec1-e7a5cfcbbd76", "comment": "Malware payload (LummaStealer)", "value": "e78c744ca39dee6d3c80befa1cddbe9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744620, "uuid": "aa497324-7b27-474a-a77b-4b609e020741", "comment": "Malware payload (LummaStealer)", "value": "e5e9aa6a22bcee732d61b8ff82cf9fb023f86da15007a1d5918a3c0abe9ff886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744620, "uuid": "7aaef7b8-6d9a-44ce-a4c8-26d9503923b5", "comment": "Malware payload (LummaStealer)", "value": "0c1f0f62b958f0a8aaadf8747f36179859a76a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710744620, "uuid": "4532a6ba-bd76-4a36-9343-631f3b00f93c", "comment": "Malware payload (LummaStealer)", "value": "f02c2ce21e42339d599273f76a7b30ef93424ea5deaa49f3e36410bacb1648f05bb1b806634c3f02cd27c1fd7b4cabbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744620, "uuid": "8ebe52fd-1fbc-417b-9ac3-c6ef6fed9865", "value": "T1BAA4BEE452BBDE66DBDC03FC6063690196BD4A85DBD3F308684508FA8C16791C523AFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744620, "uuid": "077b5485-3ce8-498c-9664-a652cbdfe99c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744620, "uuid": "c5ef58fb-7e2f-4f44-8736-5b5be46d284e", "value": "6144:sUH6pCqUF6qfhTA+mlxP7go/xCIzm1j216LmCHVsVlGh0WVdUaY:sDCqUYqIz7gqiIgLjYlIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710744620, "uuid": "0652ebfa-2dd0-48c1-bf25-af0860a1f622", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710744620, "uuid": "b8f47c70-eb29-49ed-85c8-ff03a6d355d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710744620, "uuid": "43c3f2e2-2980-448e-90fe-bbaf46f78613", "value": "AxoPac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03271778-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779935, "uuid": "b90ba437-d753-40dd-8be0-eb26f301c746", "comment": "Malware payload", "value": "c92037216614920f006f476b33edd27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779935, "uuid": "7742be9a-83cc-40c1-8920-c73039d023a7", "comment": "Malware payload", "value": "e642d8ef49460249581ca4d8f9a3baac0176963a2430263b6f9040f0cb17b488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779935, "uuid": "781cc88a-f28f-4b52-a2c2-9b593209b665", "comment": "Malware payload", "value": "6d3226769210b78875f4615da2c88dfdc64dcaa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779935, "uuid": "9da765ce-b34b-45e9-a29d-595360f21159", "comment": "Malware payload", "value": "e1e5e0853b0c0ed042633f47744b60a54b06944e2d1e15a557139b18fd9860ba3fa7019a673b92159483f5b03f45c6d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779935, "uuid": "f11e9b00-8946-4472-8911-ab995f9d1179", "value": "T169235B03F6D240B9F4A1AAFC1C35F6EEBB3BBD301D25605957780E8A4D2979108E9397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779935, "uuid": "f295aacb-692b-49c4-9b55-8db24ba89289", "value": "a77b86d8734530129a5948b6235cae2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779935, "uuid": "f1415ad3-3a2b-4400-9c8c-5394ff614a07", "value": "768:QZ8qCbwsKAi/4whkz9mg4IZHbSOaX6Q4XNkjUElKPA6nk4Ptlkt3:Qg248hg4C96qEyJPc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779935, "uuid": "e6f3d8fe-cd0c-4a0c-a01a-9dfa5ceecedb", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779935, "uuid": "464d28c4-5b19-43a5-9eeb-35875b81900a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779935, "uuid": "0b841163-93fd-4dcb-970f-0bd436dda92e", "value": "SecuriteInfo.com.Trojan.SMSSend.3907.9013.1965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beebd1f-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779950, "uuid": "08d27f2a-ff4e-4e24-9e32-ea4534260581", "comment": "Malware payload", "value": "871e91829d93e1f5e71464c349e69e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779950, "uuid": "d18cb90b-175b-49c8-a865-86e1f356718a", "comment": "Malware payload", "value": "e691e80cc044107eb5957ad597dda958611b628ac25cf6b57558187f1542ab84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779950, "uuid": "57694c31-d4af-4a82-9a55-0f4b5352296f", "comment": "Malware payload", "value": "2080eaaa779c0860c3fd4d30b8729fc25b02a87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779950, "uuid": "25214a44-bedd-4cd8-a25e-5e17f480748a", "comment": "Malware payload", "value": "545cf12ef10e3967faf610654eb42e1069d2990844d37af428b76cfe5d27c2cbc514c2e25b331b87be2d3ab9c0d22e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779950, "uuid": "4ee5ae15-cfa5-4d13-9fff-c465c8e05da6", "value": "T17492FA1F6BD548F2E78980711C3D5B7FDA7F654427A9AE839790E9AC047B281D01E20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779950, "uuid": "dbbf54da-33e5-43dc-bb0a-c6571e2a15e5", "value": "a9d5c40b896003c4995539bf70b9333a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779950, "uuid": "18877860-16c3-4b5d-a38a-ca20e8f01c9a", "value": "192:vsoQXD19XFxg/DngtkJF8xfF+jJWysVF/CMgYaUjX5tKomiQ0uV1oyCua:reTFtkJexfE7itK+m1xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779950, "uuid": "bbcc03a6-6fd0-4171-aba3-1f0423d9083e", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779950, "uuid": "a508434f-1fe4-4575-8702-a594aca9f85e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779950, "uuid": "94d3e1fe-77b0-438f-adb1-a75b154f45ac", "value": "SecuriteInfo.com.Trojan.Siggen4.62441.5418.27432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea4035b-e531-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710771016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771016, "uuid": "0e8fc217-f9a4-426f-81e8-07e7b273affa", "comment": "Malware payload (RiseProStealer)", "value": "5fc9bc3ba9d0b1049df7ad8df8e08d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771016, "uuid": "57a89cf5-0b02-4ccc-9565-5cee3932c9e3", "comment": "Malware payload (RiseProStealer)", "value": "e854f0b6e6506ccb5227f07b8122522b766f9833b74bce5127c46561995ab51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771016, "uuid": "76b2761b-16c9-43ed-9709-edc327ca93e2", "comment": "Malware payload (RiseProStealer)", "value": "bbd31e9383e944ca453408d40ed2eb2fd5c87de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771016, "uuid": "5425a725-8dee-45db-9d46-256961cbc355", "comment": "Malware payload (RiseProStealer)", "value": "b85a0ce26d9271e7fd5a4a51f55c8bb5b41d2cc64d61f00523a9bbabfd9b50e17d1741647e9723df9bab32e128c5b19c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771016, "uuid": "ebd4eb25-03de-4e0e-99a5-d2de2585f346", "value": "T14BE54B92B6057ACBD4CB13B8952BCD86999D02F9472108C7A82DB57B7E73CC117F6C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771016, "uuid": "fbe83b12-11be-4523-b268-ee02c3994ebe", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771016, "uuid": "6d0475ca-5f41-4d0a-813e-f26e6ed7c655", "value": "49152:eOBhu0uFXF0zRjz8DFs2DIFPvwkmpndb:hu0uFXF0zRP8DKIIFPvKdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771016, "uuid": "a68c3480-6b17-49dc-afa3-d552b0b1658c", "value": 3152896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771016, "uuid": "5beb2c74-b9bb-4e92-a2d3-008f5d91fbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771016, "uuid": "6d50d013-776b-4360-926a-259980521b40", "value": "5fc9bc3ba9d0b1049df7ad8df8e08d07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9add965-e4f5-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710745533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745533, "uuid": "9f91b26d-47be-4552-8add-9461b3959a74", "comment": "Malware payload (GuLoader)", "value": "62362dc3fc9d67f81dd8bcd670e8c117", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745533, "uuid": "3ec4e1a3-db1a-4021-9a73-3de07ec93ad0", "comment": "Malware payload (GuLoader)", "value": "e9144edc2096347981ed7ea94f6898cfd400918558cb0aba2f4edabbe472cf61", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745533, "uuid": "1dfaca3d-b02c-401a-9462-c64848022758", "comment": "Malware payload (GuLoader)", "value": "c871994bee2042d4cac07220e283166c3f58aa3f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745533, "uuid": "174d0f8b-b469-4550-b67b-704dd2dffbfb", "comment": "Malware payload (GuLoader)", "value": "c15907a7c1908aaf5947eee0298086b870796779d046cf359ffb47bb77fc5656e3c0c3222585487167f8224e3f0b765a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745533, "uuid": "00dee758-9772-4a73-80f0-3f26fb8258d7", "value": "T1CF44E6A3CF0A26190F8A2FC5AC61C95286FB41B531121479EEEDC7DDA183DACD2FC915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745533, "uuid": "dcba22f8-bd1c-424e-ab2c-2c51a303eab7", "value": "6144:NnKtYtINI5Mk6fqMKYJwMHy0J4iwLwhB2UcJXkcY9CdLzHxYRvbFjtkMQhM4O/Jk:VqV3hlvXd4Iob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745533, "uuid": "5ba3210a-2621-4f3b-a7df-e5e018f433b0", "value": 267482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745533, "uuid": "7a429394-0a8d-4815-8fc7-a67978a9450c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745533, "uuid": "ff1f9e97-6933-48ca-8293-40cbe3d90b3c", "value": "BKGCONF-THD1914129-BKGCONF-THD1914129.