{ "Event": { "published": true, "date": "2023-04-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-03", "timestamp": 1680566581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b05b3c65-89ea-404a-a001-62f5d91d76e5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0948b162-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525337, "uuid": "6974b12c-17a5-4431-bab7-fbc7de7383ef", "comment": "Malware payload", "value": "93b512b985f8b388a015738ccbf954ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525337, "uuid": "b79c5094-99e9-478a-876f-a070e6540a75", "comment": "Malware payload", "value": "005bff91c7c3ca88fc794d00d4882a634276c85b506679624b3b51a6a1aec6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525337, "uuid": "c27269b8-4b72-4aa0-902a-fcdc50bc4326", "comment": "Malware payload", "value": "a465c1ce1b740db7f6fd19b5eda18d2bfab107da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525337, "uuid": "8cbe4a15-ee1a-4573-91a5-aa1a8d2db73d", "comment": "Malware payload", "value": "b661d011307a7483367ed51c63d6b28beb69d0a9c79ab246e07148d36c63705e5e84963295857b0c83c542eec0dd76aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525337, "uuid": "05da1b11-11b2-4ab4-ad47-7426f4c218c6", "value": "T1A21633688C60A617D0FD05B55FC725A34605A422AAF0DBBF29ECD35705381ECADF7E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525337, "uuid": "897f5de3-f205-44a1-bc64-84b69b51e0c3", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525337, "uuid": "aa7ca98e-db99-4dfd-a293-d2e602040097", "value": "98304:3i/XDlaVlI4AhZ67RlXoAfZROOxbK58+FrzpxsUGqbgtXOgc:3KD0m4A67DXfqOZ+8IIUGqbI+gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525337, "uuid": "5e2f5466-a360-4939-b10d-d49473876624", "value": 4325609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525337, "uuid": "444e6e5d-5507-497e-babd-a98ca8d74da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525337, "uuid": "4fd659a6-3110-45fa-89ab-f44fd65f48b5", "value": "93b512b985f8b388a015738ccbf954ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87cf77b-d249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680544931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544931, "uuid": "4d4fdf6b-0bb4-4d6b-9bb6-406cc61d3b61", "comment": "Malware payload (Mirai)", "value": "0009509b96ef73979120cc8f3ede57cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544931, "uuid": "8018b452-5dfc-4f51-b346-0f1bd5d102cd", "comment": "Malware payload (Mirai)", "value": "00a5493eb40188f9c93a409e19f8b0344959e09e28cf39dafe55a8773306ab92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544931, "uuid": "9bc2f9a7-060d-438f-85c2-da38828c1b40", "comment": "Malware payload (Mirai)", "value": "daf1e2fe368ce83ea0d9675aad9f7d3855d3bc2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544931, "uuid": "3bd3fed4-4920-4ba5-9032-19ed415f4fa4", "comment": "Malware payload (Mirai)", "value": "3fb9650f21e6cc24d30310054421efd6eb26de45ce26d0b3b1377b170abdc8def44c981691d0a88c08de92f712b85f71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544931, "uuid": "d60d06d5-9059-4d8f-8cbe-7b2ce985dc69", "value": "T12E534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9675E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544931, "uuid": "2e91b4dc-ddd8-4561-886b-5c61b6e07ff2", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMwr/p9OyDQvSFRMNYL6FV+tg6wWx:+5HAdOmGyNtTAdcOyUaFRMNae+aTWqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544931, "uuid": "e1f3eba2-b000-41f0-8bb9-c9be1bae1d19", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544931, "uuid": "c668600e-194a-4dd6-973b-7776209bec80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544931, "uuid": "f0a3fa8d-949d-470b-9bb3-4d41ca35d7b7", "value": "0009509b96ef73979120cc8f3ede57cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa342701-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502548, "uuid": "99de8723-5774-4acb-8d58-dcec7dfdc5b3", "comment": "Malware payload (Mirai)", "value": "e87c6597404a12dab1b1e06b04425664", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502548, "uuid": "188538a8-0979-4aeb-ad57-f0c3a18af2fb", "comment": "Malware payload (Mirai)", "value": "00c389e981905aa3859112db0d3d8f74c82633022a304e1dbf347ef28db870b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502548, "uuid": "a1e67ddc-164c-4a1a-aa28-1ac63c38b8ad", "comment": "Malware payload (Mirai)", "value": "c02c12e3e305a593acedfbf702cf10400e43b505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502548, "uuid": "7a4e0f19-ea13-43c3-9909-bfb55bea2639", "comment": "Malware payload (Mirai)", "value": "5dcae75c1248436070e46bb779e86ceb36e4abf7d44d46492100267bb6b3b3d1161a73d2463f4b876cdc358497eed1a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502548, "uuid": "51a6c58d-32ae-4a65-81d6-25ab90c92129", "value": "T13A03F1A057454FA2CAB0D230EE501513F94E0AFDECBD74F6263D879838CB51261B61D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502548, "uuid": "d47d8c3f-258e-489e-ac8f-cfa224c12b11", "value": "768:2A6XA1Y6SBoDZTKdJZRh4pqk35Rj48vwCpCB+J7qRKw+09q3UELQiW:b91sos/ZspqgRw+Nq5+dLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502548, "uuid": "4323544e-9ec4-44e1-83a6-5199c27d9be1", "value": 40936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502548, "uuid": "97c52cc5-159e-44c5-b10b-9f87e10174ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502548, "uuid": "64173b15-99e0-41f9-9800-a0ccf8d1e240", "value": "e87c6597404a12dab1b1e06b04425664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af1825d-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680512160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512160, "uuid": "0115b5cb-6100-46db-a864-64cd709a8dc2", "comment": "Malware payload", "value": "1d06c09f5c2be548820fc72581344237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512160, "uuid": "c3314686-45b6-4ca7-a4fb-e426342d69fa", "comment": "Malware payload", "value": "00d6acb21e9db4fddbc119f9bcd529ce07080b3e713444a96562ca51c829c330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512160, "uuid": "8c4ab988-b46b-407d-807e-b0420ec7044f", "comment": "Malware payload", "value": "7684829091337360e7993e56525302351d56a79d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512160, "uuid": "4c59bdb3-298a-4a24-88ed-4b2172c141b8", "comment": "Malware payload", "value": "032d452d70994372458d2736fa1b4f42a171c9dab30155d5f6ff845c7aed4a89d7a209e776f366750696db89202799b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512160, "uuid": "f1214ece-47a4-4250-9de2-a509fe8a096e", "value": "T1F3834B52B5D1D471E976093158A8EEB09A3EFD205F619EAB33880A3B0F306C19D35D7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512160, "uuid": "1af84261-d859-42c3-b8e8-05370840ce6d", "value": "ce2dd1d93b3b08296b715229b7f9bf29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512160, "uuid": "bb38c652-1725-4f48-bbdd-d75a9d585319", "value": "1536:97ZcDjzO61tX29pIgZsvBkr2/FzriD5L6X2DZdLg9sW38NcdiTC7pkWFAXe:IDjz91tG9EBkr2/FzriDnvAhiTC7pkWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512160, "uuid": "7bbff146-8c76-4049-a015-12e85f69f737", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512160, "uuid": "b4a8d58a-d373-4ea9-999d-5d9260f20f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512160, "uuid": "98bc1f29-8ffb-473c-94a0-ebeb16810282", "value": "1d06c09f5c2be548820fc72581344237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204aba6a-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525376, "uuid": "57c680d9-4657-4c0d-86cd-c97c30583fe7", "comment": "Malware payload (DanaBot)", "value": "0c897113a199cf5cc728faf4ae4c06af", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525376, "uuid": "c75ee66c-31c4-4775-97a8-2ccea85d1980", "comment": "Malware payload (DanaBot)", "value": "01540e62b82537766dc35fa01425aae7904a09dca3d5d51623abb6bb3ba60771", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525376, "uuid": "a4152fa3-2f2a-41c5-8f12-3c445391620a", "comment": "Malware payload (DanaBot)", "value": "d67e5e73e04f24bcb87427eff5fa171169be20bf", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525376, "uuid": "cb1de120-79c5-419e-942a-5652b8462355", "comment": "Malware payload (DanaBot)", "value": "c53b690abbe03946d2731bd101a0061881357ba4b01fa2cf2e194e8af69b66060eea0f3aea10a5990a39db9b80be5205", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525376, "uuid": "3379a7d6-24a2-4af8-b398-9b5bd9d9cb44", "value": "T150363345B3D46835E2125676EE2FC2B13A4EFC9AAD3ABD952F013A374B701F2C146781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525376, "uuid": "803147d3-8d1d-4c16-a0a2-dbd493c2f7d4", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525376, "uuid": "2362d2a9-dbad-479c-ad03-69360c907cd3", "value": "98304:XJ2YqfKDcY3CmLXDXPV27Hom2SF4BWg54WhPZ2383Z4VM9ak2t:XJ2YWCcY3HDX07IwFsp54c0sJ4VMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525376, "uuid": "525f3e7f-5ef8-450f-99af-0aa91c890d5c", "value": 4947456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525376, "uuid": "46fc1cd2-449a-4412-ab16-10bda3ff864b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525376, "uuid": "ebe44dc4-d926-4a33-ae9c-69bce87a171b", "value": "0c897113a199cf5cc728faf4ae4c06af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3433cc76-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525409, "uuid": "4238239f-228c-4ddf-914e-8534c13e084e", "comment": "Malware payload (Rhadamanthys)", "value": "79e4f870fdb964f873913ffaf7de449f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525409, "uuid": "8e46228c-0115-4203-bd90-9b553e716643", "comment": "Malware payload (Rhadamanthys)", "value": "01eedbeaad73c0b83cc2524be1554f77d81d7cf3690979c87266e7274386ded6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525409, "uuid": "7582c431-c2d4-4537-997d-0c4145d0b6a3", "comment": "Malware payload (Rhadamanthys)", "value": "fc180981d7d79d10cff523c7b067b3a0b25fc93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525409, "uuid": "f6b5ed23-9eff-4d1b-89e0-dff512444b2a", "comment": "Malware payload (Rhadamanthys)", "value": "f20c42c9de54edf36762330e269df2f53573fc2d8e05fc62ba0db7c39e3f6f30d848caa1dff6abf493caa96613254be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525409, "uuid": "7ee1d3bd-a1aa-4251-aba4-abfad7c39451", "value": "T10A64C04267D4A871E622473A4F1EC3FC261EBC61AD157E9E1B45BA3F0E341A3D12271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525409, "uuid": "982a28e3-84d2-4e1b-a62e-12805353b03b", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525409, "uuid": "296711d6-5c84-49cb-9618-73447b757554", "value": "6144:xYdpcyt11QsRryGLx3RfBJRhebZ57rdHVZtkjt:CWyt3Qs8c5hzCbHTGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525409, "uuid": "124c68a6-3c87-4508-9913-55840599dc0d", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525409, "uuid": "95a4e7c7-bff8-432c-b8fd-37b6e63e4720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525409, "uuid": "030844b9-241f-42c5-af09-bb2901c07700", "value": "79e4f870fdb964f873913ffaf7de449f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ae4322-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496147, "uuid": "2a645a9e-ecda-45e2-b229-41bf8be23a85", "comment": "Malware payload", "value": "f656dfb78ee419315ada73e34dd27ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496147, "uuid": "c24c9412-c9c1-4e43-b3e1-24964ba50838", "comment": "Malware payload", "value": "03ecd0020cf6e96b88f4e6ae3fc20b11ff728a24d2c361bd34e3eda3b2565ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496147, "uuid": "0b1397bb-8f87-4969-bc50-b65e78e30074", "comment": "Malware payload", "value": "a5d337738cd3a79b37f398704d4637bd4aca1a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496147, "uuid": "a0000ffc-6413-4ccb-aad7-2f96315e0e19", "comment": "Malware payload", "value": "bad700565555de6d14ccb7140b495cbe6b9a39433854b0330ac532885e02bc83561057562ee037ce057b0c5a6bceecf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496147, "uuid": "386d1faf-8d7e-48cf-9fa0-bea2972843de", "value": "T154436B5376C0C4B2E9A30630297A5B95CFB67B3085B08A0BD7146D4BBC76345AD2F38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496147, "uuid": "455b9076-8f89-4d2f-b1b8-309b75b8945e", "value": "768:pi9g2ur4O0JWJJfoNjAx6JfnfSt7BmLCf0e9lreMr36WO3q6CIb11:7v0CJfoNjAxCStNJ0EY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496147, "uuid": "82be0c59-8b8e-4778-b946-009ccc52b44d", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496147, "uuid": "43b5d91e-bbda-4909-abd8-a79a4b67099b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496147, "uuid": "fbf4c594-bffc-48a9-b814-bfbf79a19d1a", "value": "SecuriteInfo.com.W32.Mal_FakeAl.3.13821.32643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1192e4-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524563, "uuid": "269038c6-275f-405f-986d-01c862e514b7", "comment": "Malware payload (SnakeKeylogger)", "value": "95e6ffc7cfd3d978038c4a164a09c9ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524563, "uuid": "312ca07c-8de8-46a8-9031-3cedf01972ac", "comment": "Malware payload (SnakeKeylogger)", "value": "043b43d6e252fbd521ff9f7956ecee5bc2f1dde9b0674d8f97fccf15b97215bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524563, "uuid": "17fe9c1a-ff03-435c-bdf2-ba7ed657683a", "comment": "Malware payload (SnakeKeylogger)", "value": "cd17f3207355b9b879d0a85bb953aa045c42d2b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524563, "uuid": "20199dd0-7995-4754-a3a4-05d0168660ef", "comment": "Malware payload (SnakeKeylogger)", "value": "44cc356cd8a163b196ba0721b016909f5bbf776e43ce7a0b3218cb4a65aea845dbe626b9d6a5b5e4238ccb298c3dbaf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524563, "uuid": "ac05aa65-fad0-4650-9cc7-7922855112d3", "value": "T1D8C41249322C5927CA6E46FF5012520A03759D37AA0BE7E61DC8B4F975E3F988903EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524563, "uuid": "a96af252-09cf-4286-a7fb-b67e1554c752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524563, "uuid": "989d13a5-c1cb-4647-8c32-780fb0aa8ef8", "value": "12288:u1tzLwrnpsKZzr3OYJOIHA1JxbAtMVEHhM1VErGe2+6yM:7rGS1JJaxbAhHpGej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524563, "uuid": "91af266f-878f-4c9e-8298-b437821f87cb", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524563, "uuid": "769a3403-70c7-4271-adb1-6f8fa71f128a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524563, "uuid": "7df93ce1-45a8-462d-bf05-ee17d8a4b4e5", "value": "ScanDocument8465474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb57a2eb-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680528723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528723, "uuid": "f1c92501-fdbe-42b3-b89d-e710322c6a62", "comment": "Malware payload (Guildma)", "value": "7da45a2a47228f5b6df8621fbf2960e8", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528723, "uuid": "9590d473-3676-459c-93d4-b132c5f8f238", "comment": "Malware payload (Guildma)", "value": "04f62f4216923055df1eded992dc0203f7f2c58ed538458f9dfcf55a1768ad6d", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528723, "uuid": "86c7dcf6-a0c6-4c00-8e11-21e3f25b7e9f", "comment": "Malware payload (Guildma)", "value": "2c120b827dca51ba9317889dc9472a1f7a7e78d1", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528723, "uuid": "5a15c265-1a9e-4b85-964d-9f746da998c9", "comment": "Malware payload (Guildma)", "value": "60d341150720ee54b2d4e0a6e97482b8a5a7a89e5a16835b3aea766ef00b19a2e6dcd0f9fa91480640fd8c120d2b3cfa", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528723, "uuid": "642171c8-2005-42b1-bd58-d8fb0e407134", "value": "T1C5F0AB1DE1602D42D02C01314C777B7A4DACB96B4F812027CACA53144ABCD0BFE2E114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528723, "uuid": "0fa10bca-1dfe-4f4f-9658-41d9a811e481", "value": "12:8rflM8OBE6ZGFgkGoBRjdjLEsKOmBm7zNBhJ/r1p3VbF:8loGFFJfZLEZOCm7BprfVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528723, "uuid": "caf3055d-4a37-4285-94cf-bfc2cdb07551", "value": 485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528723, "uuid": "1bf3f118-7b69-4f6f-afe5-e32c8faaf219", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528723, "uuid": "f9252567-5f88-4183-aa9e-f92705d93a5d", "value": "49_CONTRATO.Zipa__734.49328642.487626.71106.