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595117c3-e500-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710750015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750015, "uuid": "3b6bf767-a2fc-4883-b9c2-0af5c4ee6b79", "comment": "Malware payload (AgentTesla)", "value": "b1147fef848b03cb5f907d6e26902e7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750015, "uuid": "4a992a7d-9cfe-4c30-8829-5d6dfe3dec37", "comment": "Malware payload (AgentTesla)", "value": "e96fe383933b720b64e150a6cf42be3d50dd7cc073ea5719964f1a21f689ca38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750015, "uuid": "28029de1-2b97-4ac5-b036-a0938255ee6e", "comment": "Malware payload (AgentTesla)", "value": "c931c7caaf23ebceba7bae9b77794b08118319e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710750015, "uuid": "f4c80bdc-b71f-46d9-bd5b-1c4c323685e5", "comment": "Malware payload (AgentTesla)", "value": "3019d555d337857e35da21b220091959d74aa74a8f05f79a71852ff7e2da6b15474c25a39b51b2983b0d10688d6213c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750015, "uuid": "dca9448b-9949-4ba4-b9d8-29614ccd7f54", "value": "T1F522AEE6E17EB077ED1E8B38C8F35D3568E3954D45A1EBD2B40880E01EB065C3B2442B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750015, "uuid": "2d6c6df2-7ba4-4ad7-9508-11df6b0ccd3e", "value": "192:rm9Ptmnh8ocE71b3tgsi05lpEZpP9AWbBah3szTQAshINN38k/EEaZjk:i5/ocE71JvlKvbBah3KQkLjiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710750015, "uuid": "643fa395-61fa-4b0f-a9fc-07ea4e31d066", "value": 10440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710750015, "uuid": "98907d12-c669-49e0-999e-278ccf44e919", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710750015, "uuid": "85435088-fc2a-4ef1-b159-6f80a30eb94b", "value": "Factura venta FVR24-05500.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef635896-e4ce-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1710728792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728792, "uuid": "2cfbdd92-e953-4d7f-ae94-1cb91d89e1ea", "comment": "Malware payload (IRATA)", "value": "a5accdaea323327f083cacefe0683caa", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728792, "uuid": "5c6c5cd9-49a2-4096-b1b6-3853689d2ac3", "comment": "Malware payload (IRATA)", "value": "e974bfe5c6bacbe466b3bb8fef673b32fd7dc4a6cfbbe1e8260b5776af1ce145", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728792, "uuid": "a6714142-d62b-49a3-8429-d7ba14d6906f", "comment": "Malware payload (IRATA)", "value": "b5bf43f2ef1751a27cc2f251a7717cceba6daf4a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710728792, "uuid": "c775cf87-36cc-4511-93b9-323e6da68c64", "comment": "Malware payload (IRATA)", "value": "b27f743f7e434501ca4925c337064aeabc15b96603e1bc97ad4e66ac24ff588818c4ec62002604b4868ad654533e0fd1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710728792, "uuid": "8504fd41-1919-4eed-8df1-e6c8af38ceed", "value": "T118D52343F2A6E917C9F7C37721651236107B4D1ACB43EB8A2A0877BD28BB9D84BD15D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710728792, "uuid": "9d2af084-0d14-494f-baeb-faafa63e9ef0", "value": "49152:t/hml99KMTSHh5dA4bwrpXulxFQ9M/UR+kN4FQhYMXlBu59kk:lsZTSHh5FgpXIxdkN4FItu59kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710728792, "uuid": "20b617ad-124d-4e7c-91ac-51002fd94cfe", "value": 2888430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710728792, "uuid": "f074ba9b-5c72-4b19-b42a-c6924cd45d01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710728792, "uuid": "25823570-340d-43a3-a550-aa35d94dd7a9", "value": "KissLands.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bde61c-e511-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710757446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757446, "uuid": "74cb8d82-020a-4c6e-b769-ac0ace48dc2e", "comment": "Malware payload (Mirai)", "value": "b8004b0bb4ddbe0a6dfeb6c55c80e16c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757446, "uuid": "a9b82933-ed92-414c-9485-21edcb9067ad", "comment": "Malware payload (Mirai)", "value": "ea2e9835c06ebae17cb010de4a893620ca3fb4188dc9cf4a2809ea0126fc1a75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757446, "uuid": "262bc1a8-4622-40fd-a7f1-a1d958b479cc", "comment": "Malware payload (Mirai)", "value": "482c8fe45090c1282b0214634d01d6b7e344326b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757446, "uuid": "d6c847ae-53b8-4d29-9d69-9bfcc31c59e2", "comment": "Malware payload (Mirai)", "value": "8327f6f41ba7e0cc5ecc2e04817b4409c8eaa458a5429d1adb9e68b12ce05b45aa81dac55b87ae9b51d54d72a85c96dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757446, "uuid": "b00c53cf-054e-431e-abda-e6129a7dae90", "value": "T15F636C36F634192BC8D9A43E22F74755F2F5478A28E8861F7D720E8EFF2065026536B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757446, "uuid": "4f2acf9c-59d3-4a38-a980-d64a69b00856", "value": "1536:3hjRAwbrdlQK1mqRc+Mjc5n9T5REtXbWwj:RjRhb5cBon9NRFwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757446, "uuid": "6b593d2e-683e-4e68-a402-9702e8a9e4fe", "value": 71032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757446, "uuid": "3fda6da8-c2ec-419b-b432-5ff407c428b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757446, "uuid": "569f4f72-ede2-45b8-ad2e-5fab6690701d", "value": "b8004b0bb4ddbe0a6dfeb6c55c80e16c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d3e044-e4ef-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710742820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742820, "uuid": "93ed3e8f-027a-41d8-8db7-4e0b46140973", "comment": "Malware payload", "value": "a3b617895dd3a013059e96770b1bc963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742820, "uuid": "e0a80f59-e152-4171-a13e-5d9944f9fb9a", "comment": "Malware payload", "value": "eaf5fc64d70fcc022d71d0eddb0e853f895c6426fd5cd469708eaf4edd314205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742820, "uuid": "4205ec81-189f-4c45-91fa-951e4217811e", "comment": "Malware payload", "value": "f74c02ee3a61549eec16cd058a555fb8b671e891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710742820, "uuid": "7fc5ad8d-a211-47a9-a15f-fe26b54ecad3", "comment": "Malware payload", "value": "5f527920fffd9aa1f198137d72f430380476d7fe8bf82d1100388d1045189a7500f858ea0f8b085c910c1920f43fb2b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742820, "uuid": "f8568dcd-9893-457e-9f98-acb07da6252d", "value": "T1C563A3276E5140BCD866923942672F25F3B7F478032087DBAE9678AD0FDA7E45D38780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742820, "uuid": "4ee97258-79ce-4872-835b-2c9f6cc531a8", "value": "b4945172401b6dd8af1d8cfccba0a029", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742820, "uuid": "db021c1b-087c-4b5f-9d63-bd4abdb45444", "value": "1536:O4e8MfLILKCMwAf3mJKxnUnIo4qqocz+QfW:OV8MfLILWwI3mJKxSIo4qqobQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710742820, "uuid": "9917e43e-9f7f-4588-bc77-ea8edc7ca9f9", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710742820, "uuid": "3e462ec7-14b0-49aa-ab0d-178557f8e57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710742820, "uuid": "39abccc3-c561-43d2-bc34-8986b040b29a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.10012.5737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c443175-e4f6-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710745779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745779, "uuid": "c53de467-0409-48dd-b309-a87b777c5962", "comment": "Malware payload (RemcosRAT)", "value": "de81ca904b88240d1bdf3e6ce5211367", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745779, "uuid": "0ab45abe-d940-4d08-823d-a0fb2e984c9b", "comment": "Malware payload (RemcosRAT)", "value": "ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745779, "uuid": "8c5403a7-b212-438d-b6f5-c45e5dd59601", "comment": "Malware payload (RemcosRAT)", "value": "04b96d917496857a4e5cafd042e1594323437a5b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710745779, "uuid": "c6eb6fcf-2232-42f1-b6bf-de68220aefa0", "comment": "Malware payload (RemcosRAT)", "value": "8b436b75593439b39fddfd08e5c83c10088777895d6691990b663f86f8b52367a47a3d8a59200d319116a79f7d5b24c5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745779, "uuid": "65579e0b-eeeb-4d27-9c2c-45d124215ddf", "value": "T1B633B0247398D014C082AE7A4ED8C1E7A7627C16DE46CB0B32C17B0E5875682D67B79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745779, "uuid": "2ec4e078-5e1f-4340-8eac-e53c3111fa8f", "value": "1536:hX682vSrL9JfQsZvYjOEpE0Ff9hZ+U04mjDP:hX682arL9Cd6unv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710745779, "uuid": "072adfd0-7596-4e3e-9af3-a639359a4d6a", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710745779, "uuid": "b411dd6d-4c2a-4228-b7f9-91fb3d56398f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710745779, "uuid": "0179469a-fc91-43a2-b8b3-641d9e280d37", "value": "PURCHASE_ORDER_SPECIFICATIONS.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095a305e-e546-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779946, "uuid": "f28c67bf-50d8-4e66-b76a-5a29390becd6", "comment": "Malware payload", "value": "e2f22464da0a04060a3332181699a0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779946, "uuid": "0d6752b9-96d5-4151-bd06-ed974468e3f9", "comment": "Malware payload", "value": "eda2d0bdf1a89930584563d5d281884112dfdf4c3e28cb3f616ba184dfc6334c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779946, "uuid": "598e5aad-b620-43c1-b594-91728d6c5d56", "comment": "Malware payload", "value": "248c2d6a69868ff001ba113615eb14840671e9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779946, "uuid": "15fd8a8e-728d-4d62-b65b-509e9a731a8d", "comment": "Malware payload", "value": "f0f0e35740b9105238a828ec6401aa16326aa20cc909ce68f8e1a1cdd003d6b61ea7a28f760340a4dba05aca47ca2012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779946, "uuid": "cb820418-a4db-4617-98e0-52a43b3a0515", "value": "T12284B327EEDB9912CBDD47B180928D976261FC4C2B38D94F28A27D882FFD783C464651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779946, "uuid": "55cb6295-d975-413f-ab50-0ee3d897612b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779946, "uuid": "3193d748-259c-44ce-a1bb-064f9eb096ce", "value": "6144:LR3plqBRvDxtMscK2dXWNNIzcO3CMscK2dIee0:L3mhttMslmXCiyMslmIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779946, "uuid": "ca8e1104-992b-4009-a3f0-559c135f064a", "value": 407064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779946, "uuid": "e2b0bc09-3a31-4104-ab67-e40fa2bb242f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779946, "uuid": "31addc84-8dd0-4110-a452-6aed044b9ef2", "value": "SecuriteInfo.com.FileRepPup.23802.22811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e67cdd-e545-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710779618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779618, "uuid": "07155ef3-4579-4d58-9a75-17b5e8095f85", "comment": "Malware payload", "value": "c19b3c9566bd76ee632a0ca16f7b66d2", "object_relation": "md5", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779618, "uuid": "2a6d7c50-8518-44a0-ba17-fd2f3f64129e", "comment": "Malware payload", "value": "ee41eb21f439b1168ae815ca067ee91d84d6947397d71e214edc6868dbf4f272", "object_relation": "sha256", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779618, "uuid": "f621569f-7a83-46ac-81b4-25a038a53d63", "comment": "Malware payload", "value": "0c94c7f4b6fe5974ff852aeb885456fa8a4e3f89", "object_relation": "sha1", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710779618, "uuid": "46ee42a2-3249-4ad5-9d92-9a4606ec5921", "comment": "Malware payload", "value": "bdae3b7ae87438e985e1547e886e622d719ed1d8e49d658a3d5321bbf993ac16770622ea1b325ab154fb9a92822ba018", "object_relation": "sha3-384", "Tag": [ { "name": "EarthKrahang", "colour": "#D678BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XDealer", "colour": "#124A4F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779618, "uuid": "d4b01ca0-626e-47c7-b7af-8c12d6c68ddb", "value": "T11F845E24F6B800B5D067A23ACAB3CA46F2F13A890B3197CF526445AD1F77EE7553DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779618, "uuid": "52d93c15-2155-43d5-82d9-1c7a73397cf5", "value": "938145366590c326ad28ef476d306ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779618, "uuid": "886a51c5-ddec-4fc0-82b4-0f8c5d359fca", "value": "6144:sb/16fb9PK64LeFGK/T4MPMcAEP2Y2dxQTyjTjWh4MUTAp+7SqUusm:l9P96st/qczEYlM7Sqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710779618, "uuid": "6fbbf2fd-07af-4f62-8ce6-31680e4310af", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710779618, "uuid": "4ff18c5d-62cd-4b12-8737-f047bbe4bca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710779618, "uuid": "dd956dd4-07ca-449a-bddb-57c24bc87f43", "value": "twain_64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40a7e7a-e529-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1710767857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767857, "uuid": "3a152086-ea85-4a57-8ae1-f9672a1dec89", "comment": "Malware payload (SnakeKeylogger)", "value": "8edf0c1d21d2c8af7ec391b6d41e7956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767857, "uuid": "5d1e9455-d76a-47d6-bf46-112f83953337", "comment": "Malware payload (SnakeKeylogger)", "value": "ef263c250445fa7bdc89056b3bccad7392d5b51b54bcd605efc949a5bed65a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767857, "uuid": "d1bebafb-21b2-43da-bab4-17aa2a88478f", "comment": "Malware payload (SnakeKeylogger)", "value": "608f1c3c75a4910b6ce7519f58ab3958349b4fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767857, "uuid": "5f614974-2ca3-457f-b0f5-a19aafddf34f", "comment": "Malware payload (SnakeKeylogger)", "value": "153201669584ae014a89f5947a1c173e12061fb201f3327e75662ba3061cd59f602e35457b84d0da3e4f59ba7708a0de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767857, "uuid": "36103a4a-cb5f-494f-9876-0407cba966ef", "value": "T163A4E01627AD8331C95F47B6F861401397F1D1B27A85EFAC6DC4ACD68107B828D41BBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767857, "uuid": "5f17298f-fc05-4ced-97e9-38921435d3de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767857, "uuid": "d5483f84-5834-4bfd-b497-5901b95a24fe", "value": "12288:lKnXO0XBsehmTPtbvlTuy7EBXWaebaC31Xykn1IXPYnc:uRQp1uiEBXWaebaC31ikn1I/Yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767857, "uuid": "b85226d8-8403-4cbb-b07e-db8235a85ee1", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767857, "uuid": "cb8a1580-3d1f-4bb5-9ac6-08dd953ae179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767857, "uuid": "bfec9dca-5832-4727-995f-93fb9b864216", "value": "proforma_Invoice_0009300_74885959969_9876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c920b47-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710765992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765992, "uuid": "90a42666-648f-469a-9906-2fc974b9dcfd", "comment": "Malware payload (Mirai)", "value": "f332bd1819ef4352e44b830be71f7a47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765992, "uuid": "6e8c29ad-1758-418f-95cb-cf8dc6e038c9", "comment": "Malware payload (Mirai)", "value": "ef2cf3e2ce5a59e3f5e0ee258015416cf7592a169280b3ef633fabf7d6f30f23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765992, "uuid": "587d9608-9609-473f-ad80-4931039a1c9d", "comment": "Malware payload (Mirai)", "value": "5bfce661e8718c51e40b0dae661ba1622f135808", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765992, "uuid": "689774b5-877c-4e3e-8a51-c45d963b75a7", "comment": "Malware payload (Mirai)", "value": "9e48e96045c16daea0e02e3cf085194b21cfb30cee0e04f9f445016c71176c50270906b7f54d95b247b8d4c4c70f17ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765992, "uuid": "e6dc4e89-bdf9-4a73-a5d5-258d9cc3c9fc", "value": "T17F63095AF9819F11D5D522BEFE0E018D33536B6CE3EE71129E215B1127CAA2B0F7B442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765992, "uuid": "128c33a0-b483-49b1-b713-2716b4907c51", "value": "1536:wGnZwJ+yclUsk+5sAuj6o3qskYQpu0nmadOZqcllS5ig8b5p//1:PA+flU1+e6o6Y4u0nmadOwP8b5pH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765992, "uuid": "c2496504-3704-4583-a814-7355b02def2c", "value": 71632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765992, "uuid": "6a9d344c-d2df-44b2-a664-77c552592191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765992, "uuid": "fcf88a07-c993-4099-9eee-995a9d12ce19", "value": "f332bd1819ef4352e44b830be71f7a47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031f5b83-e51f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763185, "uuid": "1eb7bb46-e1bf-48eb-a38c-2d068dadb313", "comment": "Malware payload (Gafgyt)", "value": "5536dde5aff7d0c788bdb5276a066348", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763185, "uuid": "dcf0f117-caba-4b45-875c-05e65f6eb7ef", "comment": "Malware payload (Gafgyt)", "value": "efa2147791b4e4cfe9dda1b576db8dc43aca74d28f7206c2481094e74abf9abd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763185, "uuid": "7c434773-e814-4b2e-83f7-307870d65ca9", "comment": "Malware payload (Gafgyt)", "value": "7b5bb17f3394c8ca919289b7125eb059134a095a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763185, "uuid": "53ad8089-c89c-4aba-8475-d19703b39a65", "comment": "Malware payload (Gafgyt)", "value": "9295f1c2dbd4634cf9760f95e75de5100e7f847f7bb3a2e2d614c5269f4f96eb4fd2f02ecd3e249704a57c0c931c3ee1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763185, "uuid": "f6ef4db7-ab4b-4abf-a2c6-4c443ff6990f", "value": "T10C934C81A640C6B3D09F0BB9119B5B112533F6BA6B5B9D67F31C2CF0CA07981725AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763185, "uuid": "2c4001c0-e197-48c5-85fe-d229acd0522c", "value": "1536:bmLDPrFIUNUPXPMmYv0C/Qdk5cc/z4d7J2cNU5mz5hWgFrLGOth2PM37K8PN2Ur9:aLvyUNUPXvYv7QdScc7M7JFD5hWmLGUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763185, "uuid": "5b850a9d-351c-4de8-ad62-a13a3b5e1af0", "value": 