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7e870a-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545661, "uuid": "2ef6cc96-bd27-4feb-b29f-63793089cc25", "comment": "Malware payload (Mirai)", "value": "64a4fc530608fb8cda331c89a1ce0d35", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545661, "uuid": "6e021adc-8bfd-4af9-acff-edb1a6348235", "comment": "Malware payload (Mirai)", "value": "0551209d7bc989072f72c3b6b6a9d2232a287b9e8ed913d521f78c40bfa82f30", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545661, "uuid": "29066d57-3f51-46d5-a6a0-5628f9f50709", "comment": "Malware payload (Mirai)", "value": "a50b15e69a3e612519da76fe17f366901ed5b80d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545661, "uuid": "6fddbda6-2d26-4a36-9e10-efe00cd881b1", "comment": "Malware payload (Mirai)", "value": "afb4649503f12bb9e9ce4cec689bfa981c3d392038dc17ae34a4473342f30dd2b52a9b704ad732c91a32cc98cfb39d87", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545661, "uuid": "c114e8f7-a06b-4f4d-871d-7ae096c36bd5", "value": "T135534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545661, "uuid": "f4d92705-6c14-4b3d-a868-01577112cf1f", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQ5vLiKimfFoktCe3fYRM2:WShU3q7cEDlCK/0DV9i8Fok06fYRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545661, "uuid": "6d29fee7-cd60-43bc-81e2-531a5da1341b", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545661, "uuid": "d97788ef-f961-4862-abbd-06e38f6fab85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545661, "uuid": "e0890bd3-2802-4c3b-8a75-1e3e32a383ea", "value": "64a4fc530608fb8cda331c89a1ce0d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08803dbc-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680501284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501284, "uuid": "2f11cc6a-24e5-4cf2-8a5f-69174cc9c492", "comment": "Malware payload (Loki)", "value": "fd90aa0f70fc412fdfdc37774117af9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501284, "uuid": "913690ac-d4d8-4d50-97f7-6044afa42308", "comment": "Malware payload (Loki)", "value": "059c32936c557da9d73c10957a92251af1d8294f30b295fae39b2711a3b2aff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501284, "uuid": "fcb86941-a125-443a-b6d3-aebdc2a67f31", "comment": "Malware payload (Loki)", "value": "886853d55aa95167762d76928e97ffc0389dd8e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501284, "uuid": "bca648da-0549-48ea-a047-c630051b74d1", "comment": "Malware payload (Loki)", "value": "c4b792136732c427596a32ce70204324eaf430ab3731f09a5e9f2fb5a8c776f22c814afed71aea50fe4ccbb7e4994a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501284, "uuid": "698330c4-e1fb-4e3c-9457-2c494291a917", "value": "T1C2A31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501284, "uuid": "cb44f827-51fd-4d98-abce-8eac3908fa2e", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501284, "uuid": "c15650d8-c1a4-4afd-a6ec-e5f4858235f9", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmda:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501284, "uuid": "0c6c40e5-f518-4fb9-bd79-4f431d2e1c0b", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501284, "uuid": "c1fffc03-39b8-469d-ace5-8bbc1ef76205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501284, "uuid": "6e1e617f-a044-4685-903c-d8fe2cab705a", "value": "059c32936c557da9d73c10957a92251af1d8294f30b295fae39b2711a3b2aff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a03fa8b-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526734, "uuid": "b713c8d0-b2b8-42cb-b4a0-de3a893b3d08", "comment": "Malware payload (Gafgyt)", "value": "41a46dd1d5fcb14af99c08d91ad481fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526734, "uuid": "011699dc-618c-4a47-8cbf-1a4ffee53671", "comment": "Malware payload (Gafgyt)", "value": "05c6285077c3622cb563fbda75cf517e98329d0efd5d8459250066ac9b827b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526734, "uuid": "bb7c0b11-8f78-43b8-9179-9cccd5fd5a5b", "comment": "Malware payload (Gafgyt)", "value": "d6911c3d0b14e66de3e3dd92439d4c71e0af2c81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526734, "uuid": "5eb5fe1c-1824-485c-84e9-435e95fc2a5e", "comment": "Malware payload (Gafgyt)", "value": "c1c47f68ac8f1482ad77c30006b837dc4d07d19ab4543353fc24aaab7c08e2e43330e23f5bab6b8eabf13c88ffd69b02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526734, "uuid": "66f88ae7-d9b5-4339-913e-263017838ecb", "value": "T1FFE3966E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526734, "uuid": "4304eb0c-70ae-4f7b-b090-ce2c8e85d854", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hc:vY01ZkXAQT4NJ9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526734, "uuid": "8ad8acd9-2a17-471f-8bed-7f72d720a5bc", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526734, "uuid": "9a761f3c-1983-46b8-80f1-e4dc99f27280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526734, "uuid": "c5c30225-b5bb-4d0e-ae22-e434c8807de6", "value": "41a46dd1d5fcb14af99c08d91ad481fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13617ec2-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501302, "uuid": "f32399c5-d115-4302-a923-a63d4ffc88c3", "comment": "Malware payload (GuLoader)", "value": "7daf048c30145016a51d9d6bce4b6251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501302, "uuid": "6cd0b880-8dff-47f1-8b47-70675749ab27", "comment": "Malware payload (GuLoader)", "value": "05d29bf13a0c7d933c155b1eac80557f0e35d7afadf885bcc20f2a4633b300ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501302, "uuid": "a5d986df-f5e0-4812-a43b-679bbd31baef", "comment": "Malware payload (GuLoader)", "value": "5be4fd82619a5490194c424c57bd88c469970c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501302, "uuid": "ca5b43a1-1604-4d3f-98d8-49d4d994a02e", "comment": "Malware payload (GuLoader)", "value": "6e64de4972a5e7eeb35aad4dd6a76673e838e5fc49aff54905011b99fd1191353455b1db3115fb7fe34b32027745a935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501302, "uuid": "348fbdd2-707d-4930-a40c-74ea80a87c2e", "value": "T15D2402553170DCB6EA2946B064B63F76CFFEDB2213A9178B63809B09B671EE0452F143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501302, "uuid": "577a12c0-cd2e-47c3-a7ed-ff247e9f8b99", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501302, "uuid": "3f3b0225-ab2e-499b-a8a1-439ed5d77c10", "value": "6144:+qjIdWCUsmeA9ox/duEsAXsfOf5CDl9Kg:/YWAmyxld8OZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501302, "uuid": "de5b2c26-1d47-437b-afa4-e9dcb9807a41", "value": 216942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501302, "uuid": "9106f359-fd32-4e93-b54b-99f6d73f349a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501302, "uuid": "b358f269-dcef-4ab2-9fde-1d51d9a9ec89", "value": "FACTURA09000000000000000000098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6702279a-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1680512180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512180, "uuid": "6ba76871-d6c3-46fb-88cc-8cbd48525441", "comment": "Malware payload (LummaStealer)", "value": "47676ee7d84136e879cae550f3b41754", "object_relation": "md5", "Tag": [ { "name": "47676ee7d84136e879cae550f3b41754", "colour": "#9DADDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512180, "uuid": "f69e279a-d3b7-4c33-aaa2-e5b4144dbb41", "comment": "Malware payload (LummaStealer)", "value": "064d81ae81be1c4aaca1a5cf5f8631b2fc162b4d91c32968ca87429e39ff5c4d", "object_relation": "sha256", "Tag": [ { "name": "47676ee7d84136e879cae550f3b41754", "colour": "#9DADDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512180, "uuid": "4a8fab37-6679-4fe3-bcd1-9682297e0c3e", "comment": "Malware payload (LummaStealer)", "value": "56f12bb155538b082a97007b83972d29ecf4258c", "object_relation": "sha1", "Tag": [ { "name": "47676ee7d84136e879cae550f3b41754", "colour": "#9DADDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512180, "uuid": "6eeb792c-11ab-40cd-aa94-ccbbf014727b", "comment": "Malware payload (LummaStealer)", "value": "405d33a4307d24272a5334921c45df4d7ea64454d7caeddae7972fcad502ec59fec259238bda761850e15a3f81725053", "object_relation": "sha3-384", "Tag": [ { "name": "47676ee7d84136e879cae550f3b41754", "colour": "#9DADDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512180, "uuid": "69cd487e-2a2e-4845-a823-0b42fe5b2b2b", "value": "T19CD4F10257E47870F43E87324F2ECBF4268EBD529D19BA5B26B8FA3F09701A1C562715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512180, "uuid": "bee3c729-93e8-4056-ac6a-003a585725f6", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512180, "uuid": "c2f2d16a-ac90-45b8-8367-f92e8e832e29", "value": "12288:P7PQza1//MbBWEHyRITJE/O3nC+I66NqN:kzinYWoySTJf3n/6NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512180, "uuid": "346b280f-a788-47c3-8f93-b4d5f3d156ad", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512180, "uuid": "e3d54ffa-f739-49d4-90c0-98a23157ebd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512180, "uuid": "bb1ff369-cee1-41c0-a2f4-7d7628ba76ed", "value": "47676ee7d84136e879cae550f3b41754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f59c55-d1d4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680494653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680494653, "uuid": "7a8b6486-89de-4aef-bd66-ba51442f74cf", "comment": "Malware payload", "value": "a072b53a00f4e80895b3084d82cf8c78", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680494653, "uuid": "e9659550-6cd3-4e96-b3fe-f1c8227f0c35", "comment": "Malware payload", "value": "0668b24ed5b0ff9d4414eed8b3e8b2acf21226675faa1d2ce91cb29eb1910661", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680494653, "uuid": "0770ee95-8b37-47e2-8cfb-990a1e6f4430", "comment": "Malware payload", "value": "af5c7c5cc06b7f56658878db4567535880509ddf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680494653, "uuid": "1e488ff9-7595-43b4-9d3b-f2502139dd5a", "comment": "Malware payload", "value": "873d465f4ec92f332eb009466f6615d5e8d9c76530112d67d052ced5eef26a04456657f363700cd2e839e907321c3c4b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680494653, "uuid": "1678655c-abb2-456a-b724-5326f68541dc", "value": "T158A62325A3D78532C55D01B7E869FE0F0539BE73437041E3B6B93D6A88F08C166BEA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680494653, "uuid": "c2ee7677-fb5c-4c57-b889-1a452371422c", "value": "196608:lABXWviyzzww6mKihLiwApP+OL20OsQOZvdmu63:lAazvLK0mzlC0CA0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680494653, "uuid": "79312a20-ac61-4d45-a63f-f33da93eeced", "value": 10094080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680494653, "uuid": "b6667356-cbeb-467a-bafc-f806d86cbe14", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680494653, "uuid": "ce92ae85-64d5-40b2-8147-308aeaf9338d", "value": "Mandado-Intima\u00e7\u00e3o_Art516mlhg.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc1d39a-d22a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680531542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531542, "uuid": "0d9170a6-ae07-4156-9173-e163187cdc19", "comment": "Malware payload (Mirai)", "value": "0bfea8ea6533b67ec7d4df357e499fd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531542, "uuid": "a234f58c-70bc-4357-8ca3-1df59f0a759d", "comment": "Malware payload (Mirai)", "value": "067fd8953a4139f048ac4f35a958ae8fa58380a09b43748d43bcdb973015abe3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531542, "uuid": "13df7b03-464b-4d4d-ad7a-6416fbc52bf8", "comment": "Malware payload (Mirai)", "value": "8c59bc80d5b91c0e5a042e064b857d49ee5d75ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531542, "uuid": "c5cd599f-a03f-4678-a4a0-6ecf6bd5b247", "comment": "Malware payload (Mirai)", "value": "fc2e1fb7b2c06ff4f852e43d4eb7dc6b7c277769e0ec31e810df79df8bed45578613097b38cd34a8291180c24e651b9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531542, "uuid": "0824f71b-cf7b-4b59-ba0d-29da21ae229d", "value": "T1BEA2E1217F1DE98FCC37B27886E5F5C6A3D07D60D2DC89865741C12FABA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531542, "uuid": "663598bf-0037-47c1-ab39-b636dee78e27", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtQjSy/:M98o08kxofBE+ZkXaT47C2EpitQZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680531542, "uuid": "2df9c2d7-aa76-4c29-a99a-ffef68b94e7c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680531542, "uuid": "c4ac7582-0f01-4cef-845d-54ac1ac139b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531542, "uuid": "6c052724-aac4-417a-9f24-fd4f601b6448", "value": "0bfea8ea6533b67ec7d4df357e499fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1be3f7-d249-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680544832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544832, "uuid": "4969fbd1-4c8d-49d6-9131-30b7c9d3dee1", "comment": "Malware payload", "value": "fea26ffe20e4def73aa9776b917d394d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544832, "uuid": "edf881e4-6a8d-480c-9fa3-305fcc8e7301", "comment": "Malware payload", "value": "07cd9f6df9112dfe4b170d9a2ebd06b2ac70cc8272c22ecf5cf0bf53bf560a81", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544832, "uuid": "de5df211-ef92-4f7e-9e7d-1147dc6ac8cd", "comment": "Malware payload", "value": "6a4805f884821b1874152b9c9567157f0d4b21bb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544832, "uuid": "f9f5febb-6625-47e7-bdea-9ec4e46f9ac8", "comment": "Malware payload", "value": "ba6803bf9e99e0f0b04688f0d75bb05f0e3782d83456d73a5477f50c726025e08bca622fc7968a1d7f78bad4e2475cc5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544832, "uuid": "b70a3d0f-f03a-46e0-a7a8-267dc2b040b5", "value": "T103A423726FE5E5DF28BF197C4834A0B642E437EBF229AE3321D5791C0244118C9EE676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544832, "uuid": "4ea0f1cf-a344-4096-a86c-d21b7e17b64a", "value": "12288:GwqXro7exgI1rbntIzTmnaebQn1dIMLMZxpf62SU:LeslIZnazTmafn1dIMwt6DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544832, "uuid": "1811069a-a48f-49b6-bac2-8bb5b05ba28f", "value": 483825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544832, "uuid": "839f760e-d7ca-477a-be89-c9476abf750c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544832, "uuid": "d214ec01-33ec-43fc-8f3b-b38c5fb2ffe3", "value": "20230304.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33782944-d257-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680550748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550748, "uuid": "eda46e0e-596a-4ac7-b234-e0880fc545a2", "comment": "Malware payload", "value": "865ca599a0e8ac178d7f35b6d02c0d6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550748, "uuid": "6bb258ac-4fee-49d1-a54f-ade51f22f3d9", "comment": "Malware payload", "value": "08dcd03dcaf3796c81f653effaaae48f9fd290f98a611abe40d23918adde2d7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550748, "uuid": "2b281d82-1b24-4f65-b866-62cee822d3f1", "comment": "Malware payload", "value": "e35cdac3ff158d93479597d2c0be096753f1f62e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550748, "uuid": "12b69c1e-cc9c-4003-88aa-5c082e73bf5f", "comment": "Malware payload", "value": "7b0cabf3100e6e69cbaebe6032c02ffc97cea213b7cb176d89d55d0df3edb83cee64b10171001c7294c99158c1c774b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550748, "uuid": "658e1bdd-cf9d-49ac-9293-7656f39f41d8", "value": "T150B3E661F8418717C2D327BAA7CA468D3F3556D7E3D733116A386EF82BC17982D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550748, "uuid": "abc2db2c-2866-4064-ae91-b63da34bdbaf", "value": "3072:xXl16sILkOYnHjDPgg/JOyTmZuqQ4DWwXXtke:YsI4OYHjDPpTmZuqQ4DWwXXtke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680550748, "uuid": "bc69464d-bdf6-4cbf-8a6c-3c4fb8af0b25", "value": 110065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680550748, "uuid": "e928b06c-efda-4a93-975c-3bb5ed0dc25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550748, "uuid": "ccd4a46d-0ce8-47e0-8874-6e5a8fe5e9b5", "value": "865ca599a0e8ac178d7f35b6d02c0d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c63191-d22a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680531532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531532, "uuid": "bd405439-cb6c-438d-9c9b-4ba9e9bef61e", "comment": "Malware payload (Mirai)", "value": "8dbc7bd3973812be944ae838234be32a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531532, "uuid": "6f07693b-1d79-47d4-b255-9c722d3d5c41", "comment": "Malware payload (Mirai)", "value": "0934595113a0739d94e69b4049a2e54ae7ce04bc6b34d3711f11dd24bc01e93d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531532, "uuid": "0f0660a5-0cad-4092-9bd0-48d5de3d5511", "comment": "Malware payload (Mirai)", "value": "315288a07518348ca114002f2bd3500f7f1081c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531532, "uuid": "f5361183-1324-4b84-a986-adb1c4363e64", "comment": "Malware payload (Mirai)", "value": "1b8889afaebb1c0fd2b5a3e630c8bf087dacd6272a51f4ba68ef42b6afb9794d28e3ed9c43f3266cd9550abd412adea9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531532, "uuid": "e2d6033b-59bb-4e21-9adf-0666a9c62927", "value": "T1E1A2D114E345AEF4DFEF5D9452C1C2C276E587C7278AC8E340EEAF012506446BB89C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531532, "uuid": "c1ef3748-1051-4bf4-86c7-f1fadc66981c", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5nM4uVcqgw05VxJS:MRxsSVsMD6xiJJE5zRWNi4uVcqgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680531532, "uuid": "7bd28c03-797c-4c08-842b-b13d72c267d4", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680531532, "uuid": "69dc11d5-c97d-4e91-925d-597d6d74e39d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531532, "uuid": "84890b5e-dc51-42f9-8997-5dd5ca30dda6", "value": "8dbc7bd3973812be944ae838234be32a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cbed85-d22b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680531819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531819, "uuid": "e6f94b17-5f18-46f6-a56c-18ef06345428", "comment": "Malware payload (Guildma)", "value": "e883410876d6befd2ef9c3676eddfd7d", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531819, "uuid": "feb91b04-0650-48c4-b925-777999b0d6c9", "comment": "Malware payload (Guildma)", "value": "095e6f5ad3314d5bc6d03ffdb725138c8130d1527af53286171aa641b29c366f", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531819, "uuid": "08efbafe-3430-493e-91b6-2ad27903654f", "comment": "Malware payload (Guildma)", "value": "4bfef93a172707db14cf7e242f0603c29b3e89c7", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531819, "uuid": "1f30092f-5a6e-40bb-a3d6-8c50dd679e50", "comment": "Malware payload (Guildma)", "value": "0671f7d6926ee367c4129688ec2e4dc67efe5711ffaac1346bd5c2dbac0296af7bf8a23869f801a92d3645e3eec1404a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531819, "uuid": "99b21c10-4d2c-4c41-87e1-127fd4192bf9", "value": "T15AE07D4D71E37C51108DBC448E890A884D1413E10C406613C2CF6F50675CD29C44CA32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531819, "uuid": "f0d900fd-0c2d-4129-8328-c64b05a596a3", "value": "6:SGIfGlk9hjncCBCXNAIjdh2bLWuOmqmsXe/cXTyCvWnshFGacqabWgBAMssKa6Nc:Qgk91BBUvjdh2bLpOmqm7kwsjvTptsGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680531819, "uuid": "b76740e8-4ac8-4d90-9ef2-b2ea7be6dfbf", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680531819, "uuid": "f80b8db8-841d-461e-846e-fef35447f0ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531819, "uuid": "96e93bf5-3c5c-4976-adad-65b484108e8e", "value": "Curriculo30268825a__569.95605168.088029.32986.