95102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763185, "uuid": "9b308e5a-3ea9-4b74-bfcf-0b4846eec169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763185, "uuid": "a718008f-73e0-4fcd-9e57-e423f37316c6", "value": "5536dde5aff7d0c788bdb5276a066348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3241206-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751884, "uuid": "ff32b92f-ca41-416a-a502-c5b635e06522", "comment": "Malware payload (Mirai)", "value": "c2aec2e79b3e1dd79e1e77308d4b80cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751884, "uuid": "d805e46d-568b-42d1-9921-4427bcd56698", "comment": "Malware payload (Mirai)", "value": "f1cd75bfb287dc4e84637509afd817de2a89e8b25a217d9c265277ae1948c70e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751884, "uuid": "b7fed128-17d1-4b16-ad1a-c720fcbc2416", "comment": "Malware payload (Mirai)", "value": "2da5d4b9ffd7c147cc18e2169c3249132e1ad98f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751884, "uuid": "86b4c991-bb17-47d8-a28d-ce5bcdafcaa0", "comment": "Malware payload (Mirai)", "value": "8ec748197a3edb5ed90099db116c8c521f0c4e2f84a44f1b4301027199c3771feacc98c05d2aa47d168dd532d7b8b44f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751884, "uuid": "6a8c2782-9209-4b2d-a552-fad183fac4cb", "value": "T1B563B516BF610FFBECAFCD3749A91B05258C640A21A83B767934D818F64B24F55E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751884, "uuid": "60238d00-6999-4317-88d4-7987a2cdb5e8", "value": "1536:XN1FyOKY49VIg4dJ6no3ILvTc9+B6Zwnz4ag:X/FyOKY49VX4j6o+Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751884, "uuid": "63a5a3b6-808d-48a2-a607-16366d9c8624", "value": 68976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751884, "uuid": "d0083def-e43d-430c-9dd6-2caf65f77b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751884, "uuid": "607c6743-1647-41fa-b466-1abf33b3dc87", "value": "c2aec2e79b3e1dd79e1e77308d4b80cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e213cd3c-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767854, "uuid": "2bef738d-efd9-43d3-806e-c85a27df3450", "comment": "Malware payload", "value": "fc8b93107558429854146361da62e618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767854, "uuid": "fe026b40-8f6f-49dc-93d8-56f8c8685bae", "comment": "Malware payload", "value": "f27ddc5f225f50a392bfcf9cbd59557d445f5ad47f1ad31f1a899aec1ec92611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767854, "uuid": "7f0c4972-fa26-45bf-9cf5-d16443fb2886", "comment": "Malware payload", "value": "e4a2de78806dbc296ac97505f097e077e798ddf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767854, "uuid": "cefb8e0e-baab-4c85-ad79-5fd275276a31", "comment": "Malware payload", "value": "38b82367d3613c283d481019b0b1330b91e90499fe422a89db7a7ccfd00b2b1a7b77be31874265c637a79d50dace04cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767854, "uuid": "ef71c054-ee20-44b9-8fe1-988f869601eb", "value": "T197E4238CE3ADDD13E207473255B2EEF7B07A6A51196E090BA7102F6ABC607C0DC95E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767854, "uuid": "5374ddc1-054a-451e-9ea4-4e8c1e23c4cb", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767854, "uuid": "595134cd-ec1e-4780-b036-0ac968211682", "value": "12288:iq3hN3sqXCPo54Ca4BpOrQhH1CRjU0u3FZWTzge:phFslgmKpOEVCq0cszge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767854, "uuid": "3c2fb709-75f0-4bcb-a8fb-6bee7a6997d6", "value": 676400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767854, "uuid": "6f906461-212a-4da6-9165-ad23328178b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767854, "uuid": "c5d80c84-e972-4bd7-9e56-c2117fdebf34", "value": "PI.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a9fed7-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753874, "uuid": "c9ca0570-ba03-4720-a456-1aef05901c40", "comment": "Malware payload (Gafgyt)", "value": "93afc78a8c5f67b025bf921891709228", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753874, "uuid": "0762222e-a1fc-460e-a4d8-366ea9a60b2c", "comment": "Malware payload (Gafgyt)", "value": "f3a56572ca2ed0efcbbef7588345ba7235b1456f834a0834e13a41d054a6e004", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753874, "uuid": "07331991-8a1d-42ec-bc54-c090bfeb7666", "comment": "Malware payload (Gafgyt)", "value": "b5884da2575fdd68e20310da508e59ae17bb92b6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753874, "uuid": "9f43c233-efed-41a8-b94d-35642bcaec63", "comment": "Malware payload (Gafgyt)", "value": "ce373e5d89308a282d69091ae69e256d13f36ef02b978b31190d2f7deb623ed2168e01319edc47396931dbf1278bb15e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753874, "uuid": "789b5775-2f7c-49bd-88d0-eb3a57ce6a75", "value": "T1C5E32A06F8404767C2D26BB7B35B038D77225FA99BDB334199293DB02FE0B591A3A5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753874, "uuid": "e2d539f9-5b4a-45d5-a7fe-54c975e449ab", "value": "3072:ehRHih54YD1GMw1vZRw75El3WgqetJ8add9QzhssfS3E6ps08QXL4CQSU5WvQdvk:n2w750mgqetJ8addQtfiE67XL4CQSUw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753874, "uuid": "c767b2bb-efc2-4eaf-ab76-58d175be6118", "value": 150832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753874, "uuid": "c12e6e9d-91bc-478a-89a2-5fe99fa0c94e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753874, "uuid": "a2f5dfd2-4a39-4caa-bacb-e2ca9fe6edc9", "value": "[cpu]", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64153621-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710757764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757764, "uuid": "284be778-8d36-40b8-960d-312e05fc277f", "comment": "Malware payload (AgentTesla)", "value": "49297bac3fc834e1173f22d2e445ba9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757764, "uuid": "1465e831-dadf-4820-913b-3452780d3c65", "comment": "Malware payload (AgentTesla)", "value": "f3d403a65c2b5bbd074e6f1f473b2a9facf7074f7244dc09a7f0699c5cd0d8f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757764, "uuid": "86df7db9-9b24-422f-90ea-ff1de06f8567", "comment": "Malware payload (AgentTesla)", "value": "62c76d2f0c3c387effa57c031e9c539670fb496a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757764, "uuid": "759d9997-3cde-4dbc-94c4-7e0d4d24aa4d", "comment": "Malware payload (AgentTesla)", "value": "f1c1bb92a7ae75ab202aaa76f782b398e4c5ed6c104ee405c1e8ced5bbd33557d12491d97b8570e126782e1bbd2e505f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757764, "uuid": "58ed1b53-6395-46e9-b03b-b0f3bdcfb18d", "value": "T1C2D423FF4A7B693BE1B182605470E28E8E4AD779FF687F1A146101D6BD42187EC3D118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757764, "uuid": "5011c73d-f45e-46ff-a951-497b57ea5e9a", "value": "12288:abEoHKR3RZbDNvXpQ3m8P0sdeNeBCdnlTk9QScZSMUdlViPSPrfnEa4qNr1r9e3h:ao9J5cPV7UBlI9CZZOlViPSPrvEr6rJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757764, "uuid": "65e0d773-e063-41ce-8a7e-51910eada1b9", "value": 620987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757764, "uuid": "399a2444-5c2e-468e-bf10-5beedb50bfb5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757764, "uuid": "c645dec3-10c2-47e6-bf89-8730bbbd4347", "value": "Proforma Invoice001&002-pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1fefcb-e529-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710767820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767820, "uuid": "6d437652-e0d0-4c42-ba34-402ac1d57e4a", "comment": "Malware payload", "value": "45b1dc45eec64dd6ef42ff827d4405fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767820, "uuid": "b3611124-6a73-42f6-a34d-61bcc512c5a1", "comment": "Malware payload", "value": "f42496aca487ec4753a8f887f26c0eb5862e6626b4e474614c611d4b28f45909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767820, "uuid": "baf2d00a-e429-426f-91d2-456987c03fb4", "comment": "Malware payload", "value": "f34c8c2fe7c5bc610b4513cd853d97304960d429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710767820, "uuid": "0be52981-23a7-4261-b1ff-1444b039a384", "comment": "Malware payload", "value": "729d55c714a5c7475845d331f61232f596adae2495df707a0369ace017fe980976c61a3e49adbd05a1846e63e11b81b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767820, "uuid": "54ec18f5-08b8-4d27-a0f4-66262493a236", "value": "T115A4188227544C37F2BE06F5548D043593E1DD967AD6AB4AE98CB4A06F7331E00FE26B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767820, "uuid": "d6e017b7-0317-482d-b27d-a0563459985c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767820, "uuid": "708cc360-3745-40b3-b9e7-d267d6994e29", "value": "6144:JAtVdRkURiLBetRu2m10c/XOsnx/Bjr7xii6wgDm7NE/m2O0BBAdN3MVqRw6aPMB:JCVdRkEtY/+a/BLj6wkm7N/0Bi3MBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710767820, "uuid": "b7dccc30-8c2a-470c-aff2-7215aeb47fd1", "value": 493432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710767820, "uuid": "ef09d546-64b3-44b6-bcd8-194ac08012bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710767820, "uuid": "3621e38c-90a0-4999-8538-cc279b55b95a", "value": "6000117092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bb7b8d-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710747035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747035, "uuid": "3f2b1ec6-4d0e-4d94-930a-a7f09ce41df7", "comment": "Malware