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6fc474-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496138, "uuid": "81ca9a8b-1a6e-4ed3-ae3a-7fb0d0a59ce8", "comment": "Malware payload", "value": "548c5c001f9071f0e9d7cddc3b5eaa8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496138, "uuid": "9b66c7e5-5ccd-4096-b388-147dd5e31e50", "comment": "Malware payload", "value": "0977e465ad47281ac06cd1fc6fc2274da31cafd155de48a01cc92af89f4e5e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496138, "uuid": "7e4281b0-80ab-4aea-9a1d-caaa3f794fa0", "comment": "Malware payload", "value": "b6cc81ddc286de38633d4ac013ba7279df40697c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496138, "uuid": "3aefa29c-448e-4fc4-a4cf-6e4ed2ced38d", "comment": "Malware payload", "value": "8097d642f5f5dfe1fe9f3f83984098bc4b8c4b9acb7cb16068252a1ef068374694f450d55be5f01cb6135ab27c7b6aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496138, "uuid": "0679ecc5-766f-4f5c-a10a-efb94e8e2431", "value": "T18985CE01B206D56DD21845B88C67EEB4A174BDE4EC019A2771DCEF4F3B7636389073AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496138, "uuid": "6e019a69-302f-413a-b78e-0f3d73de4a9b", "value": "12bcf110c8be1eb008c78670dda0c907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496138, "uuid": "455f6c6c-3a2c-4ee6-a0de-9108bf91a06b", "value": "24576:+GwL1enmxN8syNLhn7y1FW+x/yIaQQJYZrYUe9Nfb:MLAnyN8sOLhG1XyxQQJYZrpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496138, "uuid": "ad768e4f-36c7-4b73-98e9-bd3f2179603c", "value": 1718784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496138, "uuid": "6f572d55-f728-40ef-9c2c-7e73d75ab210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496138, "uuid": "45c081d2-484c-45fa-ab0d-bfc1fac1115a", "value": "SecuriteInfo.com.Trojan.Siggen2.33758.27587.25078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530d0013-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680503127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503127, "uuid": "9bfd4cd7-dcb3-4f52-a2c4-ee6cd122683d", "comment": "Malware payload (RedLineStealer)", "value": "e7c31cd054f469c689a28cdaf1f3c50e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503127, "uuid": "7b7bae61-949d-4c91-b537-54b202637eff", "comment": "Malware payload (RedLineStealer)", "value": "0c58c80d4e98864168be4d8c4eb795994d7964a8f7835ca9043167c8d232aaa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503127, "uuid": "c8260926-53ac-47c5-9f02-46659ad266a9", "comment": "Malware payload (RedLineStealer)", "value": "f251f739b449975a67d06aac65b1ef54e7f661ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503127, "uuid": "9502fc71-4ca8-4a53-a8ae-864dfca005c8", "comment": "Malware payload (RedLineStealer)", "value": "37869255ad23adcd94cb94aee8ae0105521217972bf08e159256179574b0f1da3581ffd44c6cf17def42ea5fd2f5ac2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503127, "uuid": "35462d12-b31a-4052-bc36-a6f89eba9fc7", "value": "T16135E330B495C422FC727D3146D08B7085EE64BB5A90BD6AE279E72A7B302D385705EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503127, "uuid": "a9a92dfa-9063-4419-95bd-8f0a915505b8", "value": "6006a64dc74ce041b99c2ab005455ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503127, "uuid": "074bf80c-2c73-4ddd-a18b-cb28993bef9d", "value": "6144:S+i0XUaVUOAOx/7hMRLE0ewMMMMxMMGMf+/sAdO27t9vC:S+i0XD/7qRg0ehMMMxMMGMGs4O4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503127, "uuid": "b9279004-979f-474e-a8a2-5f354c32e9f0", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503127, "uuid": "15e6bfca-432f-4cd8-98d2-61e51819c256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503127, "uuid": "eb458b36-8047-4a10-b633-1d663b7476bf", "value": "e7c31cd054f469c689a28cdaf1f3c50e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c98274-d258-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680551373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551373, "uuid": "2d72b8f0-3647-46e4-bd69-d178a0cfc3cc", "comment": "Malware payload", "value": "bfbd01c4cf59a84d9ba40a02b9aa27f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551373, "uuid": "da3e99ad-df3d-460f-91a5-22f7b0835973", "comment": "Malware payload", "value": "0c6f5b1412fbb4c9143df6ab8f990aa284052d049b8dc2895b6db0dd923e8f33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551373, "uuid": "5a4a35c9-27f9-4fd1-b766-5838bfd8da17", "comment": "Malware payload", "value": "e26d234c4120a23e85f02a0bedf2297ce44bab76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551373, "uuid": "73d3f158-fc19-4d4c-a0a5-03904b2bd0f8", "comment": "Malware payload", "value": "148dc1e66033de9e9abab68358b0d21ecec8131c49f27ef423c6f70fda5b87224bf9a62d4fd0bb1a220dd352b69c94df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551373, "uuid": "e5175ddd-e439-46e3-92fe-d15c7bc707cf", "value": "T11FD3722AAB618FB7D88ECE3705DA45011C8DA1C792D96F6BB2B4C59CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551373, "uuid": "98e117df-5904-40de-abc0-2e8b61096e60", "value": "1536:Nc3eTkeVfACLsYXZF6beI/o8OVcjpRqdAXH4VDHcIrmW+IFB16f11hJ/:NcjIEZOVCqmXUDHcIrmW+IFB16t1hJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551373, "uuid": "79e4c5f5-8049-4ec5-883c-809d7d168c08", "value": 136896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551373, "uuid": "4ae16506-5e11-4f2a-b0af-95be3355c64b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551373, "uuid": "eab567b2-fe83-4534-be98-ae28f4b22236", "value": "bfbd01c4cf59a84d9ba40a02b9aa27f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76e1f97-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526596, "uuid": "a6097d2d-d55d-4036-9b05-4a523b9dbb80", "comment": "Malware payload (Gafgyt)", "value": "b59c039a31d28fee8872efb328c2ff53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526596, "uuid": "97bdb219-12a4-40e7-be4d-1b3e9bacd7f5", "comment": "Malware payload (Gafgyt)", "value": "0c90384c8bca81cf4167297aae9959497452d5f70277632e89b5c64d921b3f1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526596, "uuid": "03993ec6-a902-4336-ae10-e1b1e7057fcf", "comment": "Malware payload (Gafgyt)", "value": "d6738662fa2208fd750fb9750d3dd7051aaeefc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526596, "uuid": "c3e53324-b761-4b72-b2e0-b740cf7a6532", "comment": "Malware payload (Gafgyt)", "value": "4c7148b12ce5d51ad60e9fbd01ff3404049e19804833bf616acfb8c1a4865f0168d98e9a1304ab042d781e2767057787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526596, "uuid": "d576b9e6-324e-4061-af02-359ac99eafb6", "value": "T1FBB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526596, "uuid": "f2508751-9c43-4c01-99c7-ca4b2e511c4d", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCoB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mjn0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526596, "uuid": "3812ed1c-3ab3-4b36-8efe-2bc817a620aa", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526596, "uuid": "43a7f623-19e7-4cbc-9253-7d01a96c5945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526596, "uuid": "1f41318f-51e9-4b59-b26e-a8c4348737d2", "value": "b59c039a31d28fee8872efb328c2ff53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19667f88-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501312, "uuid": "7ca155f7-de86-473f-9582-156977df2239", "comment": "Malware payload (AgentTesla)", "value": "76d08c9a795cb286eb92d8ab41d1bff5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501312, "uuid": "11e7fc25-e275-49de-a673-0872ed811f1d", "comment": "Malware payload (AgentTesla)", "value": "0e4ea6322dba2d469a0e405188c76f6cd9332e193071048192621abf85bf7cdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501312, "uuid": "58030b0b-b934-40f8-a1c1-cacf2f1291e1", "comment": "Malware payload (AgentTesla)", "value": "b00f94fc957f25fcb4fdccb8aad1d679247cde04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501312, "uuid": "41f6995f-cebf-47c9-9569-bad9fa2af7bb", "comment": "Malware payload (AgentTesla)", "value": "97aba3949d74feab99fda9ed68553d65ec3c1efc80d6df1bed3344d62092f27e8aa27d94d90407792595854cf1fca653", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501312, "uuid": "8977e764-286f-4c28-9d94-52a649b721d1", "value": "T129642218E7E1C0ABCEF1A1311E3A8FAD8FE7ED216964594B4344570A74636C1E70DBE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501312, "uuid": "7b1d7819-6688-48e3-b5c5-2274a88e5b75", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501312, "uuid": "c6e3dd45-33c8-4a71-80b8-5c0ff67865cb", "value": "6144:PYa63sAnyhbptQUF310y/LGcCn75IDouSHwoX1TzseW6:PYlFn2tFFF0y/LS7ohSHwoX1/seW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501312, "uuid": "0b90c081-ff00-4864-b82b-4e63212be614", "value": 326654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501312, "uuid": "844b1473-7997-43a8-a499-53b67a0e000d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501312, "uuid": "0f086fe8-89cc-4467-93b9-5f5cfc812e8e", "value": "PO 0051-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0427ef5c-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680523181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523181, "uuid": "dd687aca-94d2-4bc6-b549-2b0739632dc7", "comment": "Malware payload (Gafgyt)", "value": "5a639c8a52ad6d3ae7bdc8e92a684182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523181, "uuid": "010a6adf-58ee-41e6-96b2-eb6db1ad201c", "comment": "Malware payload (Gafgyt)", "value": "0e7898a312d030b0aa8dcd8076affad0ef5a1dccdc77c5e153788eaebc84a720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523181, "uuid": "d47f7c42-5e6b-45bd-8368-6539dfa3140f", "comment": "Malware payload (Gafgyt)", "value": "1f5c1a13387008efe475ce0aa6d47c82f1d32170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523181, "uuid": "35f67545-f8bb-4517-9e67-48132e6095a5", "comment": "Malware payload (Gafgyt)", "value": "6d4e908de44ba4269dcc47b120b771f104a32a24ab00198a4dcdaba22d6696616ddb3adbf20e1e192902a78ef1c2d03e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523181, "uuid": "02ce780f-f348-4e55-b8ec-485aedb8cfae", "value": "T1A8B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523181, "uuid": "b0d216bf-ed9b-4420-922b-5bf9a23c02f3", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPLJmDk1c8xF6KjW:jfO8IBaJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523181, "uuid": "604c3332-090e-4b38-a6b9-1d6c75477a84", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523181, "uuid": "aa7ce1bc-76c2-4fec-b0e2-024b304715bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523181, "uuid": "42f78ab3-2905-44f3-ac3d-9146de880699", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2918058d-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532262, "uuid": "1458c068-96a2-4d92-b594-cdc27692c3aa", "comment": "Malware payload", "value": "cc666ed2f4433ad092242630118cf021", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532262, "uuid": "df126ffb-ff71-4d1a-9963-29dda90dfb67", "comment": "Malware payload", "value": "0ed2e28b75605890d6af9283e4e4c30d3579c84de7c4ac3a7bac534c2a058225", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532262, "uuid": "9f899d68-074e-4410-8451-aa1c224ffde7", "comment": "Malware payload", "value": "1f6879022501d33a128e01d98d782bc082a0e6c3", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532262, "uuid": "30f47e0c-afe1-4c97-ae16-b07f9d2c6db2", "comment": "Malware payload", "value": "0f251f546dee0b3a402cee6eb30009ccd9db122cb7d030d4fe9cec79c14a4809ed01bc249ef76bec30bd2d5fc3aaa79f", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532262, "uuid": "9fbccd89-eaa9-460f-aff4-b9dfcd0e2735", "value": "T1B045CF240BDBCE7EE7AD0679B0D641F2DEB4EC15DBC3E34B4A403AA23B163C45941996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532262, "uuid": "545c0d30-3d02-488d-88e7-695c5a477cd5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532262, "uuid": "2b6dac35-2a2d-404a-b3ca-75e27c64afe3", "value": "24576:sPSvZ9RrRdA5EDudAwq1qG7SkcEQ/eu1WOzTnio5svy1uy1gh:fTm8udAbj7O/EOXP5Rgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532262, "uuid": "412d72d5-34fe-4d8f-8e34-5621fd0e3b76", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532262, "uuid": "59a07e6a-ccc0-4302-8be9-f6668da860a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532262, "uuid": "da293262-cd62-4e72-aaa1-0674a2c09daa", "value": "8441776c4e5752aa1b2b7607d5dd58493cd3c82b52e9d24b2b8fe6c5612e3702.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c24eadc-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501424, "uuid": "a056ac54-e5d8-4631-83de-9d08d8f68fdd", "comment": "Malware payload (Formbook)", "value": "71189449b735013a8a8fba07e37a2052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501424, "uuid": "e53e43a8-beff-44f7-9152-24bf8d9cab07", "comment": "Malware payload (Formbook)", "value": "0fa02b6f90f13470038c0ea42455736163d382b77b536a3b2df65691b7c1a874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501424, "uuid": "d8d313a8-387a-40fe-b2f4-368d26e5aef1", "comment": "Malware payload (Formbook)", "value": "0a6c03df53d0bdd4f3a0a2cd4898ead439c09ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501424, "uuid": "bc526a02-91aa-4cc4-ba51-b11a4ad8ae65", "comment": "Malware payload (Formbook)", "value": "5f6ee812fd3164e9233a22e6e7ee43edc994f63fc9844116a9b144b6adcf828394949d6962e92eebb1a4ac6973d6dd15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501424, "uuid": "1e544cfd-87e4-4a61-8f2e-81bedf062dad", "value": "T1B245B49C366432EFC467CC729EA81C64EB907C6B631B8507905F319D9A3E887DF111BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501424, "uuid": "777e9bee-9cad-4a47-909c-ccf6cc7f4811", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501424, "uuid": "e932b0dc-80a9-459c-8f7a-cb25c6d0e99a", "value": "12288:3Tw+hXZUNTjZRyywVHpPuc6CEXInl8f9Vjzk2Vo9WkbpU77kXwkjZZ8cDH7JbVqs:kcXZUNnLwVJ16CE+lWXpAWSU77kht5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501424, "uuid": "7d744e3d-b3c5-4b16-872a-4a55f6b8546a", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501424, "uuid": "4faca2f5-9dad-4d81-9c6b-51614937fc1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501424, "uuid": "62dc4def-d9b8-4e7f-9989-97eb78dca6ed", "value": "30163753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3200d8-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502555, "uuid": "0e55ea3c-3179-40e0-b9d6-a5208883e8a7", "comment": "Malware payload (Mirai)", "value": "0fe195828572a92a2973c4b0a5ddd97e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502555, "uuid": "57bb9874-9e23-4695-aebb-0a94f8341626", "comment": "Malware payload (Mirai)", "value": "100951c6a9a32f157b23b53ff73d0bac40a0281eac7c111c844f65dfb32c75a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502555, "uuid": "8b6c4478-fc74-41f9-9ac9-c8807f570de8", "comment": "Malware payload (Mirai)", "value": "7cc31dc70f422314bfeda36928b061862fe7586e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502555, "uuid": "7687914d-152c-4470-af9f-a85131d5dfd3", "comment": "Malware payload (Mirai)", "value": "222ea32afe00ffe7b97de6f61151f785934501128f69afbe0074940a7d88232d2f4f3ffe4bc0438ab2e654000180aa33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502555, "uuid": "9dda89af-3b45-4844-9d6b-1897b413c0a5", "value": "T18D534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502555, "uuid": "990bf81d-4f33-4670-a8d7-49235e01aa0f", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGV8+BCpEMsQ/J9KCrMvuBxANUr6FV+tMiwW9IC:MvolWm+phBgd7KCAWBxANee++bW9vF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502555, "uuid": "468877a4-5604-4479-897d-c3725e84991c", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502555, "uuid": "2c08e903-8eab-494b-aaa9-3011251d3178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502555, "uuid": "ce95ec0f-9671-4fc3-ac32-70472e280e67", "value": "0fe195828572a92a2973c4b0a5ddd97e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faebb88a-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680524883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524883, "uuid": "624ad729-6eee-4488-8160-cd365d6485d5", "comment": "Malware payload (AgentTesla)", "value": "f4171a1d0b83927205b24a869405fab5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524883, "uuid": "55f7ff47-06f7-42e5-89fc-dd6d3922e387", "comment": "Malware payload (AgentTesla)", "value": "1035c0af69138d45af1e8a10682c5fe707ac7e4334ea1517744da7ac67dad711", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524883, "uuid": "6d38fb39-1b1a-4ad8-b628-4e4d64e3862b", "comment": "Malware payload (AgentTesla)", "value": "18daf981878dfbca56ff020a94ffd5ff31acb930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524883, "uuid": "38af409c-e2f4-4ebb-95d1-9492794511a2", "comment": "Malware payload (AgentTesla)", "value": "af3a2cf70ee8495c130f14c0c54c9e6d55fd49f0499374f03031d523a086c380a0836cb2c9c2c91d16e265feaaf55586", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524883, "uuid": "7c409289-4d36-454e-93cb-affb7e0e8976", "value": "T11FF423013999E332CD3D4BFB90A2922513B26F5B5853E77F4CDE28D62D32B1882C6657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524883, "uuid": "58cd9eda-aef9-4b51-809b-44dfe16bd3e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524883, "uuid": "68916188-bfc1-47af-bc31-6f24b6f0868b", "value": "12288:P5CBWKdq1FbwwJLwre64jor+JlC6l8w28bQpP9zPQ5roiHn/uLIdlL1myy1GBL:QfrpXaXC6l8wUgloIn/8yy1EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524883, "uuid": "85343f04-21ea-4e3e-b255-f73918c1c047", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524883, "uuid": "a3801b18-1ba1-4c9b-8311-e357c63bb1ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524883, "uuid": "c91d23c8-b7a3-4207-96e4-edc8295388c1", "value": "DHL_AWB_NO_#AWB 4507558646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f21079-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501286, "uuid": "d8d052e0-330d-439c-be18-f88e90a44247", "comment": "Malware payload (AgentTesla)", "value": "6000c65c92c57aacb254a0086b11c94f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501286, "uuid": "8fdf06ec-8434-49de-bcad-ee7a51ab467c", "comment": "Malware payload (AgentTesla)", "value": "1133ebdd4a9e4fe36b9860f676c523e0a9f7419b345bc29cd5cbfd4cfc800e3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501286, "uuid": "ad0c6932-9362-4825-b754-3d22f3e7f918", "comment": "Malware payload (AgentTesla)", "value": "0445ffce0d85572af354edfe744a3762440f5c9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501286, "uuid": "7631c1cc-ceab-4c72-8ddd-ef2e95f56428", "comment": "Malware payload (AgentTesla)", "value": "204fd2a8828e74599dd5e157bf6f80f0448e96c52e587d281ff7350777a1ae51e82eac3ee0bdb03efa03e3f8483c1d22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501286, "uuid": "e81385c4-7c55-41e8-9036-74ae385652ed", "value": "T10A242B1A2715D561CB5F417FC016C21831F1EB07A32AD78F5AA1D8FA1B821CEF92B8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501286, "uuid": "0ba69143-b67f-4c00-b18b-74d9bfce4649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501286, "uuid": "4963c71b-7c3a-4642-8495-f75353eab778", "value": "3072:xGVrVtjlopA8k8kGnRmc4UhUa794PJNp3yvzuOioNlBiJZV9XWsUm2KgMM3n9xGL:xfznLTUIwJ/ivznH+9G2LM37TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501286, "uuid": "bb53abf0-2741-469e-bb24-b0b48d905f22", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501286, "uuid": "610627b7-e945-4aff-b60c-27638f446143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501286, "uuid": "608f6e70-c9d5-46fe-b482-ee6c75c71b1c", "value": "1133ebdd4a9e4fe36b9860f676c523e0a9f7419b345bc29cd5cbfd4cfc800e3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2035a8f5-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496170, "uuid": "28eb45d7-5943-4d3d-a7ce-540126bf6355", "comment": "Malware payload", "value": "e53da0899c3419e7354d367749ebb44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496170, "uuid": "cc8379ef-e532-46c0-b8cf-01f62af849b1", "comment": "Malware payload", "value": "11464b6a095c424a6676bc3e04204498873cb8aa67904cde058b45e746b1ce30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496170, "uuid": "3c3ed0f7-3347-4918-942e-45fd6a848e7d", "comment": "Malware payload", "value": "a2bb8d2bb3d6512b31a71236e7a9440163a0dc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496170, "uuid": "f48de548-e402-418e-a0b0-629f13ab43bf", "comment": "Malware payload", "value": "e0bf7f9d3b86fbb89bbea2ae6b734093a0e5a677a0b0f504edfb45d2e240af0d0e4d0efddb9295b6c314646e2d0da172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496170, "uuid": "86d75ac4-93ed-4262-9dde-d5563afe5919", "value": "T169359D49F7B1C0B1C7462531156A33769AB64D878B35CBEB1264FDACA9324B1EC3B231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496170, "uuid": "9fca08b5-2d80-4b09-b5f0-312aeb540171", "value": "12288:7o/4klOshCOjK65e4DL6hyY8mxYbuwS8QDO:7ogpsgOjK64ALcyY8tCwpQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496170, "uuid": "ebc3abe0-47ce-4208-8609-6d7d9fe6d6c3", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496170, "uuid": "85ec22e8-664a-4215-85bb-1ec89d033197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496170, "uuid": "3a8b77f5-6ead-4239-b823-0b0617c70a1e", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.24721.25113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438d4fd8-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680533595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533595, "uuid": "b5599489-85d9-44a9-a311-45b472daa407", "comment": "Malware payload (Stop)", "value": "643ced7b8fe7f7be8a88a511b44f147e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533595, "uuid": "4893fea7-f71b-4707-a9e8-65ec67c97c74", "comment": "Malware payload (Stop)", "value": "128fa047e83a40698640ec9ccc30af053cd2a93ef4be583f02ca8e6ae5c97e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533595, "uuid": "75ad8417-0d76-4315-badd-2994c1c7b814", "comment": "Malware payload (Stop)", "value": "85720e255f20401fa95eb302cb0cd1e8e05ed30e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533595, "uuid": "806bbaca-c74b-41bd-b1c8-f84068587f7f", "comment": "Malware payload (Stop)", "value": "f1c6e2d3f17627853a97bc8f5e26456d30eef6e427a5ee677daaeb4312665d878a5ddf5c2ddb7a18633a39d4a9d4b879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533595, "uuid": "1d787aa2-5bbc-4c72-b167-a40e4bcab3da", "value": "T162E41220B4D3FCF2D1128474193AC6E67B3CB8721B65CED73B140B2E6F662D05A6B256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533595, "uuid": "ad8fc10c-09ac-4221-b93c-b43934df86ed", "value": "bb60398211b18fadc0393d4c1e0d3fbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533595, "uuid": "929a3a73-2d29-49ba-972f-ced6c004a251", "value": "12288:Kb4luw3purT0vUCg0x/O+6iMYwnKZTFspS+K6Hxmp4EO2r7:KbhwLMFl+67YwceHVh2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533595, "uuid": "f80904e5-a267-496d-be52-4ce2248f918b", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533595, "uuid": "88553d9b-81e5-4a09-8591-5c5a6c422ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533595, "uuid": "7b897dbb-d85b-4add-a324-aab40d8a0a6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14fe385-d20a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680517942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517942, "uuid": "a5a72e13-a636-4216-b32b-ba7deea4132c", "comment": "Malware payload", "value": "8e4814728e93c1f87770551054d21d62", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517942, "uuid": "ad765c9d-170d-457c-a330-66d5b4f404e9", "comment": "Malware payload", "value": "13b28ba7c20232c816ea0703680abd2e408474adcac3f6f9c08948693feef6ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517942, "uuid": "82e5762e-d2a0-4463-827c-fd044a9ede37", "comment": "Malware payload", "value": "19f91835d53294267e9a7f22e0be5b041edd177f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517942, "uuid": "df392d39-a143-41c2-b07c-1eaeb874ebed", "comment": "Malware payload", "value": "8a1a447a8623e354a5d98c26b83e79e06f437909d3421daadf2d358985d222b4da8194eb7a50f3ceb4ee8a9732b938df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517942, "uuid": "8d64cb69-5b16-433b-be65-88e3a05c779e", "value": "T136C4236CF51ED6A8C6080EBBD01283CDA37DD411BDF9E67F74C89A261A3795C9408D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517942, "uuid": "2c00dbd3-04db-49c2-9706-2974f42ea45e", "value": "12288:Er9tYiI4E+8VIryK3xCVpl7Eh0wK7kmD5xIFAS:EUiI4pNryKQbIjKQm7IFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680517942, "uuid": "39fa7c20-ae54-4d1e-9517-88eff6a92ca3", "value": 550491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680517942, "uuid": "ba0e3377-0140-445a-8a06-3013e21791b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517942, "uuid": "029a9328-dc0b-4953-b6ab-5c40a009a6ba", "value": "SecuriteInfo.com.Heur.26428.7611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5c9aef-d275-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680563725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680563725, "uuid": "80d9a1fe-12ca-4aea-98d4-d767b46a2af5", "comment": "Malware payload (Loki)", "value": "100763dc2051a6d4b419e1f5da415df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680563725, "uuid": "31f248e5-54f6-412d-8789-541070e2e271", "comment": "Malware payload (Loki)", "value": "13fb93d94ec52f0bea0a0aeaf6db673b97a49c466db458f07bb9c4fbe14b5e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680563725, "uuid": "340f94bd-87a6-45ae-8e83-49dcb4a535ae", "comment": "Malware payload (Loki)", "value": "3f60f204b977bbd362913272f31d51f4cb2c68cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680563725, "uuid": "4330527e-e3f6-4260-bc9a-21fbf5ff0a58", "comment": "Malware payload (Loki)", "value": "3a52822502b2f9d8f45bf8e7f1dc9eb1ae8e388f9f12444e59406c4f2b4490fb3b9a29a4facc05c156c1a8e8795bbad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680563725, "uuid": "484f3c7f-2fca-4208-b2f2-a66c9b8eb203", "value": "T1FB44E0227681C4B3E96A05B95C15CEFDAE7B78700B1945CF3B89067E5E202D29F3634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680563725, "uuid": "bbd2d7f4-4687-45ff-8bd0-197c073488eb", "value": "d233995a591f0c21b167474a8600ae08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680563725, "uuid": "814a4405-c156-49bd-8839-6acf568b8525", "value": "3072:ozrbRHyThfGBULPvLo6TGjQ3i8FD4IARlh9x8RCpVVDCtCeqmYJL5kd1CU3wsUf:qn5yTMBULnCjQ3iUD4fRnj8RChJdEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680563725, "uuid": "458f8260-b050-4dcf-a9c4-e2488f9edb4c", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680563725, "uuid": "fd13307b-9570-4aa6-a951-0321ff7ec1a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680563725, "uuid": "dd548211-6601-4cb4-8edf-fb5b7101ebc5", "value": "100763dc2051a6d4b419e1f5da415df1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfcf673-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496163, "uuid": "1d42b4a0-cce4-4cce-be68-2f85b2cf8a2b", "comment": "Malware payload", "value": "171b0101d8939f1678003322ef736a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496163, "uuid": "0b627a5c-6a1f-4ad1-9f13-629e803d6879", "comment": "Malware payload", "value": "1405c3b8c1ddedab092b1c6c0c525a992f83702ca70f69d0bcd98e4f4a17c08b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496163, "uuid": "b4796363-52d1-4eab-92fc-ea0f3f65222e", "comment": "Malware payload", "value": "d150075b755437d8643fc7044a494c1758f3c4f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496163, "uuid": "d73c5eef-d417-4963-89a9-20030677692f", "comment": "Malware payload", "value": "cdc88c6098c9c29e5500481cfcc7185e7818941f498d6b7a4703d144455c79b487c77f8b3aa96385a0da78fa729c65d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496163, "uuid": "47c5a67c-7596-4d88-a9b3-72280224e287", "value": "T150B4F156A2485B30DDB20D33A017C87D47223CA5CDBAA65D22C7BA0B653E6F31E37947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496163, "uuid": "a45714ee-f9f5-46e0-9c00-6ef0a6a13b4d", "value": "77b2e5e9b52fbef7638f64ab65f0c58c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496163, "uuid": "b2218046-59a1-4a48-ab64-e206dc847f00", "value": "12288:qjGccZo7YdAyz9OWRLyLKaPWZ8CMJ214/PQNtwnRcY3rHuJnmYH1hnmjWhbY:tlZoot9OqyLKaPVwiXQNUuJnmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496163, "uuid": "41fd3921-7b61-44e2-9580-b9f7c54b47f8", "value": 532143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496163, "uuid": "646c99aa-e3d3-4a6e-bf1f-05e07fb13706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496163, "uuid": "46a2ef50-4673-480d-b21c-7512e4495552", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.AutoIt.55.21236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cb0956-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525492, "uuid": "dd9041f8-a2fa-4664-86ab-b2356bc0b045", "comment": "Malware payload (Rhadamanthys)", "value": "db4689e8c76d02e6937c0bb2d28ce97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525492, "uuid": "365353a4-fa2d-4c0e-93e4-6d5af2fc8826", "comment": "Malware payload (Rhadamanthys)", "value": "142f9eafaf44dd0bee0c6967c8320f374fe926195f55f7ed32907c1239df5939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525492, "uuid": "cc1c0f2e-5ce4-4b97-9258-859ae74461f9", "comment": "Malware payload (Rhadamanthys)", "value": "e159cde5967e4c1ea4da3a62303db9abfe443d94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525492, "uuid": "695eb839-7b48-4b8c-a2a0-a35b6a28ac35", "comment": "Malware payload (Rhadamanthys)", "value": "fd6fed81a6fc9c547b2715b8dd50ce29ed951a5617710f816a1f351e284f6efd6e5a6799599b5c8e6b2ad0f366fcd6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525492, "uuid": "a3ec8d75-fe8f-491d-a7f0-67ec2e0c40ef", "value": "T19064D04267E1A870E2324B31AE2EC3F4261EFC61ED257B9E2755FA3F0E341A1D521716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525492, "uuid": "4293dd0a-e4aa-4020-aec4-caf77d6eb055", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525492, "uuid": "320e52f7-fab6-4c10-b5d1-456f952f0a66", "value": "6144:HSjYOz9/7BLciKBaPtDI6iA3oQRsoZtkjt:y8Ozd7nKBaPtDIlmoQuoGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525492, "uuid": "ccd34459-52e6-4a30-80ea-3d29d87bb4f1", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525492, "uuid": "f2d0527b-a82b-479b-a776-8664a9161fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525492, "uuid": "daac520b-a2bd-456a-9437-1590903c48c7", "value": "db4689e8c76d02e6937c0bb2d28ce97b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa765e6-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680501287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501287, "uuid": "b07b411a-77dc-44d9-81bf-62b44592687e", "comment": "Malware payload", "value": "af26590778c0246a1777d524641e51b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501287, "uuid": "1ff0d769-a61e-4be4-86e1-94571d7aa9aa", "comment": "Malware payload", "value": "1543b6bed342aa7dd2061cd2b444081b878968efdb52736b9a8a532586bd1b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501287, "uuid": "a9b5e501-b36f-41eb-ac3e-236395d1ab69", "comment": "Malware payload", "value": "02ce737428d519ecbb07afca93073b82a8cef8c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501287, "uuid": "5fed0132-b14e-426e-ad9c-55e2b2b4fc8a", "comment": "Malware payload", "value": "3709d168ebf0578110256db07cb44d841a668f47ade9ad244d4776d1fc41adcf87ce5e41f55bcfb905fed6c7196af488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501287, "uuid": "38908eb3-04c3-4787-8e54-7d34cc8763a8", "value": "T163D31A1137D3D072D0F21134997EB2B59A79FD250C6ABB0B2380F72D5E71685EA28F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501287, "uuid": "757dae96-f8e7-4b8d-b01a-64f17c7808ec", "value": "3072:Ye5KZ2NO2WOOISTUYDz1PZYsSOXoA5o8Wt+hFqMoMCDkuuJbTxtV:Ye5E2NO2bwzb1k8WkLqMowRT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501287, "uuid": "35b9a92f-ba03-4f58-a9be-18449fb9ee80", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501287, "uuid": "9b95b6ab-30ef-41cc-ab6a-0a059cc1c869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501287, "uuid": "7edfdb4b-d37a-4fca-857e-80493fb1ab4a", "value": "1543b6bed342aa7dd2061cd2b444081b878968efdb52736b9a8a532586bd1b71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec8beeb-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532272, "uuid": "af731362-762d-4071-a0b3-36f32e46a97e", "comment": "Malware payload", "value": "3c7d79a7cfcfa3409baa0e7a88575e59", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532272, "uuid": "9d70cec5-18cc-4364-8b26-39d3c9ec20e5", "comment": "Malware payload", "value": "159a6825d7b99b7ae11ae504d391c5ac44ac92acc1398428ed7127664c617673", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532272, "uuid": "2ded2c70-cac5-4a3f-a4f3-46a526eebce5", "comment": "Malware payload", "value": "eb12704d6b5ab7456d0dafcfdbb57433cd6bff15", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532272, "uuid": "e03a6f51-81bd-400e-9de6-aa0d751ab55e", "comment": "Malware payload", "value": "162814c4a2c1393301d965b0fa261fe6cb74de0266f5d44d18d23629eeb327a7d26e41f859b070af1b7372380f5de302", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532272, "uuid": "20d4d6d5-ed9a-4c86-8f92-604ee7e8bf8c", "value": "T1A245CF140BDDCD1EE79D0E7AB0DD03DAD674C8199B87E74BC44129A23F9A3C4BA811DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532272, "uuid": "2197bf15-4e02-4c3d-a7ed-7eb912134e29", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532272, "uuid": "73bed3be-6b32-49b1-82a9-ad7958a986e9", "value": "24576:f1M0vYtuCuKN6ZUn6gsw7nwf0zl2O8XMQJnHYp5NodzxFop/0qIv47E:TYXUZ0SEcj8QxYpfoxxFy7Iv47E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532272, "uuid": "fb1835ce-730c-4701-8189-2a07c77b4fd3", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532272, "uuid": "d9ad915b-31de-4660-8aac-7d8f9672dc71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532272, "uuid": "f899223b-8787-45bf-8e24-3b76e5dfbe30", "value": "c7e2f4b524b567630d466601f7a7ea1e7e5f74c3ee652794f2e1c6f17e41f571.