payload (AgentTesla)", "value": "100f46e4f82109e764d4740de9cf8c81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747035, "uuid": "a2f92f31-1b9a-4cae-8053-e607fd3253da", "comment": "Malware payload (AgentTesla)", "value": "f53110f7faed128650f2a39022367e05761d34759d9677af73d3e1d094571fe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747035, "uuid": "db5dddc1-53b3-471e-b110-82e16ad736ac", "comment": "Malware payload (AgentTesla)", "value": "ab1cdb2ad5b0c969fe5047eee4fe5b504ba31587", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747035, "uuid": "b63a258f-0835-4e25-b09d-c9cebefcf7ed", "comment": "Malware payload (AgentTesla)", "value": "3bf3791d175c9a73ed4035b0090607bc4eed88dbf7851df982edd9be31d9a6e82c3edc7d81ce8fcfb96550af0015f8e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747035, "uuid": "a0266e59-042c-482f-b971-42a258e72e63", "value": "T1FA359E2267919032FFEAD1735B59F202467D6C1CC127A53F12E42E786EB2B73132E616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747035, "uuid": "9c31a7ef-dd98-4e41-a462-0d0c9e3161ea", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747035, "uuid": "02abbdd8-7653-4f9b-a283-6ffd8511ad8d", "value": "24576:vAHnh+eWsN3skA4RV1Hom2KXMmHaN+ftI6A4tJRuz5:Sh+ZkldoPK8YaNitI34t/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747035, "uuid": "0adfbf6d-faf8-424d-ae88-0fe97c8d7eef", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747035, "uuid": "1b9977cf-9922-4391-8943-3264dc79879e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747035, "uuid": "0dd5c35b-354d-4541-85e5-a865c46c1a7a", "value": "509656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06e599d-e532-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710771717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771717, "uuid": "74588fe8-d4b4-4be4-8614-b2d6ea3334d1", "comment": "Malware payload (Gafgyt)", "value": "79ca364fdc44ad7456058bec9d33f39d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771717, "uuid": "7a1c7ffd-3d55-44ad-be66-d292c5812785", "comment": "Malware payload (Gafgyt)", "value": "f5423b4a47c7a158e74fc9819cfd9065fbc0d02b2208c48c41c5f6a2f59e3546", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771717, "uuid": "27525f8d-c51a-4ade-84cc-fb81997bdbe3", "comment": "Malware payload (Gafgyt)", "value": "257455e6d8e93ab46428bda0c79b90969dc13bdd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771717, "uuid": "17c2c217-4159-4486-b131-3a56d332f4c5", "comment": "Malware payload (Gafgyt)", "value": "9dcf937fb5da330cedbd6961e783b3ab0a9ae3fd91142db045a7512503b7d4d252c4647279d29220e62217b680d7ffe1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771717, "uuid": "1710bee4-1f4b-42f6-9169-e2f049e6ece7", "value": "T1EFA36B13B552C77AC08362B82BEB99729423B5FC0B32325773D47EB52F198C95E5AB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771717, "uuid": "07d43360-191d-4332-b5b3-b4777e61a03b", "value": "3072:5xkwP3AqCvPSatfLEq6Nlw0aCim1GuOVyDlOzQ:s678PSUw4TCim1GuOVyDlOzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771717, "uuid": "3716d8ad-aaf5-48a5-880b-df69da4108cf", "value": 101548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771717, "uuid": "45baf23d-7410-4a89-b98d-fa6fca99e004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771717, "uuid": "2437210a-0844-4e24-94a6-e3985e38fa11", "value": "79ca364fdc44ad7456058bec9d33f39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce168aba-e4e9-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710740333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740333, "uuid": "1dd8b0dd-39c0-4074-92d8-07e08bf1666f", "comment": "Malware payload (RedLineStealer)", "value": "3b069f3dd741e4360f26cb27cb10320a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740333, "uuid": "e4b4a31a-8b8c-4639-bb24-6814bb93af8d", "comment": "Malware payload (RedLineStealer)", "value": "f63bdc068c453e7e22740681a0c280d02745807b1695ce86e5067069beca533e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740333, "uuid": "15b2b85a-4980-4bf3-b299-51421634f9f4", "comment": "Malware payload (RedLineStealer)", "value": "6a9503aaf1e297f2696482ddf1bd4605a8710101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710740333, "uuid": "b885c043-337b-4111-9418-24d7c197bc7b", "comment": "Malware payload (RedLineStealer)", "value": "97e2198190dd67b39d218a884689325cbcfa4aa3a29251d9a61603bb1e222618d27480d27e4f442ac9c7fbcee218ac49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740333, "uuid": "348dd058-f918-415c-ab2d-efac4f2a41ed", "value": "T18EC48E81B709BD62D67B03FA948518601F71EDB9E806D316ADDB7FBE3E32361420251B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740333, "uuid": "bae8f8c2-2ee2-4e68-9656-7890afa2052e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740333, "uuid": "3c7b37fd-1eba-438f-8ed0-d56e78974196", "value": "12288:q5aw1dGYJeEVZjYGcN3CNIb88WsNMP5F1k:qLVRYGW3CNIb88WsNMhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710740333, "uuid": "d87c4c4c-f6ab-44d7-b346-7e75829da259", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710740333, "uuid": "67329c76-74e5-4eed-8ec7-e0d9fd5abd31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710740333, "uuid": "2f444bbf-c381-4e89-8e11-682ca2efac63", "value": "3b069f3dd741e4360f26cb27cb10320a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d68d5f-e506-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710752720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752720, "uuid": "edf69324-0158-457f-826b-c7871f99ecdc", "comment": "Malware payload", "value": "f970b5ac04385ace3cc09e434e5e66c9", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752720, "uuid": "a265d294-b950-44f4-bf7c-0067add8f01a", "comment": "Malware payload", "value": "f69867080a0259c1d454fb4dbeb830718634b15afe7da9e4939ce5aef6ceee05", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752720, "uuid": "960e7d17-7feb-4f99-8cb8-950f71976189", "comment": "Malware payload", "value": "4d0f0b6c4da6967f1ce28a4bb80870d91bd70cd9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710752720, "uuid": "03a7b628-8a1f-4dfd-8b78-8c56ab739354", "comment": "Malware payload", "value": "fc09e557bf4618e71a4427e46ff0d128461783729b29261730f8274c63f3678d0929c82ebb724b244d4948bf1b32846e", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752720, "uuid": "b56a2e04-6f72-4628-a704-6d1e595d4530", "value": "T1B023F13AE3292940C8F4987C126D17937986119C8743FA677AC9790D5246EFA33AFD8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752720, "uuid": "ffccf2eb-0389-47dc-9a4e-0085db3ab0b4", "value": "768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/L:tLq94YV7JMxXyd4x+gzexTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710752720, "uuid": "38015835-3069-4ff8-9f14-e50fe173ea01", "value": 49376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710752720, "uuid": "7cf65a67-3686-4c3a-a2e5-2c476252f8a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710752720, "uuid": "e51357c4-f12e-4615-aca7-5bcaa93903bd", "value": "ACH-3136-15March.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45db17d-e530-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710770864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770864, "uuid": "a2c36402-d689-4339-a29c-43193c4913ae", "comment": "Malware payload (RiseProStealer)", "value": "729096ce3678c83392b927f9101fa5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770864, "uuid": "ce03428f-ecde-46f8-a18e-5509cb58e274", "comment": "Malware payload (RiseProStealer)", "value": "f6dddbe18895719a899361ec8b464d9277c8cbe0d4aa44427fe76a617f8a3e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770864, "uuid": "9a2b7859-3c39-4c82-9b91-3a5c5884dcf2", "comment": "Malware payload (RiseProStealer)", "value": "d18c59adec48ea7eae2083c68a9cfbc96f4e20ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710770864, "uuid": "77ae6c49-9b63-4508-94da-ded1b1df66d2", "comment": "Malware payload (RiseProStealer)", "value": "7abfd9d39b3da41fa3ce9c46515ed769900c79fcde061d78e0d7d130c095530773d768c0c4743dc43f4004ced2949a05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770864, "uuid": "eab79cf2-e72a-4bf2-8efa-26dcecdd673c", "value": "T10876239139C39ED4CE4C0430466AEC7D2621BCFA48954E9777F93F4A9DFA2B0B53250A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770864, "uuid": "f65363d3-a403-4cf5-b752-d12f559c3ae6", "value": "ba4ce0cbe832b3560bbc7a0c6d1fe182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770864, "uuid": "11b6fd02-18f2-40d4-b2c8-3cc3bf7c517b", "value": "196608:LFhNnZgNOBKJeg57J5DUx6yKZ9PATjabwBitIMGV7E:LDvgmWeCzxyKPPACbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710770864, "uuid": "cb1e5867-cf96-474b-8827-6532e49973f7", "value": 