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d162fee-d231-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680534497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534497, "uuid": "25228fdb-52c2-436a-9a10-23e1dbcee226", "comment": "Malware payload (Mirai)", "value": "eaf0ee35b4b7201e7f1e1be5c0e61bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534497, "uuid": "87bc4125-7bc3-4956-b3b6-e0de38c68388", "comment": "Malware payload (Mirai)", "value": "15e71fa1ba2ed62ccfb615b16415b5b28ef4ca9be2d4ea93b463423dbae9bccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534497, "uuid": "10a9df7b-25ed-4ca9-b411-f2751f80d5a3", "comment": "Malware payload (Mirai)", "value": "7c8e51c52d4832a218934ab94c13f76cee99b2df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534497, "uuid": "82898296-9b7f-4bdd-94d9-bb7c703fd808", "comment": "Malware payload (Mirai)", "value": "7ac439adf721c143e9078bfcb07f7961ec4933c9b562766bf4c36454e8d3a351a5229c32de754561be6d36fc7a7ef673", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680534497, "uuid": "db682e9b-492d-4107-8275-9ae7df605780", "value": "T112330A8EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680534497, "uuid": "d1cd193f-f63d-4604-953e-d735a9c9a6a1", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oG7:r/hqaJMeteqK806MHdkfQX6HuC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680534497, "uuid": "6c20f69d-e923-494e-bdbf-cc3319e1ec3f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680534497, "uuid": "2d53d389-aa7d-437a-993f-44d5c6e45ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680534497, "uuid": "5eab0085-bd82-4d9c-9465-86545e4f1cf6", "value": "eaf0ee35b4b7201e7f1e1be5c0e61bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdbb248-d234-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1680535810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535810, "uuid": "b5993a80-ba58-4a49-90af-90aa56373fa0", "comment": "Malware payload (LummaStealer)", "value": "b28ab720f9d5f6a7b7ab2772f1388df7", "object_relation": "md5", "Tag": [ { "name": "b28ab720f9d5f6a7b7ab2772f1388df7", "colour": "#135DFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535810, "uuid": "875fa24a-7e9e-4f50-afb1-35c38ca4c0c7", "comment": "Malware payload (LummaStealer)", "value": "15f7f1e52909648e38d62c3b4dfa1f7fc62e718abe50f373a0a6a130b8031364", "object_relation": "sha256", "Tag": [ { "name": "b28ab720f9d5f6a7b7ab2772f1388df7", "colour": "#135DFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535810, "uuid": "c8277394-4b7f-42ed-b4b9-3ede00021e63", "comment": "Malware payload (LummaStealer)", "value": "337d6306aa49ca0274869c5b89764bab8de2268b", "object_relation": "sha1", "Tag": [ { "name": "b28ab720f9d5f6a7b7ab2772f1388df7", "colour": "#135DFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535810, "uuid": "430aecd0-c1ea-48fd-953f-e4b38564e2fc", "comment": "Malware payload (LummaStealer)", "value": "74911535a79362f0d2a6ea9f927891229cc67d85ec4547ca0eb1a6ab9eac1b6aca3427c2a86470e2cacde7b8f15cd973", "object_relation": "sha3-384", "Tag": [ { "name": "b28ab720f9d5f6a7b7ab2772f1388df7", "colour": "#135DFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535810, "uuid": "f5d37a64-ba34-46ec-98be-43d70ee97b77", "value": "T110C412517EF3C476D04645744826E3A12B6FBBB14B63DAC7278803AE0D316E1AB7E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535810, "uuid": "1908933c-647b-4340-a42e-e4c373e52713", "value": "bb60398211b18fadc0393d4c1e0d3fbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535810, "uuid": "aeb22553-e338-4902-b377-5fc95ae2f35b", "value": "12288:4aPLO3f1VaE9tLkrDnBEpBbsICyPH/z4RiunKdX1SjGSG:4aPLO3dVZsPKplHzciBd0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680535810, "uuid": "b790fb80-2fe1-4ad4-bd10-17c6de9c3f51", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680535810, "uuid": "d725c864-b01d-4f9f-ac7b-bb1a7f6a369d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535810, "uuid": "8d78fa42-0c44-4492-bbed-f09d91b260c4", "value": "b28ab720f9d5f6a7b7ab2772f1388df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20370046-d1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680503901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503901, "uuid": "77ff4637-56f4-4ea7-aa31-94e76ac8be76", "comment": "Malware payload (Formbook)", "value": "729d96b63c258f46d4f599bbb07de822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503901, "uuid": "448f45b5-62bf-4326-b144-e4cf3984fa30", "comment": "Malware payload (Formbook)", "value": "169fdf358714cd65c4451fe9ec9cb72217367296298f5b570b3e6c74f1a59f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503901, "uuid": "a3cd4188-8dcc-4f44-915b-3a4b522660ed", "comment": "Malware payload (Formbook)", "value": "e1487d9bdbef8a03dc2e4d0cf5f23f423295903a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503901, "uuid": "bad5540e-4045-4c1e-9a88-f0ea69e3eacd", "comment": "Malware payload (Formbook)", "value": "a92bff4aa996a348e8c2a7b35b044b9cea790a56dd1d6600bc23a458bf10278c6f00603b6012843f6fb65d87f9908229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503901, "uuid": "94033ce7-5c48-4d62-955d-a3629dd4127b", "value": "T1B1D4011EBD01510ED96159378C634AE31EB36D2D8DF45A1513FABE2F88323CA799D283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503901, "uuid": "ac105a1a-d782-4f69-ad4a-4cf4b14233db", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503901, "uuid": "d50226c7-a62f-41bc-bbb5-ff3b6669c1c5", "value": "12288:kh+G1bq30horZKL+s1i/hLkRJBbx2xl2I/lTRttWfRChEa+CeKdV7:kh+G1bq30hFL+s1i/Zk7El1ldtphEjsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503901, "uuid": "ead0a8b7-bc61-40dd-a0a0-e049ec262cdc", "value": 639624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503901, "uuid": "323baa12-b458-4862-8142-8c38b6d283fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503901, "uuid": "fe4ec5de-7eff-403f-a64b-2f5353f90090", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8770bc-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524567, "uuid": "3a187714-0b12-4015-ac48-0189b271ac78", "comment": "Malware payload (SnakeKeylogger)", "value": "ce4f4a28c43e3ffe978d659e451759b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524567, "uuid": "b1edefce-7480-4ab2-98d6-52821805b992", "comment": "Malware payload (SnakeKeylogger)", "value": "16c366cb47a4b606f2b20a1a1ccb4a8e408c758afbae9b51922667abf9c2b92f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524567, "uuid": "02f2b20f-a3b4-4f5b-b5b8-edd470bc7b1f", "comment": "Malware payload (SnakeKeylogger)", "value": "e6cad4258318085d36a9024b7b0824b9c5bce377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524567, "uuid": "d2675e74-c7da-4c62-8d9d-4d35bf9b790f", "comment": "Malware payload (SnakeKeylogger)", "value": "0122fe5d74b93f82049c58947dfe0ceef331c3ce59f9824dcc68346a1ff7e996f8b3290a33c0f40b5e83c6d5071ba03d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524567, "uuid": "d1f4af86-5611-4535-9b7f-c624be385157", "value": "T189D4124A332C9F2FC67D45FF60616109437A9726B60ADBEF1CD4A87E56F37488102A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524567, "uuid": "335cd457-12dc-4de9-b3e5-6f9197c89f8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524567, "uuid": "52957927-c06b-4a2b-b815-12d9989179d8", "value": "12288:BktzLwrFjS/YJOT9vdmHbNnHKMsWilQwP6lSKO0xESMH+uLL1VyW:F5jS/Ywvufs9SlSKHLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524567, "uuid": "2bb20703-ea69-487d-be35-7983124155e9", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524567, "uuid": "2594a3e9-ac1e-4b9d-beda-a6d3ffad3923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524567, "uuid": "4e4ef892-0afb-45c6-83c5-cf92df605568", "value": "Inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9b23ef-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525562, "uuid": "ebfa3b89-7743-471a-b121-17bfb68199f0", "comment": "Malware payload (Gafgyt)", "value": "3843454b72c9f5a918fedcc3999119d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525562, "uuid": "73db547b-80c6-4df8-ae9f-09a92da59cd7", "comment": "Malware payload (Gafgyt)", "value": "171cad5a47be13653091a52f357cd9792b70650fc5e7c66f65769a343ce51995", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525562, "uuid": "250d571f-97c3-4ba1-b0e5-a048bd72887e", "comment": "Malware payload (Gafgyt)", "value": "f7cddb5e9fd6b99134c46741d9921c5a1c591a16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525562, "uuid": "4e7fb3b4-315b-4f53-9f14-f4b67092a1be", "comment": "Malware payload (Gafgyt)", "value": "f632ae9bd9a79305cc483e07339c480e06ec7ac2a1a8d53ffbe6c05d8b1a824b161b4635ed22d5b463728ecada16cae9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525562, "uuid": "50158fce-8b95-47c8-b7b4-27f2c98aae11", "value": "T190C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525562, "uuid": "919586b1-d5b4-40ec-8c45-55dfc1180e6d", "value": "3072:H63VpNeuWDGeQf8sRCUt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCUt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525562, "uuid": "9da0e3d1-cc3e-496f-bb9e-1b11feec64ce", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525562, "uuid": "8e176d2e-506d-490b-aa76-e511ca014ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525562, "uuid": "a315bc5c-7759-4bc0-af9a-efdd5c231ea3", "value": "3843454b72c9f5a918fedcc3999119d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331fca75-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526696, "uuid": "b7103f1f-55b6-4e98-ba90-5a6fa97cd04f", "comment": "Malware payload (Gafgyt)", "value": "93e08e8b65b864b627b8fef9ddbaf5ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526696, "uuid": "574c8ca1-20f4-4ac1-8a1f-069ab87cdb41", "comment": "Malware payload (Gafgyt)", "value": "1898885c49727ea4b8070096d359cc2633ed6ca5fa69e33f2557a9828fdd28d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526696, "uuid": "f9250b8f-7d47-4f29-ab89-56513ce29fb8", "comment": "Malware payload (Gafgyt)", "value": "622b4cfeaf358b013279fbe6ee2d8c88ed984c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526696, "uuid": "b9ab67cc-6951-40c2-b238-8e7d219c8297", "comment": "Malware payload (Gafgyt)", "value": "143d1d695fda42ceb42befa72e99cb7fcd838b5bcbca017971271e8393221e6575f4b29fc05e39af1462cad45c0e78f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526696, "uuid": "9b3cbb5b-526f-4a27-a95a-61df28c20102", "value": "T1D4E38266BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526696, "uuid": "833e366a-2eef-4a18-8a62-e4fce2763363", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytV2pLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflsgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526696, "uuid": "fdcdfb51-8119-45b4-a9e5-46ea0a0bf73e", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526696, "uuid": "6f0cb757-8eb1-434b-94ad-e27f79649d17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526696, "uuid": "08fd2fbd-108b-44e2-9446-b97a152cd608", "value": "93e08e8b65b864b627b8fef9ddbaf5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4ce52a-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525582, "uuid": "f00b5b19-2566-4924-9188-3e7eda90b1e9", "comment": "Malware payload (Mirai)", "value": "af790991430b7bbc10f4b655392f7d97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525582, "uuid": "463c4893-b9cf-4aa2-a308-aaae81078b1d", "comment": "Malware payload (Mirai)", "value": "18f181c5497c6df46fa3efbfeda7bc29d6860cf382f889beccc598cfe940fc2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525582, "uuid": "be52aa9c-00b9-44d0-8180-546a2eabd762", "comment": "Malware payload (Mirai)", "value": "96605547028f59ee84bedd68d4d242ebbbf2d235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525582, "uuid": "f98ec187-b707-4752-ad3b-065a1f213382", "comment": "Malware payload (Mirai)", "value": "2731d49374131095f21b18aecb65f20227a7a5de63c416060d35983770d855f46713cb09883f4d3af421df58a282df40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525582, "uuid": "ddfb74de-b7a7-42aa-8288-1df77b106521", "value": "T120230271890E8EF524703C36EE959393B6E126B1C5673013D6280B386F757631E5BF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525582, "uuid": "94aa7b94-3ef2-4e74-8f16-0a34bd1b0015", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3B9q3UELbUXfi6nVMQHI4vcGpvz:DECFd+A6YHAx0LRQZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525582, "uuid": "bb67b245-83d4-47ac-9b8a-65d66a7736ae", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525582, "uuid": "59f908df-6999-4aff-8e3e-0c7878824ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525582, "uuid": "3f8b5b2e-71d4-457f-94df-5152e442f25d", "value": "af790991430b7bbc10f4b655392f7d97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7be9cf-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680503144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503144, "uuid": "4b4a172e-eb37-4028-a064-6cd63aa234b9", "comment": "Malware payload", "value": "b13535dbbd04e5c0b14ec6929daf338a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503144, "uuid": "e046702e-b4e8-4d55-b57e-772d95946a2c", "comment": "Malware payload", "value": "190171b5b9396a45611bec190377551bb5ab3364781e521a88419c5055bbb947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503144, "uuid": "93c752f5-500d-4647-b7d0-393f113ee088", "comment": "Malware payload", "value": "7427088abfb8b324fb647f5e2682e6a4350e7cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503144, "uuid": "6b242d41-fd29-4869-83ca-a758abda0eea", "comment": "Malware payload", "value": "044a90c3b09673e1212ff66fe3e458148da7011c8a356603c20c6bd5716733b403383dfd9fe13a724c3f9fc6d67233da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503144, "uuid": "1e4d13b7-2de7-4787-a7ed-3ea7c6753dba", "value": "T1332633DA95094E7FEE9430BC46F2490B75671B471A60680BA732B5E0F9FDBC1C81372A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503144, "uuid": "91f7da32-f1c8-4f58-85b7-7b66fd6e1a47", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503144, "uuid": "70411d95-d0d9-493d-b6bd-93ad88fdf629", "value": "98304:cL2ncElQ1GcTwWKCx4WBDbJCxCB7bjqgx7+3/zqEn2o4L+9Veg+vT2K:cL22VcWR6qbMxCBLGvzhzU+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503144, "uuid": "30beabc4-6a05-4d0c-b232-4448fa03ee27", "value": 4513280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503144, "uuid": "6f3406c8-ffce-486a-ac63-0823c3259b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503144, "uuid": "870dec70-6b10-4aad-b8fa-e907e19e951f", "value": "b13535dbbd04e5c0b14ec6929daf338a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e498093-d27a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1680565825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565825, "uuid": "89f409a9-546f-4620-9a3b-08272d7ad017", "comment": "Malware payload (Vjw0rm)", "value": "ee0206917e8161e75445007b635ab8b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565825, "uuid": "57b0c51b-d3df-41f7-ad45-7235c5269cf9", "comment": "Malware payload (Vjw0rm)", "value": "198783e619d1dd2aa76a91d82c046a911f529d46ab27e96867c26635b1a626dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565825, "uuid": "245809bd-0dc7-4300-9839-dd4c2c1abcf1", "comment": "Malware payload (Vjw0rm)", "value": "36f4a4a1b46b34cb64ad50872e953191171d68ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565825, "uuid": "38244d33-ffa4-4822-9d92-e1fc1f837605", "comment": "Malware payload (Vjw0rm)", "value": "f254195a3b87e18ab7ce48a21354929cf2d66cf08ca7f60fcc0153ab2b9bcbca612ac32ba4fbb700ab1bee626681d29e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565825, "uuid": "312f051f-d6b3-4597-bfda-bf4934fffcbb", "value": "T198710E9C2C5BC62843E27B8A901ED14CCDF508B07B24D2B1148DEAC5360E9B987F19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565825, "uuid": "77781e77-0a21-42fa-a03d-4084bf153fd9", "value": "96:SABNo5DDk2c24ZRMHXE6/BI2+Ys+fJVDdQqR7bJy66:zSc2c24ZRMlBI9Ys+fJhfRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680565825, "uuid": "e668e89e-8c68-409d-8b46-6d9ae11ecd30", "value": 3553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680565825, "uuid": "300785f4-4f3e-42bd-96c1-8df731d26ff2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565825, "uuid": "80a66603-c5ec-4c18-b992-65338626189e", "value": "sco-4-32023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5b1b4b-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501289, "uuid": "787fb817-7314-47d7-b6f0-b8b2be8e630f", "comment": "Malware payload (AgentTesla)", "value": "12ab0e15b1c07f2b59f084a5cc6dbb9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501289, "uuid": "a31dc5d5-e775-40a3-afde-866ea1e95022", "comment": "Malware payload (AgentTesla)", "value": "1991f258d7992b474526d2bf2f73a02e511505a364f2bbf649428630ad757dc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501289, "uuid": "ab8c4598-36fd-4132-b9bb-ce2e4225dc1e", "comment": "Malware payload (AgentTesla)", "value": "28ba046680724d0057c09776548a7aa93a0807de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501289, "uuid": "5587ddbc-fa86-43eb-a037-0e185136064c", "comment": "Malware payload (AgentTesla)", "value": "830ea7280423d0d22c5a62045a1ab1a6e1e820b3ec8f1e62fbac579ae6236109b0b5e07a4ae54d999967e80643bca461", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501289, "uuid": "b74008cb-0314-454d-b62f-7354fed4b3ea", "value": "T198F33928928599D2D32D4074E7A01148CBB2D14E5217E79D0EADACF73B467C3362F96F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501289, "uuid": "551cf7a2-c9fe-49fc-8047-79800aff9160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501289, "uuid": "e30b1451-cb68-4ab9-a77a-755e4207cc1c", "value": "3072:KElywxqU2q1/ruQoQRv7lXJTIz3STG1J0mRVaskeEq23krWoAC:/bqu/r4Q1lXG3Sq1KmPAlquElA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501289, "uuid": "ff5b0037-70e8-49a0-b17e-2994ea717c74", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501289, "uuid": "ef13f3b5-1d18-42dc-b546-5b0fd9176251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501289, "uuid": "0ec58107-c9cb-45e5-84d3-768ca53d23fc", "value": "1991f258d7992b474526d2bf2f73a02e511505a364f2bbf649428630ad757dc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813821a6-d239-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680537994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537994, "uuid": "e5f9d2de-9ff4-485b-b697-3db9913f50e2", "comment": "Malware payload (njrat)", "value": "d7035c21debae512ddad30c60fa03a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537994, "uuid": "dc0758d1-3507-4e92-85b5-0bcf2d730331", "comment": "Malware payload (njrat)", "value": "19e78ad3abd96494ce47426c40e6dc2206409ba8c8a7ad8daa57b9e89a070ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537994, "uuid": "e52f90c7-3fd1-4adb-b713-d57f2de464cb", "comment": "Malware payload (njrat)", "value": "e5eb3957c68f75b0ab3f30dff3ef33d1b022c583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537994, "uuid": "f6f2ea6a-87b7-418f-8bd7-6859c0b9d229", "comment": "Malware payload (njrat)", "value": "c9ee03efa57f2a894a940371516779d9120745686eb8dc86ad15e3d8e2ce74da03a6a34c8da02cb3ace12052e23726ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537994, "uuid": "3524d419-fc7c-42e4-be06-293ea7a27853", "value": "T1BFF2185D3FA08176C2EF2B7406A2D72102B2D1075A23EB5F8CC844FA6B777D14D81AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537994, "uuid": "8584dc42-a697-4185-b9be-b7591ee6d85d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537994, "uuid": "5e256f3e-5d12-4533-bdc3-b28c522a1bfb", "value": "384:BLdClEUdi/dMkt1QhY/BKzEQePC45SY2OzRLTm3yilqr64sbbyvGe:hUEUdi/dMc1CEQeK45SsbLvGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680537994, "uuid": "0201d6d9-d63c-4712-9cd9-6b72a231774b", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680537994, "uuid": "eafccf78-0c1a-4a29-b0a6-8572201e9c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537994, "uuid": "3c2c8a12-d30b-4e55-a774-c93d3e653699", "value": "bLcH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6afc2c1-d229-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680531265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531265, "uuid": "9539c879-66f2-49ab-9a56-d2354a31d02f", "comment": "Malware payload (RemcosRAT)", "value": "3fe590be88d8bc906189b042eb818c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531265, "uuid": "38ccb89e-e2c3-4a70-a5c4-53777483d8d6", "comment": "Malware payload (RemcosRAT)", "value": "1a0b3222046f0838c8a536e376b898b6c97cdb821aaebae4f9ed0dc9eeb23b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531265, "uuid": "30bd4f62-0c96-4a07-a4a5-4d2b0eb026c0", "comment": "Malware payload (RemcosRAT)", "value": "5998e3797d80bc190ea7dacea5ebff4bdfca774d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531265, "uuid": "664caf13-cfd9-46ec-9467-29f5aae5b2a7", "comment": "Malware payload (RemcosRAT)", "value": "612c06453962b46eb35b4c09c8e271d884f8159c5d19b7671c1dd319f626b9d0ad92fc3a1a2af90b843f1530b9132211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531265, "uuid": "c8bf1e90-4022-466b-a2c5-e8d5d6ae109c", "value": "T1EA34129277D4C4A3EED346318FF3B7B6D4B663911922501F2E741F826B22383971A369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531265, "uuid": "9ccdc491-c76a-4375-b778-33fb4add4f6e", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531265, "uuid": "3c8e4f98-5980-4153-ae0d-816ff52376ec", "value": "6144:i1kalCH9IWq8IC1CPWdM1DbpzZreOo0RyZ+XzWtf:i1oH9IWq8IC8Pk8pNKOo9+je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680531265, "uuid": "70cd09af-9b4e-4ffa-b6a2-2636112d13ce", "value": 234568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680531265, "uuid": "9fa17d8d-7826-4584-b116-b7f6a43e58e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531265, "uuid": "52a65c15-27c1-4481-b23a-274d7748ae18", "value": "Guisarme1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe168360-d255-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680550229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550229, "uuid": "ed426ea6-057e-4bc2-8f5b-3971e790ba07", "comment": "Malware payload (RedLineStealer)", "value": "6d4ebc5e271bb681d1f19472a1e2abe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550229, "uuid": "aa442efa-e307-4906-a1d2-3755fccffd3c", "comment": "Malware payload (RedLineStealer)", "value": "1aa0127dd78187c2d2d18f1d7b5787355dd495ff1e13d60022f7c5503e1e67e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550229, "uuid": "313e9547-ac6b-43e2-9fcb-abefd582074e", "comment": "Malware payload (RedLineStealer)", "value": "53a3898096d8a871fc759fa9c698e6ce3937f1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550229, "uuid": "d77ac1d2-b376-48c9-9f60-b15e36d1331a", "comment": "Malware payload (RedLineStealer)", "value": "966c9cb1aac50948120ca6c8a5c56d4e3aee22b80111d149f0cff59e347897fa3193d6b5c63afc4cfd1732a33919d828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550229, "uuid": "b8be29d2-4f90-4ea3-aa06-12cf5ed09536", "value": "T145554A4A2C7140B2C9328431F990FE2429ACF4586BB3F67E2A703B7DE5AC991C5B1D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550229, "uuid": "f742c323-23e5-4b94-86a9-002ad80b5a63", "value": "5131925e2a63e384d473ce1212d177ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550229, "uuid": "ec4b87b3-e521-437d-b43d-dcd3f810811f", "value": "6144:Mt6Lj3Pa2pYpDa9Lc0AOMFQ4nFzuU/Hff:Mt6Lj3C2ZieKhTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680550229, "uuid": "bfd0a5e5-e684-4ee2-8de4-f87715ffd3d9", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680550229, "uuid": "44e8ee7f-8e30-4056-b8df-4eb513d0ef74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550229, "uuid": "bdb3f1cb-2c39-4fd5-bf60-45b227c63c23", "value": "FiveM Mod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fbbb8f-d265-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680556767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680556767, "uuid": "ea4a57ce-5539-4356-b87d-744dd421981b", "comment": "Malware payload", "value": "b1f1f3b46d0420b827373f1672438dc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680556767, "uuid": "1cc5cbd2-7dc0-40d7-b7d3-53041f86e37d", "comment": "Malware payload", "value": "1be73cff2b36af6e455461e349148ceecf429aa7f7ebb182bdc7f0e40e1fbaff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680556767, "uuid": "d50fe758-e189-4f08-b8ef-364ad635ce52", "comment": "Malware payload", "value": "eacbe1df71373bc8330863ad865a5aaf9f34d73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680556767, "uuid": "7ec1dbf4-f302-4e93-9588-39a20b097c59", "comment": "Malware payload", "value": "3833047d5ebc998daa0d476b8b40e48eadbc6908ed1d11ae4636412c19bf9dbe0b7724ad323474e6f63e2c5e3ce061ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680556767, "uuid": "a23836a9-8cd5-4d55-a592-eea39f5ba8be", "value": "T1F706F143C2720256F64B96B2F4E348C34F95BD8E158C0F12A8C27C29D53B156B59AFEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680556767, "uuid": "b1067eb5-c1b5-4f2a-85e0-5bc7df10b7a5", "value": "c53fb5f7392e47877643ff46a44b6668", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680556767, "uuid": "431f501f-d152-42cd-9b76-07249490f512", "value": "98304:bKWSbsRwVl3FpaIwuhPr8v2+Uu/g+DZ9SuOd0G+tuV:ZSwM3vaItj8uf0Dauu+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680556767, "uuid": "8573cd7c-c77c-42d8-b028-3a5912abbcb1", "value": 3707328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680556767, "uuid": "be5860b3-ffc5-4f03-99b0-0adec63e4fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680556767, "uuid": "d8f5cce4-69e7-423e-9a57-47d7434a1dff", "value": "Clip1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f069ff-d1e9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680503637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503637, "uuid": "3641b83b-0f4e-4b1f-ba16-8e00b9ec1968", "comment": "Malware payload", "value": "ff41b1f3c1c3f1496a95c15b99ac196e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503637, "uuid": "6619f8b1-2415-4beb-af49-139292b44326", "comment": "Malware payload", "value": "1c03995a1bf9cef2c90a2553f68b97a3008e241662cf9741833a13788972be8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503637, "uuid": "90d7bee9-546d-4f70-bdc1-c9ade21a02c9", "comment": "Malware payload", "value": "75a3baac463c8f20763eb50b2688b08db95e9927", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503637, "uuid": "2627be5a-988a-432d-a8a2-ea3b21c06649", "comment": "Malware payload", "value": "022eb5ca691e3cf2eab0ef590837649c6530dc8e76fab2f9ed1377827cd0a2ec952c132a852d19fbcd160f7a0d0618dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503637, "uuid": "7e3e811e-01d5-4c51-89b1-c26d14bd157f", "value": "T164F4F163A147DD66C649493E4674F7DD822C8F625E1BB29970653222EEB3D0B2F0CCD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503637, "uuid": "1e080e81-5075-4f62-91f8-ce8e17057f65", "value": "12288:Ergtxmu8vcO92H6PAOU8WNR7uz6VdTqoHkd6/Djc2KMffJo1mJxRHHE6mRsc9gCr:EUtp83FYOKduGVI9dk0vMfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503637, "uuid": "8823fdd3-2267-4f42-a3e1-c01a8b682937", "value": 736859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503637, "uuid": "7e877778-43f8-48f7-9543-5127948ce7d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503637, "uuid": "c3b00a6e-ffe1-4a9a-8d80-a8680797c146", "value": "SecuriteInfo.com.Heur.8925.4383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4684715-d209-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680517437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517437, "uuid": "1a0e1011-b946-418a-9e14-f7699f8ed696", "comment": "Malware payload (AgentTesla)", "value": "6de6ecf40692dbd08e2ae442b942f868", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517437, "uuid": "137f2a46-b069-427c-baa4-9330efb854d8", "comment": "Malware payload (AgentTesla)", "value": "1c8980a32b195ccfe41474868abafb174d9f99b338b5f50ae4d071701f908266", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517437, "uuid": "e366bcef-87ab-4d78-8d8f-0a8024df1dad", "comment": "Malware payload (AgentTesla)", "value": "e0ad54c2844947b74bcbb6587efc27238f6eb584", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517437, "uuid": "f3381570-cbb8-4017-9c97-6c711b5186e3", "comment": "Malware payload (AgentTesla)", "value": "6eaa176fff1eb16f01b6a8a3a18a0179afe63a5f27413053f1ae120e68814df4856156ca1bf1ff5dfcac9e73dd8b4fb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517437, "uuid": "eb18db27-bd37-493c-a710-7ab04abe92d0", "value": "T19FB419411EB4412AFDEE4EB6542902D30BE6DC436215922FC7843FA6897274CFDCA6F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517437, "uuid": "981227d4-1121-47aa-aaed-36e688e8dd81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517437, "uuid": "4223e786-c07d-4499-ac99-19bdc670fcb4", "value": "12288:zDQawURHJFy9aMArqkmqkmq9vU1Z4elq:z1wNAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680517437, "uuid": "bacb72ee-a777-49d3-9ad3-a09140df72a2", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680517437, "uuid": "563ea340-0eb8-4b76-a107-308108367a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517437, "uuid": "607bc39f-420d-4fae-b08e-f7e24bfe549e", "value": "Account Statement_#216_03 April.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd05781-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680526556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526556, "uuid": "0e55d691-cc1c-442b-8412-8f2861675790", "comment": "Malware payload (AgentTesla)", "value": "f5b96b58b304b221cd3cb626eadbf0a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526556, "uuid": "c7054071-1770-40c6-8d88-f88b79802cba", "comment": "Malware payload (AgentTesla)", "value": "1d10e59b8eef51bc1c2031277be763d5fd5c018a41ba382e791e2af64b0303e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526556, "uuid": "48b8d090-8ddb-4b6c-b2b8-cb907463490e", "comment": "Malware payload (AgentTesla)", "value": "a082e9164f5fd0ec9a83140b304c392a8fdc9f25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526556, "uuid": "99d8042b-0da6-4a32-88f8-038b63b102e2", "comment": "Malware payload (AgentTesla)", "value": "de7412fde875e1de3549d57e5322cfd9c329f1303f5c47da2f8e52eee655c86c8cbc1a712a6d8111dfb8a84b5d510c88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526556, "uuid": "fa65ef96-9b9d-4dc1-aa00-0d706abada7e", "value": "T17BA4781069B04C98FCEEAEB5981A45C719E2EC0E6521D51FCB583F4A85B474CFCCAAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526556, "uuid": "ee687057-45e4-495b-8175-33ca81f277cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526556, "uuid": "4148d697-4d68-4c36-864f-523a23e226ed", "value": "3072:huguJUHFhpT8JygHiT1Q4GIJZgtWdtWOs4KyyqzFqq1X6sK0/yDWkARfLB+3VKtm:hqJihpIC7tWOpw0/yDRARfGMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526556, "uuid": "8254016a-207d-4f90-9098-6d54805b2de1", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526556, "uuid": "71bc9568-c262-41dc-aaf8-b9d623c9726d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526556, "uuid": "a66392dc-af91-44a1-b0c7-e5e7b0d2b5d4", "value": "Account Statement_03_April.