7166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710770864, "uuid": "fbd96ca8-da6c-494a-9dae-f8afbf69d89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710770864, "uuid": "766cf725-590c-4c08-9001-6356022c1a45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8512f4e-e4fd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710748886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748886, "uuid": "b4a78125-3d41-4223-8bbd-ce92b4f88cf1", "comment": "Malware payload (Mirai)", "value": "1f2c612e914ec564696f57c803beab0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748886, "uuid": "4379b761-eb1d-4d4d-aa8f-246f1d82b774", "comment": "Malware payload (Mirai)", "value": "f6f98e380b7a9f70051fcb4d250cc724e2aaecd703c1098c98cd00d750d0af23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748886, "uuid": "1f88463a-978c-47ab-b65f-4267c6504d1d", "comment": "Malware payload (Mirai)", "value": "704d222703732baae66de3834fc349e7d0ac4271", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710748886, "uuid": "fda2790e-89e0-4d09-9f7b-8e38d7ace9f0", "comment": "Malware payload (Mirai)", "value": "ef5d0d0a7d9dbe21ef9fa786cd378414d4e3658ea320007ec8b5536a52990a5b8ee9402cba5065391b0bd092bd40233a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748886, "uuid": "e66afdfc-df35-4039-ab23-cab0135d0100", "value": "T199633A96F801EDBDF80BE77A4413050ABA71A39102830F366797FD53BC762A55A63E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748886, "uuid": "2fad10ab-3fbf-423c-b815-37470e214a04", "value": "1536:RQJA4fwOj4N9f1z8h3BJsLWgWLrLc9LaWk1/:RQJNYf1iLsqgYFb1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710748886, "uuid": "c61be4d1-1ca5-4563-b55e-4d8bf4a4bc85", "value": 68912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710748886, "uuid": "4a295092-2255-46a7-b419-c5b15486b9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710748886, "uuid": "ba705027-af98-4b66-8a5c-371898d80dfe", "value": "1f2c612e914ec564696f57c803beab0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bb0cbb-e4c7-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1710725575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725575, "uuid": "bcf19829-4e90-4298-bec5-0d53a0e7871b", "comment": "Malware payload (IRATA)", "value": "207b35953d60b5e637761a1daecb4081", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725575, "uuid": "bf93952d-9bef-43ed-9a38-dad62bc66c2f", "comment": "Malware payload (IRATA)", "value": "f797821068cf7951ac6177183fb3fd9db19a4b75efff1a915c7b67ed0a0e80ec", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725575, "uuid": "fd8640a8-02a0-4b30-9235-f5de12e43f94", "comment": "Malware payload (IRATA)", "value": "897bd5c21120212be00eb4a042954b0dc8e664bb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710725575, "uuid": "c83c0166-65ef-4fc0-bc6a-d259244347d9", "comment": "Malware payload (IRATA)", "value": "1802ce7dd4ed59e59b5086a075c14d44d1244c877b4d7cd55a673326470b205d929a5f529fcdf873b60ef1e8e494fbad", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725575, "uuid": "72a30721-16aa-43e7-94e1-893ce74e3e1b", "value": "T164951243F762992BC8F2C3332075563690774D29CB53AB8A2A1977F938BB9DC4B815C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725575, "uuid": "c1e59049-d00d-4669-83e4-5fe08cbebf4a", "value": "49152:v/80ZbtD3B4ufyGpQMsXTDd4Xxv6c1k1tw9cb8mLV:nDtDx4iyhMsF+xv6cC1tw9a8mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710725575, "uuid": "5cbc0cd3-41a8-42d5-b053-d7f775f80e85", "value": 2020078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710725575, "uuid": "c7bf5433-9035-41d4-9217-a5632cb8f8fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710725575, "uuid": "85c0ee4b-58df-4e4c-be73-bccc9e972427", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e49c5cf-e522-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710764519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764519, "uuid": "828a5079-2c34-4b60-bb30-076f8e1c2873", "comment": "Malware payload (AgentTesla)", "value": "de5186a50d8dbc05c58d236ae7921aba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764519, "uuid": "0d8a629c-6ba5-4add-9ea1-80cfe64f141b", "comment": "Malware payload (AgentTesla)", "value": "f7e3d289131a067c332064bd6f6cb7d336f0fb0476af14eea1d1b1a7127493a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764519, "uuid": "fd269978-ba07-401d-84ac-452447ff876f", "comment": "Malware payload (AgentTesla)", "value": "89d83bd5870a263a8ca448c2b7cc46303ad05b60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710764519, "uuid": "099c9109-3c88-4589-85cc-a3c0ccd5ae83", "comment": "Malware payload (AgentTesla)", "value": "b5cab5c7affd0125e5f76fe84a913069f44b5d6bb873b36df66118b671984a18a7e228578f02ea131b022023a0a7ac36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764519, "uuid": "cd68296d-54c8-49e2-9d81-97ddb89c2863", "value": "T10EC42349B74CC13BC77623BF5EB386901BF3CB308996D74665C2B1C98558BA4C8AC60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764519, "uuid": "e09e6845-cf61-4085-8ff2-7f3df6984227", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764519, "uuid": "adb92697-dce9-422c-95b1-3335aab89cdd", "value": "12288:0gRhUm0mx5qwuB6W58Oc7vFwUWM4nBvAOneTADP:D3X5qZzG1dwDbnBvAUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710764519, "uuid": "9107680d-2d93-4e8e-a8c4-42edc8190c3b", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710764519, "uuid": "d262d48f-fdb6-4558-aa4d-1027dfc9eaec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710764519, "uuid": "41578214-9530-4109-942f-9622f8032b82", "value": "260224-027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a283af-e509-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710753868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753868, "uuid": "2bf8a62f-de3b-4f8e-881d-ab34f97dbe1a", "comment": "Malware payload (Gafgyt)", "value": "bfd9a98525f714cd2ad744ccbe6b8f65", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753868, "uuid": "c1dc07bd-3995-4667-8d6e-19582eb0ac22", "comment": "Malware payload (Gafgyt)", "value": "f81f1845c2231c275a33c0460fe28456b9d1cfbfa7b52dfc87bb00959a5a1b5e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753868, "uuid": "e8d820ff-d4d3-46f6-b43f-eaad0291372d", "comment": "Malware payload (Gafgyt)", "value": "b7316d1cb39093406087b980f5835471a4ce5a0e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710753868, "uuid": "15125afc-cfea-465f-a848-a73f0b2b56e9", "comment": "Malware payload (Gafgyt)", "value": "e35d3ee962fb2fb007e85e21745c31c3ababffb9bec6fb1487b1c4302082d1b3aeb4ed2b8f7502e973080f0647f9a6c0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753868, "uuid": "57672211-9284-430b-b9ef-fb8d049be5fb", "value": "T1EAE36C2B75C18CF6C00286B126DB63549523FE7F0AB62147B7947DA0BF398C94E69BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753868, "uuid": "4f24078a-514e-478e-9e09-4881d23f9d39", "value": "3072:L1grBvfROBNGYAXXpETbZcutJ8adPF4KQTjs3/CijebvfcivGmS+Qk:eOLSX5YmutJ8adPF4f4Rebvfci+mS+Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710753868, "uuid": "ec7d3533-f624-4072-89b7-62a44e734576", "value": 143460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710753868, "uuid": "4b724d60-30c2-4fd6-a1fe-6258d1383a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710753868, "uuid": "0e8cd29d-d38d-488b-b52f-25d418eadff7", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb8d5db-e520-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710763636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763636, "uuid": "89e243d8-c9a7-4608-94ad-460565f3a0da", "comment": "Malware payload (Gafgyt)", "value": "f411dc69ce0c9b340491710426917aa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763636, "uuid": "960b0180-701d-41c8-a5c8-a8a29345c452", "comment": "Malware payload (Gafgyt)", "value": "f8727c639da2a98d27251a36b85ade5b17935082819848c5a90a0f04374803fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763636, "uuid": "a35eccd7-384a-4e1f-b7b0-774a1e7cf12b", "comment": "Malware payload (Gafgyt)", "value": "42c2f5eae12a7e57b3cc8e4dd7c6da9affd61133", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710763636, "uuid": "fb3cd980-4a0a-42dd-9394-3615a95346d0", "comment": "Malware payload (Gafgyt)", "value": "76e44d9d26bae57e6a2626f895a708bb305a025583dac400adbf29c9b81afe9b4eb05f96b9748f3f0823d72f6a4a2656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763636, "uuid": "958e5623-9f1a-4688-97f6-6a2ef0ff7661", "value": "T1DCE3745677508FB7C81ECE3216A94702208DD59E22E92F6B73F4C61CBB8A55E09E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763636, "uuid": "3ff218f1-7df4-447b-a7d8-e8d463a756a3", "value": "1536:6nCdD6AAR1reTVstCVl9A4MxZs3lf4APKnQZTeKVdo5h6fWA63rMsBRTFAHj4jM:6nUat4SfAmsTO5h6fa3rMsBRTFCj4jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710763636, "uuid": "29617ef9-5980-415e-af41-291dcbe2fc0e", "value": 153077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710763636, "uuid": "8d757805-1d28-4485-b027-b71044c4955a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710763636, "uuid": "1519b5d5-3682-4322-b50e-6240ea767158", "value": "f411dc69ce0c9b340491710426917aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617fdfa0-e525-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710765920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765920, "uuid": "8054edb4-bf1d-4d98-b9a2-2e52224bbeb0", "comment": "Malware