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e644e6dc-d1ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680506380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506380, "uuid": "3823bfd9-f152-4192-b44a-3803ed7e6df7", "comment": "Malware payload (Formbook)", "value": "e827a30064936b58c6f789623317f491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506380, "uuid": "0c2a77d6-7394-45c7-9ea2-908778018958", "comment": "Malware payload (Formbook)", "value": "1d8e5ebbfd116c875add08d4a4b4a37ef0361b28f9e9cbfd0690bc81206338c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506380, "uuid": "715d23cc-4968-4ace-9798-f4d965a18aef", "comment": "Malware payload (Formbook)", "value": "79ce624d096ae63e68f3ac5c1096684130b7e609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506380, "uuid": "bbbfad5b-d6de-409f-ae0e-de10d2a1028d", "comment": "Malware payload (Formbook)", "value": "f1b96a9b797941fd7f3796dde5e7219ee1d76b68ac07443380d318b82df8ed60aa8b6a0c3c4716323149b2fe18867d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506380, "uuid": "c97c0f09-428a-430a-838f-8f8925be01b9", "value": "T18ED48E22B6D29837C1633A7C9D8F47C4883A7D011D34398AB9D93E5C9F7866C393A197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506380, "uuid": "31ccc402-f74b-4ca3-8720-5afdd0e009fa", "value": "cc0710b7e3b5a549c1f5298a73a5be6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506380, "uuid": "8327f466-b038-4099-81c1-9a9544f0dbc7", "value": "6144:WdE8uEDkEfQQvbaGrYddRe+51qjREwCZfc7RO5E4Z1eFEZpIismTxg9FromA2Rl:X8lDAjGrc7G2wCSOn1kOpIiteSmvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680506380, "uuid": "959f20b3-7880-4fa1-a348-dfd142f46a7d", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680506380, "uuid": "b3287a9b-bd08-4abe-82c3-86a6ac70e5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506380, "uuid": "d7c827d1-f4b9-4707-93eb-bca7336fce51", "value": "Nova narudzba u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c6f76b-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525569, "uuid": "310fa467-5f71-4f56-9246-49d89bd12f97", "comment": "Malware payload (Gafgyt)", "value": "792bfe7aedd030b23261c695a38c8e52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525569, "uuid": "229b7c14-eeaa-4564-95a4-a37bfd5796b1", "comment": "Malware payload (Gafgyt)", "value": "1e5018d80d427eb77b0575d82d9a5e634b92be98853e49abb9e9f1627d6d5d90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525569, "uuid": "51dc5b2b-8d1b-4504-a91b-619993481eb1", "comment": "Malware payload (Gafgyt)", "value": "66031543342b0b2cc54f59e7cd105311ec9d7d53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525569, "uuid": "a00c7de2-e054-4a06-919f-695319bf0f1d", "comment": "Malware payload (Gafgyt)", "value": "c1d69069550f76bf87536926e83e46d4c27a9666bb7cde4dde4abd27db4b43b7d2a19342b21e0b14d7d28b57746314ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525569, "uuid": "e7f16b92-cecb-44ed-b870-771da88540ca", "value": "T19AE3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525569, "uuid": "a094c6fb-c8e5-4b7a-8a9d-02f5cf46ba60", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hB:vY01ZkXAQT4Nw9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525569, "uuid": "fd225289-e1cf-4abd-b1c0-71e1883bb82f", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525569, "uuid": "5bfd185c-d6cf-424d-9ff9-f73bdaf13ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525569, "uuid": "368ec673-b2d9-40e5-a5a4-9e7c298af760", "value": "792bfe7aedd030b23261c695a38c8e52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b97ff6-d222-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680528287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528287, "uuid": "4b8ea03d-9f3c-47de-9396-32698b55c053", "comment": "Malware payload (Formbook)", "value": "f463680f1ca137f422fba9a817f8365e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528287, "uuid": "336d59f9-bdd9-4952-ac95-021c2418eb90", "comment": "Malware payload (Formbook)", "value": "1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528287, "uuid": "7ac699ce-5921-46f1-a1f9-da5825fdf8fb", "comment": "Malware payload (Formbook)", "value": "a7546db350deabb78a34c1c5ad9407080d5ff0d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528287, "uuid": "59091c0b-839f-430c-bb24-d6788fe9e2a1", "comment": "Malware payload (Formbook)", "value": "95e97a57d37607061a0b83ac5ba696fd4c86c5752594fc415bb349e71f73ee4e8b1335a9c4428daab30f4ed3e10c6ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528287, "uuid": "5a82e35d-4421-4d84-90fa-c3c805609eb1", "value": "T13EF402292BAA533AF57667FC95E42185977E13B32713D99C08F152CE4B337038AD062B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528287, "uuid": "63b8887f-788d-46ab-b8b4-61cde30d65b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528287, "uuid": "9ef6cb6a-e940-496b-a5c1-28819dd2da6d", "value": "12288:6XXmYMUnFW/Nfb1zBZ/0w93Vw5PFQnH8A6+gH6vjbP7Gob7X2S9NkDWihtf:6XXUhdBZ/0glXM6PP7G+YDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528287, "uuid": "d263e478-f051-4b10-a98b-99cef64fbc5b", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528287, "uuid": "a7e86641-f8f1-4814-af16-e0421b6eeacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528287, "uuid": "3f68b1a9-49b1-4868-917c-1f00b2ffcf89", "value": "1e525975cec93758de32a42e3385aa8a8b285a2556a0048c2f4bcf2106d2529b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0609d169-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496126, "uuid": "40e19cb8-ccbb-4308-9e3b-d67d4a4cd629", "comment": "Malware payload", "value": "e700ef6476808a59e616aaa28e30d0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496126, "uuid": "e529bdcd-ebf3-498b-beeb-3c6c121e65ec", "comment": "Malware payload", "value": "1f42b9d0c37c8e917e9e2eb053d6744bb8d150b7c5a15937a815571c95625e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496126, "uuid": "1c5bd9f1-89c0-42a1-91a2-9a820f732782", "comment": "Malware payload", "value": "008b2b4e92e2c98fa8594e8dea0c39d96b1a687d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496126, "uuid": "bf2dd977-2d92-4664-b8e0-228c19a55af3", "comment": "Malware payload", "value": "7ec953d0d68080eb18c737c9931e10db51bb3a6e66397a2ba3a03dcd22523acc2cd7fcc117fc582ae9b20ac47a61e877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496126, "uuid": "a70715d1-18d5-45ce-a4e6-de9317b704a5", "value": "T18ED3C507B7981286EA51C77C4C72BA26641768613C41BE2FEEC5BC983735D07ACB271B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496126, "uuid": "60cb9e13-0e31-44c2-bee9-540ca675d9b6", "value": "1536:qIMnEjiwglChe1Bu/N6Q6mPAMw/RtC+pTx/mKjUQ7mAV:qIC8hebu/N6Pf/mKjXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496126, "uuid": "9f150521-5811-45c0-8481-dcd9ac955af3", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496126, "uuid": "437fb736-8e71-4b72-adb3-a8856a222283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496126, "uuid": "34de5db3-b488-4837-bd46-05c562d010c4", "value": "SecuriteInfo.com.Trojan.Crypt.18411.16959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01942343-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680519311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519311, "uuid": "efd8427d-03b9-46a2-9fe6-25f516bbb562", "comment": "Malware payload (Loki)", "value": "0f576c29cbc1fbb37bb93202ec9cf46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519311, "uuid": "c5f5d1f7-6059-48e8-9067-4aea482f4f05", "comment": "Malware payload (Loki)", "value": "1f4ba3e37b0bb7a99563ad72e2314d7b3d1a0af6810576c2155facff5cda4944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519311, "uuid": "8bdab5df-78ad-4780-befc-e632642a0a65", "comment": "Malware payload (Loki)", "value": "6de171214594c9b7aab4abcabf30095672d14f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519311, "uuid": "3dd34eb0-42c2-495a-8f76-7f64edacf9b3", "comment": "Malware payload (Loki)", "value": "5d6d1626fd481eb436c09a0542327d2583f06a9c4a9b778aa5fb6ecbbbfa2e0d41db2b1c845e848cd4937a2dcfc30e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519311, "uuid": "964200ac-4aca-43c7-85ea-75962660154c", "value": "T111D412146769F732CD1E4BF7808351041377AE6BA403E77D4CDAA8E79823F588A92D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519311, "uuid": "94543949-7171-4543-90ed-177e4e4bb36b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519311, "uuid": "f0914a0a-f78c-4ccb-bff5-d92604c8a1ab", "value": "12288:T5CBWKdq1FbwwJLwrIizZA9Rsbko28XbRI+ZUyShvldBDja1OPjagD/Ub3:cfrpBzrz28PvS3rDbPjaggz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519311, "uuid": "0f4299fa-c7c7-4bc9-82fc-e57a532e2848", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519311, "uuid": "79099126-8eee-4628-b862-17278cd6114f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519311, "uuid": "377b0fea-d589-413f-b765-7a471aea47b2", "value": "671100727020782898pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0173c9ac-d24c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680545940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545940, "uuid": "c66724fc-073c-4bdf-bea9-f2663eb8a6b1", "comment": "Malware payload", "value": "868c2859a66ed53e679b86c20e6062a0", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545940, "uuid": "fa050576-73ff-4489-9b97-e410bdc2ee5e", "comment": "Malware payload", "value": "2152ce21b9e6a53b97eedc4bbf24351d9a31b603293e48c57cfd1f88a0bbfc5b", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545940, "uuid": "1e5798ed-60a2-4f21-b5f4-8437d773b729", "comment": "Malware payload", "value": "d1292e59e4f3005cf7af0d5b14325b1679ba2019", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545940, "uuid": "0ca097e1-48b9-4427-8f57-714081b4b978", "comment": "Malware payload", "value": "1eb9a71f183d27fd18fc799c5a01f0c77783c8c1fb7bdcc45f06261e2468c365d50d70235dbb2f35856f33199a07e26f", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545940, "uuid": "a4793d1e-dafe-4f52-8b75-bff82b0d2a3a", "value": "T19886236276875121D1FEC4350A37FFD660B52B1583B2A0FBA6C859CE35B2AD05372E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545940, "uuid": "0b1b22dc-a9e6-4ea4-9e11-0909a518728c", "value": "196608:50dxeh+m00OMftpNglCPbq5yKFr8vs32gjgEqr:50dch+m00Oa4v5yzk32gV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545940, "uuid": "f3509568-9627-454b-bc82-8a2ae7b166d6", "value": 8229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545940, "uuid": "db4bc1f6-8e7c-4df1-8aa7-6f5cf4cf1d72", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545940, "uuid": "2e303eac-535c-4982-bc37-155fefdc027c", "value": "AFWQ5EX5KXOEKJSKN2MI.MS#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed319765-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526578, "uuid": "b35fe916-28fd-458e-9c62-5f1bedf11e4d", "comment": "Malware payload (Gafgyt)", "value": "a7a382cb9245b51d41b12459526aa573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526578, "uuid": "dbed6929-c47d-44bc-959c-49c25a453ec4", "comment": "Malware payload (Gafgyt)", "value": "215b3e42ca3e7a97c886b465202e45810596b90c1072b54bfd4f4cb5a7706b58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526578, "uuid": "11ac1f7a-a2a9-4963-aacf-db54c06dbcdc", "comment": "Malware payload (Gafgyt)", "value": "712e0f83a9ec66db468186d7749f320a088c961c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526578, "uuid": "79df9ecb-4bb1-437a-90e1-f0cec12d25ec", "comment": "Malware payload (Gafgyt)", "value": "f92226d6f635996fe3a977b43dad02166d5b26a6a7fec40518dbf7a985ee43d8bf0b5274c2daed5a950d7ed61a0ccb41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526578, "uuid": "250e5d14-0327-4a9e-b68c-3c5f23388b4a", "value": "T1F5C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526578, "uuid": "6fb65a0d-4497-48f6-a85a-7288918c3736", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAgRdc0sfm7ypwYujl3IdnuW:ZP0DNPAd5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526578, "uuid": "54744662-e93a-46d5-92ca-916509d963b7", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526578, "uuid": "3d79684f-1e19-4a0c-916b-7c84cb02e21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526578, "uuid": "08049936-8457-403d-8be2-bc46af9dce17", "value": "a7a382cb9245b51d41b12459526aa573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77614cdd-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524663, "uuid": "39db811b-44d7-42f2-b587-84c46a2130de", "comment": "Malware payload (SnakeKeylogger)", "value": "fae8a94e9d180cb6ebd19baaff00ed22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524663, "uuid": "28c154f2-384e-4081-a061-2192eb241163", "comment": "Malware payload (SnakeKeylogger)", "value": "218837a31e5d0be80334b33216d047700a3f0983d847ea6019f5a5e638e69f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524663, "uuid": "312c7b01-fc3f-4ccb-81a3-001391a401d4", "comment": "Malware payload (SnakeKeylogger)", "value": "8585bdd94acff8528e2711b2618579001e1581e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524663, "uuid": "8f124cb7-6217-44a0-803c-f2b631b68871", "comment": "Malware payload (SnakeKeylogger)", "value": "1d0caeca9c21aecc129af4f78aa39f79a0e2e93c746043e267fc681e31be401e7ed831cd2bfae04efba4b8672045252f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524663, "uuid": "8c09c238-fa23-439b-be9d-a7c4e4da0ca8", "value": "T18005183EFDF49104EA0F1EB16732300592FC1492DA2AFD6D96853EA307DB526A9E3741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524663, "uuid": "fd07c023-1412-4a71-aecf-688fe0399b8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524663, "uuid": "b687c666-f0cd-42ae-b00f-a2c24f89e873", "value": "12288:l5CBWKdq1FbwwJLwrb53qOYfm+E9myYyG8ZFTOwl59+ay2j+DpfwPfdM7m3St5:Ofrpx3qOYfXEkYlvSwl59SDpfiIm3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524663, "uuid": "593d3bc4-ab22-4bbd-99ee-1b296f176a41", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524663, "uuid": "a3def680-8726-4829-8da0-259330d57a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524663, "uuid": "40c54952-a59c-4423-bdcb-aecd823daf67", "value": "Drawing.img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72a0490-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526568, "uuid": "da7d19b3-f6aa-480a-a9e1-4ef67bc32928", "comment": "Malware payload (Gafgyt)", "value": "923b4cf4458ec6a5e643bb491a004c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526568, "uuid": "9f8c7d8a-463b-4ab4-9828-b9cde646e0c6", "comment": "Malware payload (Gafgyt)", "value": "22a6f36244cc0057481622c675a421222a398cae376273bee2b6e390640064ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526568, "uuid": "5ba69b24-8a0f-44bc-b930-7dd540dabe1c", "comment": "Malware payload (Gafgyt)", "value": "3dd6bb042cee61c21f84908f9f46fce9d710b037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526568, "uuid": "a2c3c9be-7f6e-4baa-b2ce-04943a03b1f1", "comment": "Malware payload (Gafgyt)", "value": "54c915678ae6ffbe4ef56cec96c7e153ce314cbb262051fe4f0b286c63c3e0add05f820fc681105f313dafc0fd3af6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526568, "uuid": "f9a5c39c-8150-4e70-b316-2ae3ceb1cacd", "value": "T1E3C3FA45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526568, "uuid": "a0052ac4-0426-4b89-a9d1-44c0088b75d9", "value": "3072:hQrFRNfuLrGhEPOD0Sg3gNlmBoHQuQekQnYW:IFzuaEGQSg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526568, "uuid": "7e243e5f-2483-4541-871d-9a52bc7a9889", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526568, "uuid": "fbc067f1-6397-40b8-898b-5ebaf24920ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526568, "uuid": "f6dcbf35-00a0-4717-9443-133bf29d98cb", "value": "923b4cf4458ec6a5e643bb491a004c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261be974-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525815, "uuid": "8741d0bd-162e-42c3-b195-d4c021d945f2", "comment": "Malware payload", "value": "5b1fce8172d4b839f58f8a2294981f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525815, "uuid": "3a0667b9-cfb7-4f69-873e-b22554f732db", "comment": "Malware payload", "value": "23344278db22ed91a785dfaf1df94a405724541404f76a15ce15072307847158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525815, "uuid": "0d054cda-af7a-4b16-81e4-ac4c466a6215", "comment": "Malware payload", "value": "85684c922c94404f688524db47a69bc8c8641daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525815, "uuid": "202633ed-0d07-4ea0-9865-57c3158a8d1e", "comment": "Malware payload", "value": "575fbbab8182e7fb55f910b70e4d15eada9927e214da18803c8dd47561ac828372d8718e00f7a9ef31469184aea46b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525815, "uuid": "ec7da557-3859-47b3-b1b0-8ae1eddabaf9", "value": "T1B3B533AA2C586D44F456FC7C9424AA621F2DC239CC78DB5F3599A011FDE7EA360863C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525815, "uuid": "a9f611d6-d8db-4d4e-8a63-1a447a3897ad", "value": "49152:FjeKUyNL/dgCNkoVsemmIQ/RCLxnnLFeMtpzdIbzDYdHm:nUyJF2oYGCLxnJ7rzdIzYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525815, "uuid": "64281d19-ebd0-4ca1-bd3d-800bd8d35a07", "value": 2473679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525815, "uuid": "0852fa90-f5ab-4f3f-a959-5d4044f8ac96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525815, "uuid": "d9c91bc2-8b54-4279-9bc1-af7eeb768055", "value": "5b1fce8172d4b839f58f8a2294981f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41659ad5-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525002, "uuid": "4b951aff-b892-4118-95d2-f5405fd19e4d", "comment": "Malware payload (Gafgyt)", "value": "026010121b4333174fa485ebf2ffafec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525002, "uuid": "9f551d47-74b5-4962-98f7-c93283461bfb", "comment": "Malware payload (Gafgyt)", "value": "23731ca4756308a7a8f89181f7c0385a3b91e6055586be24807356735a94b6f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525002, "uuid": "3ac549ff-675f-4362-8f3c-bb2145d7ace2", "comment": "Malware payload (Gafgyt)", "value": "0ae410f6ab4153b821219633674fa30ca4374dc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525002, "uuid": "70246514-45e6-414a-8582-a6c3a4b4382a", "comment": "Malware