payload (QuasarRAT)", "value": "130640fbdce6bb6006df6e0d007d4feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765920, "uuid": "91f07c22-6329-4744-8105-51d5f3a68f7a", "comment": "Malware payload (QuasarRAT)", "value": "f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765920, "uuid": "e4cacb42-3f3e-4e41-b2f4-f664cc34cd1a", "comment": "Malware payload (QuasarRAT)", "value": "876ec1f095e2dbe0847f12ca30179abc1b4becf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710765920, "uuid": "48e7aa33-f7e9-4272-8768-05e3865e1df1", "comment": "Malware payload (QuasarRAT)", "value": "5ecfa3e31776f5fa45ed2d9e368717620b780591e4cf51d9f19876cbcf5b697ac35bf8a8503e081849781bd2514a43a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765920, "uuid": "b75fbcf6-8ea2-4d0d-b1e6-0eef367e00a8", "value": "T11CE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765920, "uuid": "1d32b944-9a73-40e8-ae3e-c659786abbc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765920, "uuid": "7fefcf00-75e0-4797-8e03-0af191e2782b", "value": "49152:CvDI22SsaNYfdPBldt698dBcjHUkRJ6ebR3LoGdX4THHB72eh2NT:Cv822SsaNYfdPBldt6+dBcjHUkRJ6YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710765920, "uuid": "ac4bcbcc-1fd1-4cd8-993e-ef3852ab111c", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710765920, "uuid": "4e5eb4e2-71cc-4499-b2c1-a251b8891bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710765920, "uuid": "cd03d826-8543-48ac-bc7a-25ee634ad1ef", "value": "130640fbdce6bb6006df6e0d007d4feb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67343feb-e4f9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710747032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747032, "uuid": "c280e0a7-7dd1-4d9f-ae38-588fb18767e2", "comment": "Malware payload (AgentTesla)", "value": "6ba2e01221b8cffe253ae166553ad9e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747032, "uuid": "592f51d4-9569-417d-8983-b1584f7a1db5", "comment": "Malware payload (AgentTesla)", "value": "fac8f188956422e16f6e841012015856bd2990e13d4b4b73ef10f4c9eb498ed1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747032, "uuid": "21dde977-c58d-4bc9-bb37-f162661851f0", "comment": "Malware payload (AgentTesla)", "value": "13c2a0152578d7adc0ff71ca1424112c1250e803", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710747032, "uuid": "3e1f36b8-6743-4701-b82a-426f1b2a4057", "comment": "Malware payload (AgentTesla)", "value": "18cd7a6ce30cf79eb8d9b21937732fd07e94f2c0df6101b3b64b6747676a156dd40af9ddafd49602bb4b22741e66a866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747032, "uuid": "4f2ca892-080f-4842-a664-85014d8d183a", "value": "T141C423EC623CBEDA98A41C00D2B43DD80D9EF77C683750FA3C62E691512D797B931269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747032, "uuid": "70dc74fe-73bd-46de-90d4-63af710d33df", "value": "12288:sNVQAJiSDs6plTUvez6cINmZ8NtcLRVR7g40JLhPTvW8:qqd16/YvezrXZ8NuLn+4kpe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710747032, "uuid": "0dbd678a-5428-435b-8991-a111c2a79229", "value": 548265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710747032, "uuid": "8aa77049-97b2-4574-805e-c1c562b5fcec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710747032, "uuid": "c91fe998-b907-42e7-bd6b-ab675448e335", "value": "509656_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0319d5-e4fe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710749293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749293, "uuid": "1add5056-ecbe-469e-8673-88d66b68284d", "comment": "Malware payload (Mirai)", "value": "8ede8b5e5ada9437ceca58dba212ca9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749293, "uuid": "e7fc93bb-dcd5-4c63-ab12-20a561c471a1", "comment": "Malware payload (Mirai)", "value": "fad3d46b7dbece2892ceeb8c6d58ba5b9b2f0827edf11a751c06e3b4fd1714a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749293, "uuid": "6f0339ed-a1e0-4b7b-852a-c288adcc9a22", "comment": "Malware payload (Mirai)", "value": "8598bcd10e03b9ccdc0a6f24d84be8c6821f8314", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710749293, "uuid": "9d26e661-a837-4cc6-8f5c-837e9fd326a5", "comment": "Malware payload (Mirai)", "value": "d40d200ba5ce3dd0108216e6869cef09f34097922e9082a6d03805409d8ba909d6981df061a56e833130a8d6681acfc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749293, "uuid": "13fc62b0-5b85-4b62-85a7-1e0c9fa01cc5", "value": "T15D335C22BA791E17C0E0A47A22F74725B2F6575F25B8C61E7D710E8EFF14A406A036F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749293, "uuid": "31f8cd1a-6613-4e7d-9b67-dbdef7a7e8c4", "value": "768:vPoyWMq9pOZEI7e1b5tLvzLZ53nxxJGf1wa+O+YH6j5a8rwsS:vPtSkZEI7e1b5tnltxxJtaMYgD0sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710749293, "uuid": "c53af175-c839-4da1-978f-231be42751f1", "value": 52008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710749293, "uuid": "7acda602-478f-4914-8a39-9a81763c54c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710749293, "uuid": "47cc74a1-3b00-4ff0-8b70-29374b9b81fb", "value": "8ede8b5e5ada9437ceca58dba212ca9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de580375-e57b-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1710803066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803066, "uuid": "ca74a186-2508-4d9d-8b50-8f0efdc7a1bc", "comment": "Malware payload (CoinMiner)", "value": "3d233051324a244029b80824692b2ad4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803066, "uuid": "d0557b18-e9a2-43d1-b66d-ae677216d165", "comment": "Malware payload (CoinMiner)", "value": "fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803066, "uuid": "30787de4-6ad8-4082-902d-892e33f00f57", "comment": "Malware payload (CoinMiner)", "value": "a053ebdacbd5db447c35df6c4c1686920593ef96", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710803066, "uuid": "0d451f1b-66b0-4c61-8a6e-2a53f8529a32", "comment": "Malware payload (CoinMiner)", "value": "c5004203fc92d7f6a70471d2387bf566105149fba99991d2f9e01d8c9397104366601921512350466cbeaee950c810c7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803066, "uuid": "a96424e2-4203-4076-9713-0c2b695e8dc7", "value": "T18CC5338275A23779E09040789419EFB1A9F3B4D7EB7218DF2FE60D6138719C5C8B6A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803066, "uuid": "3e47a232-8d36-46b5-b2b6-073bde1125fa", "value": "4b3ee95f35e7f4c0001cc18c48681f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803066, "uuid": "c88eaad8-2659-48d8-958a-2489cfcfdd09", "value": "49152:IqS9PgtJ02+VbOhPN2qI/8fsSxL7H2tAODP2hXNkOT3m:N0PCq2sbOJN2L0fdL7HFOIXNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710803066, "uuid": "c5f5daa9-2460-4508-977e-20e902cd7c84", "value": 2694656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710803066, "uuid": "089777a1-a42f-46e4-8e1c-e7e41d006b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710803066, "uuid": "b5e5b42a-03d8-4139-9f5a-73a2208c71f6", "value": "3d233051324a244029b80824692b2ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420ef6f2-e531-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710771021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771021, "uuid": "ac6b5a22-c594-4e5a-bd9e-91b01514b393", "comment": "Malware payload (Stop)", "value": "d938eea3995975254eb0d6fd7a86eab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771021, "uuid": "fd2a6f26-fa06-4a4a-8c7d-2c8ba830801d", "comment": "Malware payload (Stop)", "value": "fc38866bc8b8cab27e524e8592c185d3876460b3f3cda7fe445276c0f4dfe336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771021, "uuid": "bc8541c8-1ecf-4444-9db3-efec53d773d8", "comment": "Malware payload (Stop)", "value": "f78c7d18f72efff57491926d5748706566827eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710771021, "uuid": "1f537db5-85d4-4ebb-9865-998b57a72c24", "comment": "Malware payload (Stop)", "value": "cda21bfd3e3987e58190a217ddf15dd72203e6d6f6d9a2880b84ea837a8f6a013b41afbd0082c4509cf36ba72c3cd222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771021, "uuid": "381b8b99-c842-4ee0-9f34-cd6ab14964df", "value": "T16905F08325E1EC75E95603314E2D99DC372FBC62AE21479733742E0E68B12A0DEB7761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771021, "uuid": "14b84f41-0737-426d-86d6-a420d760e514", "value": "57736d727b019d98ef28404f91500352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771021, "uuid": "006b1c8e-5f96-4a68-b02a-287f3b262bff", "value": "12288:pygE4bTnwRtA+aLzzRFVuRWRUgOTtaEoKWneqxoJ/tbJpg3puHfsfk2+uDuzt:0xRtA+giPgOpaEoPxyRJpgZ0EQuDuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710771021, "uuid": "51b0c3e0-b4b2-4b58-b90c-b27a99bb0625", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710771021, "uuid": "4bd304e4-9caf-4a81-82e4-e1347ab8051e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710771021, "uuid": "28ae603e-0a92-45c2-b117-63f48fc3a6c9", "value": "d938eea3995975254eb0d6fd7a86eab2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80890a56-e503-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710751369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751369, "uuid": "e870dc48-73ff-427f-b916-3c2f18d65be8", "comment": "Malware