payload (Gafgyt)", "value": "abcec55a4afe9a7768930d9d79bf059fa1e621545261f358b252d1a4d1353f747c2f4403340e5ea6c90f2903c704791b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525002, "uuid": "f0132db0-4bb6-419f-b2d8-f83a8ecf7d4c", "value": "T1EFD31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525002, "uuid": "030bcf72-92ba-4a5b-a270-34c327c95c9c", "value": "3072:Sdf+fvEqa9FazYA7IboRhee391CErktmCQA9FX9aH:ifWEqa9FaNhee3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525002, "uuid": "7fbb2c8d-f061-4b6c-a593-9defc8ef3ccd", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525002, "uuid": "4d3c4eae-3507-4619-98e9-d0d4de2a90dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525002, "uuid": "1f5d6d63-6b6c-4d1e-b3e2-f64e95e805ac", "value": "026010121b4333174fa485ebf2ffafec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0f3af7-d260-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680554678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554678, "uuid": "4603739b-b7b0-4b6f-b873-c500e5b8bc10", "comment": "Malware payload", "value": "10d1ed59b70c000cc8c3cf900fe7fe43", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554678, "uuid": "ea753e8c-647e-4c52-ae7d-906dff6bd079", "comment": "Malware payload", "value": "2415042aad0dfc1c268dc8212db9e5f83268e2fc21af4986df0e37677a970f8c", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554678, "uuid": "b6b15a8e-80d0-43fd-ae88-31679ece289c", "comment": "Malware payload", "value": "65b2be5f5ac11b0004cd8d804aaf1e10fc05fd98", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554678, "uuid": "3f45f6b2-1655-4b4c-a756-87480b5d950b", "comment": "Malware payload", "value": "fe463f22ed4ed9545e8908bf917d6696c76391573f22099cf8ed45df123a4eedebd26b072ceb45605c5da901869b7fff", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680554678, "uuid": "6f41dc9f-3b94-49c9-b4d7-d38f71bce12d", "value": "T16011ADF65B2E5012C9B5CB421D47A29ECF6041A254C40610F8FD4E61EE3A166639FACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680554678, "uuid": "f2992c86-7ab7-4c00-bd9b-e9d11de893b9", "value": "24:DOVtyyq9KJfeFTxnswvpdPNuR71q2z8JAhc:DOVtyyq9KVeFXFMqcrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680554678, "uuid": "9a9f912d-2947-44f5-9b0f-f9498e155c2f", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680554678, "uuid": "ade99d5e-5d76-4335-9a48-8c12ca8f4c3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680554678, "uuid": "16161001-f24a-4fc4-aa63-fed3f88aa877", "value": "NmZdffZW.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5424ca3b-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680533623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533623, "uuid": "0d4db9dc-b636-4298-b6a1-9b0f51f35e45", "comment": "Malware payload (Rhadamanthys)", "value": "c8509c1d5a79dbb9fbb1936f80247c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533623, "uuid": "5e780ad3-d5e3-4041-ba68-5ec4252b13fa", "comment": "Malware payload (Rhadamanthys)", "value": "241d5983fba08287582d2a8b2a56302498aa911f8a980319bac5eddca6e85859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533623, "uuid": "b6fd459b-3e15-4894-ac48-56b2daa615f6", "comment": "Malware payload (Rhadamanthys)", "value": "6dc5a8de2a6eb5578998f9ef42205bc574279f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533623, "uuid": "7001c916-a446-4a44-ba4d-9374e89d31a9", "comment": "Malware payload (Rhadamanthys)", "value": "bbdf05bfc8ebe8bd2962069b838a6b34943d655ce9f111fbcbe37e5c2a97774f6229028741717daefa5f29080aeb3dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533623, "uuid": "7e94fbc9-7dca-48c1-bf73-a45a5aedca53", "value": "T1F044E0207AA1C872C562D6745A20CBB0973FB8729B96C5D77F441B6E0D302D0AA3EF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533623, "uuid": "fbb59a85-cc49-44d0-8f32-fa962d9cd95e", "value": "bb60398211b18fadc0393d4c1e0d3fbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533623, "uuid": "53cd20c1-b17f-4482-86ed-68fb64d0a66b", "value": "3072:dykjEgsu9Y9Afi9MByMYB1QytK50CzCELmnrV1hiAioug0JcZfQ8ec81a9YFUA5G:Djcu9I9SYBCss0tRVfUchY1KYFuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533623, "uuid": "a406be80-729b-4ded-8ba2-f4565a42aea7", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533623, "uuid": "5b70eb48-c79d-45b6-aae8-ca8e64509710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533623, "uuid": "b9d62269-4c0b-47ea-8cf1-52adb453076a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23623634-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525810, "uuid": "62f99d7f-6f97-4691-b9da-f9f53b236db4", "comment": "Malware payload", "value": "e3f3a908eb0831af90a16f3aebc6a8a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525810, "uuid": "1ecba75d-56e3-4de9-9247-9918281c4ed8", "comment": "Malware payload", "value": "244d389ab5a7afc8cfe334f30e03cc42aa8f8e5bb527cdc0a565864b4e106beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525810, "uuid": "b8106a76-e89d-479b-b456-67b1a9b468d8", "comment": "Malware payload", "value": "250a099e33ff1e5d1f7fa38b69dcb65e5ea163ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525810, "uuid": "773720cf-8be0-4a74-a405-ff70874d218f", "comment": "Malware payload", "value": "51dcb3edd95170003f0729b1016c1a686d66b6e40ed3840e663d60eed55ff34d755d020b974e340771a806751c41d374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525810, "uuid": "79f68c48-e24b-43b5-a206-dc81e3741631", "value": "T11DE46C1F52A212B9C0FED16DC60B9A17E7B13449433166EF1AE049E62F27AF1967F310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525810, "uuid": "1910c56c-100d-4ac6-99b0-06cbbf3b547c", "value": "12288:WbawWVgs5fesY2u6/92YM+N/cNSL6gn+hzNkZJS+sjwkwXw6aZG:W6OsVesYH6/92YM+RaStQzZEXw6aZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525810, "uuid": "1fab0283-e062-4ba1-a0dc-94b2d28617bf", "value": 677612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525810, "uuid": "93a665a2-0445-4d9b-a766-88a1ae12f9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525810, "uuid": "72c83739-f407-45e4-bce7-eaf69e7d482c", "value": "e3f3a908eb0831af90a16f3aebc6a8a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfc0804-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524670, "uuid": "868ce134-6f81-4e3d-b18f-04542a13e470", "comment": "Malware payload (SnakeKeylogger)", "value": "b785c92842f73d91e6f3c8f1c393aba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524670, "uuid": "60b3c71e-3341-4c96-858f-ca1e24dc4d92", "comment": "Malware payload (SnakeKeylogger)", "value": "24740eec512c214af4e012f2ec3bc79fdfd9912abd32b6d54b7e9ca1115407d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524670, "uuid": "c893536e-2337-47e7-8e74-e5b13bcbc0e3", "comment": "Malware payload (SnakeKeylogger)", "value": "3872d5bdd7050b29a68f4fa1f7a3181ff5fd62ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524670, "uuid": "2b5a661c-22b3-46f1-91fb-1cc321671bb6", "comment": "Malware payload (SnakeKeylogger)", "value": "99e07b0fd7e494af6f68ca9c1ec7bc31123ad54bad01f28f2fc9f9c3dc5ff1d3dc5b5b360df87f7a3f5b37abd1257d13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524670, "uuid": "df2340fb-c8ed-4e38-be38-9d20e8efdf14", "value": "T163155DD1B150889BEC6B05F2BD2BA53015A7BE9D54A4C10C5A9DBB1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524670, "uuid": "5cc6c37f-6a0f-4fbf-afc9-e35fe2041e98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524670, "uuid": "9ca259bf-ce78-4b80-bab1-97faedef0a8e", "value": "12288:PJtzLwr4rFBuzujDw0+wex5ylet/qbShPCkqd3k:waFB4ujDw0+Xdt/qbShNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524670, "uuid": "ea623315-639c-4c33-8598-e56959e00f6c", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524670, "uuid": "d0d452e6-2ec8-40de-88d5-c260a76b7cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524670, "uuid": "2397028d-2a8f-4e46-89a6-9ee1e418f859", "value": "PO-230403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff93e897-d251-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680548514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548514, "uuid": "775f4039-6607-4631-b8ce-8cf94189798c", "comment": "Malware payload", "value": "e0d2634fe2b085685f0b71e66ac91ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548514, "uuid": "29c675d3-28da-4a7a-9bf6-fbb3ea30f3bb", "comment": "Malware payload", "value": "24c485ecb00d9d6ed8c12fb7a3162169cb1b666ab9a90eb3c1bcdf8dd8c40df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548514, "uuid": "08c1d83f-42f6-4f5f-8eec-dd4f6d8b4ed0", "comment": "Malware payload", "value": "c03d6b2218ffff1957a91f64d15ee1cbb57726fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548514, "uuid": "4dee22f7-bb28-472f-b036-c05ee7b1e038", "comment": "Malware payload", "value": "e20b4a58c2b60de5c8dc3e25f4d37df2f34ce2caa8572b5e99565180ab190d3b4d0ed9c5131df25b8c86d1fc9a01815d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548514, "uuid": "35cb5ec7-b8ab-4ab8-9687-feda56bd0e14", "value": "T110462847F98445E4C4AED130CA659212BBB03C991F3063D73B21B7B92B77BD86A7A350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548514, "uuid": "5507fdae-4fd7-4a97-9df6-87ab16b04d5b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548514, "uuid": "d28d0ff8-5d7d-4a7a-b929-2e1fd54e6256", "value": "49152:pyWMOEmrU4VWLP6zev05oej0EL9gCegK/efy5d8A45EG273LCV0UOQJUh9q101GF:Eq6PQn4/9GEp32VLV+h9sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680548514, "uuid": "0ef13e8d-db44-4cd3-8f23-92f233dc2fb8", "value": 5680128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680548514, "uuid": "32bdb28e-b300-4c84-ab19-ac585e976981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548514, "uuid": "b77c3cbe-1fd1-44aa-990d-8b6f5dbbb600", "value": "1bz7KfahvU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6651e7-d202-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1680514387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514387, "uuid": "5ed1a60f-a57b-459f-bad1-cffbf8bed6c9", "comment": "Malware payload (Gozi)", "value": "541be41ee128346374d431f10d6cc20b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514387, "uuid": "75c5ca1e-b6ae-4898-a622-4fbadade57d5", "comment": "Malware payload (Gozi)", "value": "24cdbf7a48cec89af865d7218234edd773ee1029b3987cc8f1ad67aa834bcacc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514387, "uuid": "a7188fc0-017c-4fc9-b365-76a3c2b48839", "comment": "Malware payload (Gozi)", "value": "00e7745e6ad74bf7e4bd2455c10aa7d7b833a151", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514387, "uuid": "39a6da1f-98f0-432f-9a7f-cd3d47f04566", "comment": "Malware payload (Gozi)", "value": "5621fa3932bb231dcf124fd8a38128da776e87f2756375c303eda3925836d3c1682cd81645aa4cfe3c108d3c2b25927d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514387, "uuid": "519d9a18-27af-4afa-b4bd-8d54ed3a8033", "value": "T1CC542A5382E1BC85E92A8B739E1FC6F87E1EFD508E09776922289F1F04711B6D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514387, "uuid": "2acda2e1-c45b-4a3a-8f1e-af1fb3f82706", "value": "936983a4f2f646ba7a7e331c33b74850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514387, "uuid": "0bea632a-4da5-4beb-83ef-a7571209d46f", "value": "3072:Ub+8iSpLLS0ox73fkUWSSMYVmbvt8J1/0shaQ4Zp0GIhzEqovB+qcNlfb:c+8hLlw32IYsvtessMIOcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680514387, "uuid": "5b71fdf2-fc0c-4659-931e-577d678964db", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680514387, "uuid": "4ef15f67-b21c-4101-83f1-71f4d37eb966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514387, "uuid": "92245bbc-070c-45be-925e-8338b6adc2ef", "value": "server.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1026637c-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LgoogLoader)", "timestamp": 1680533509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533509, "uuid": "104b2461-7c98-4d30-aaec-c4c79e04a63b", "comment": "Malware payload (LgoogLoader)", "value": "fe3b2746b0cae443a3dc46449a9bb685", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533509, "uuid": "6906ff6b-8ba2-47f0-989c-bb19be16ce5f", "comment": "Malware payload (LgoogLoader)", "value": "250bd8fd060f17996ada1d8758326e8af409c9494fc052968096cf0ada9859e9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533509, "uuid": "d9e6f564-f455-4422-9aae-229ae37bf5b9", "comment": "Malware payload (LgoogLoader)", "value": "3251fcc420d0fe1f3251659c20b33588523b6a53", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533509, "uuid": "9acdb099-6838-44f0-b7ac-0d7606e60502", "comment": "Malware payload (LgoogLoader)", "value": "47cd9fbaeccaa761cbcd65604f043d42c5d99fb5d1d117d4ec9982d2a3e168ad696c752559e4afc48d33603ad2c023ef", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533509, "uuid": "fc7b1351-f945-47de-a445-971b9b798843", "value": "T1D855493439EA502AB173EFA94FE479DAD96FB6333B075859105103864B13E81EEC253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533509, "uuid": "9608dda4-6f02-4701-b585-260fd5578813", "value": "24576:tdJ1roxcCfczRR/1v/17mCUOBUdGZsMgueBecqD:XvPlpSjBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533509, "uuid": "7d11fc53-9193-444c-a658-3a6da97d108b", "value": 1291624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533509, "uuid": "05230e29-ad44-4a25-ac8b-977a14145d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533509, "uuid": "9252919d-e888-4b39-8e6f-42d85d4586ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2731dc8b-d219-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680524099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524099, "uuid": "80cb5557-1e65-4293-a3b7-4a939a26a16f", "comment": "Malware payload (DCRat)", "value": "096b067623ca168a482806549a010f38", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524099, "uuid": "28559df7-bdd0-4e3e-8aee-913610ea7dab", "comment": "Malware payload (DCRat)", "value": "257475a3f62ecc48c670cb863501fcc956a3a0dfd02f8f9378fc542bb40efcde", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524099, "uuid": "038e9b93-3e6a-497d-9643-0d476aa4969b", "comment": "Malware payload (DCRat)", "value": "717d475a1ba3adf2c75186c3765eb4eee3d5be5c", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524099, "uuid": "6393fe37-608b-45b9-bf1f-afc7bd5a58f6", "comment": "Malware payload (DCRat)", "value": "8afa990948e769d141dd0c705886cbf931991565cb373f0e600eae6164e6ccc44d9332cf3e66399d4c883f0faec4bfe2", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524099, "uuid": "e08f3c90-f377-474e-a920-67fd07e45594", "value": "T1F3F4DFD623DB6414EB5B84BB41EFFFE95DA66C321BB272C1328883431C17062661D5BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524099, "uuid": "a59a0b72-1d6b-4e5f-a434-9044f54949cf", "value": "2ec1e43fddcd7fe383eaa8dbeb0dd6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524099, "uuid": "bd62ab66-73bd-4603-8125-2a5b73cf4855", "value": "12288:CLHh2VxkcmPP3YAaa7bPIDors3oGahZtu9G2hChh1Gi6DfFaOhTvoLmh80nJS:CLHh2/Kn3YAaa7k8LzZJh1oEvgjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524099, "uuid": "da882066-da8d-41c0-9e16-af8bb8218903", "value": 747680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524099, "uuid": "988a5e61-7b77-43e0-ad82-418d80b24666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524099, "uuid": "723faf2f-84d4-4510-9b81-60db173c8a29", "value": "096b067623ca168a482806549a010f38.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a810b3e4-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525603, "uuid": "d557280e-6e63-453c-a163-c3e6afa16945", "comment": "Malware payload (DanaBot)", "value": "0aac44324aec30f0098ce053ea0a0b44", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525603, "uuid": "933fe31c-a475-4ee6-8fe9-07c29ac3836e", "comment": "Malware payload (DanaBot)", "value": "2643aa7116d9448c7e483582391fa30e3f8b8e39e30cb9bf4b21c22fe756485b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525603, "uuid": "d8cc2501-4b81-4b02-89f7-f157b12651dc", "comment": "Malware payload (DanaBot)", "value": "51f1875f36c1840220c49606aa08f585b04d261c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525603, "uuid": "265d09e9-316a-430e-8c76-25fea6acc053", "comment": "Malware payload (DanaBot)", "value": "f3e16be69acccc6339444163ae0e99d2f5ad95cfccfaf80bae9e8e30640af06fe9885accb097e6592367df1af9a1f14e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525603, "uuid": "9da7b0ba-653b-4b1f-ac1e-5d49f96e765b", "value": "T11A3633503311C4A1C76DD9BB0CDED3E0966DA43887AED6EE758E9D4A1B133C1223B762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525603, "uuid": "ea1d16c0-2dd5-4958-af8e-589365db1a8d", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525603, "uuid": "2b78ba26-76d5-4faf-b8a6-7dc050f5f5a4", "value": "98304:M5IJrZvMQOlsIEhC4EllckyGK10JCj8jTA5+1aTXi4067mLs0i:AeZvMQvXFElBsuCgg+QSC/0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525603, "uuid": "edac07a1-e9c7-4f21-aa36-66177d40a42e", "value": 4900352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525603, "