payload", "value": "f658f8a0bd92004861b2ad7256447d4b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751369, "uuid": "5496aad7-a361-4b1c-a2a4-29c1230a7386", "comment": "Malware payload", "value": "fca98df1a94a064ee7ef2270a3bca1c74d819dc2d45c3db6438b3acf9c9dfba6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751369, "uuid": "7c31f8c1-fbfd-4ec5-bbf9-ec6eb11b67b9", "comment": "Malware payload", "value": "dedb74751ced7f5191dcbbac85728659e4ad58f0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751369, "uuid": "78dc586b-8237-4924-b928-3d40af0a7772", "comment": "Malware payload", "value": "8673d4459f5d1e3121ad24c5a4413a5e348e23630ddf8ec19e92df83c320ab5878bbcf1277f40b5c583f8fa03f552ada", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751369, "uuid": "332c3c34-e5d7-4d7e-9319-b0942b3c01a1", "value": "T1B8D2E0A42C6B61A48B6E437D3EFEA5C0E62CF467588430D79931930115BBC94EEC7B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751369, "uuid": "dc758a68-e4d0-42dd-8bf9-10b5a2949815", "value": "768:OzpzLEEgI76fR14tmzdsEd2v3ICDTuK1yVesecAdk:sBHOfR140Y4CDT9SRecz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751369, "uuid": "556aeaa1-f2b8-4517-9c2c-fd86c45f09d6", "value": 28671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751369, "uuid": "dbd7acdb-5b14-4690-8ae6-9818be67c78d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751369, "uuid": "5da08439-c9aa-4d97-86f7-5e63210b0e9c", "value": "sharpobf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de51102a-e504-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710751956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751956, "uuid": "a803cd0b-a603-4143-8f2c-cf474607c3b7", "comment": "Malware payload (Mirai)", "value": "8374ff8662d10663f9f7a69b1ef10dcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751956, "uuid": "1e45c8fb-e674-4099-8b0a-259d88540863", "comment": "Malware payload (Mirai)", "value": "fcc5971da609fe142c76ce6d8ea46a87b7aa6894979d25111fb1bad5b657365c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751956, "uuid": "a938050f-dba8-414f-bd85-bd2737b7b7f7", "comment": "Malware payload (Mirai)", "value": "92aae71f4991c756adf0fd6a07ca8f29fcbbe4f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710751956, "uuid": "9f5c6b56-ff8e-4b27-881e-600b9144f466", "comment": "Malware payload (Mirai)", "value": "f70b47011594b7b3e0ebfd7c8b42b4bbebe32003be836be55fdc47c9814b4c52fb622b6b6ac2f012d89d34acdc40ac48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751956, "uuid": "d002a5bd-3fb2-484c-9f5d-1901adf708c1", "value": "T152338D36C87F6DA8C5448638B82249342F63F50885A7AEFA9BC187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751956, "uuid": "0da7c601-92c6-44ae-92c4-18ebdad8ff31", "value": "1536:0ndIcnkW5wtdl4ZhTZJNexd+3+4keEtCQfd42+:0nFnkW5IEreO+4ke0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710751956, "uuid": "49493712-8d71-4643-a732-a88ae1f56bd8", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710751956, "uuid": "0e5d46ea-4b24-4a71-b454-44755faef678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710751956, "uuid": "05a77efd-72ba-4b9e-a40d-bd21465d0484", "value": "8374ff8662d10663f9f7a69b1ef10dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f99e57-e512-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710757791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757791, "uuid": "fc9e397f-7d75-4c05-bcf9-8651bf3d5dc2", "comment": "Malware payload (AgentTesla)", "value": "3058f549ff98122843329831d38df21d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757791, "uuid": "49d36ffd-717e-4780-a151-ad6cb388ed87", "comment": "Malware payload (AgentTesla)", "value": "fce5a540b2d85de37fc842f385b45d9b2420f0c70aea6222e3ae2b570327c2eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757791, "uuid": "3b4e45ab-2fa2-4f6e-9b42-48aa581b5f4a", "comment": "Malware payload (AgentTesla)", "value": "346044fed089b0a5d36c2ec8208cbcc67cb87fb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710757791, "uuid": "6dc3f255-7075-45d6-a2be-5bcd8e74ef51", "comment": "Malware payload (AgentTesla)", "value": "a768e6d0114e5fba64d7f5ab5a88afc131972389e221b77f57985fd6a8682e63c155e709e72240bfc397b0a707e3326d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757791, "uuid": "9bbb4e10-d85c-4994-b583-071609d7c04a", "value": "T142D4232D2C068F409DC5F25DF960F13A5E86D084C712B86B6A0486FF87B56D4EE9EC4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757791, "uuid": "60cc37c7-ae12-4016-aebb-fcdd2470c68c", "value": "12288:eGG10dbJQ5r3tXWoY816Co2mOXDnrBUPB9U1ciiiSWDequi:erq+htXd3MC3m+j4B61ciSWki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710757791, "uuid": "d205a197-f493-429f-9506-28212f37e2e0", "value": 616203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710757791, "uuid": "a099140a-4ffa-4803-a2da-221ccc18122f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710757791, "uuid": "434358fa-105f-4a45-a3ac-a0357bd4e524", "value": "TUBITAK SAGE TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce39187-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710769563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769563, "uuid": "63557348-f917-4966-8bc5-e76ee6391ee6", "comment": "Malware payload (AsyncRAT)", "value": "92c9604ff2e207dfbc0e742acbefe6d1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769563, "uuid": "2541e585-6594-4bd8-bf2b-f9ae4b6ebd23", "comment": "Malware payload (AsyncRAT)", "value": "fd70b499b3f61717a04333c9fd4f7f244252854b6deb0ebd627ba2934b53d00b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769563, "uuid": "8e8f7a03-44eb-4234-8047-bd71beb4e6a0", "comment": "Malware payload (AsyncRAT)", "value": "b68193bbe1adf1931b529d57d20fcd01712663ee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769563, "uuid": "ce0915e7-00b6-4e4f-b850-acd82e50e132", "comment": "Malware payload (AsyncRAT)", "value": "afb4e2108dd7cdec8eb548632bec80ee3d30473f4313aad7b9216a368ec3361cb6c28f009e154c7a0cd1606c6a9900a6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769563, "uuid": "41dda302-f8dc-4f33-a909-570360f3d41d", "value": "T1849423097288C6AADC1C56790EECC412273599DC0E5AFB7C67433F8ADE12BC1E656F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769563, "uuid": "a8f2aaa5-887c-4928-a54b-06ac7cc9ed03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769563, "uuid": "78271e1f-2050-4a98-ae39-84982d14a42d", "value": "12288:FhjGPbb95UVH8Jy3uD5AKhqLDPOgRP9WzkgRh:XGPbgVu/GPOouz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769563, "uuid": "97af0004-8d9f-4ebc-8c41-4201efeaeddc", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769563, "uuid": "20246c46-5e98-47c5-a346-4d7ce53373c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769563, "uuid": "9ad7cba7-4273-465f-9a6c-2bc17b7ef3b4", "value": "Invoice-AWB-Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296f3b56-e52d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710769262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769262, "uuid": "fa292529-faf4-4820-9c76-fb3ee0452025", "comment": "Malware payload", "value": "8057cda45d9cee1d9fc11ece480f12c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769262, "uuid": "18021e18-1ed4-43fa-b765-fcbe0358c91f", "comment": "Malware payload", "value": "fe1d86987f6692e3ed55d15a115ef0956b9f183b6f790c1887602ba8a6f39fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769262, "uuid": "432a16d6-5f37-458b-83a8-990aaad7d24a", "comment": "Malware payload", "value": "a24b4b5370b0737dbc612c70e6afefbd01a4faaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710769262, "uuid": "f2cc0e22-f25f-4caf-a882-788b09a46558", "comment": "Malware payload", "value": "53fc3e18d7f9a475cce8afc2b0651fb439989f99f52ffe925117204bcc041503dc0b3e1d41ee187a8017c0861eaaefef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769262, "uuid": "8e2fa95d-5495-4f3d-b888-4a7739cad8f5", "value": "T1DE159FB9A5841572C4120E34DE16E7AD641C78F17F2820EF2FF80F5CB665EABF885852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769262, "uuid": "9b6c31bf-c5cb-4e63-aa3c-8d3470402ec5", "value": "48cb53e6073981d79ce56fb69707e743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769262, "uuid": "aefd6bc5-1604-4719-981c-b4b1b4ed8e33", "value": "12288:oXxu5oy0XhL9ljnp9zIO6S33Ys1fCjPfeCMVAgfMCfNe9:ohAcXhL9lV9cHSY2ZCMVAgfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710769262, "uuid": "4e373810-7c82-442c-85e8-3d154838a409", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710769262, "uuid": "2b210bf0-c879-48ee-a02b-c48571dcc186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710769262, "uuid": "46af023d-e2aa-4bbd-ae41-3b971cf9b0f5", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }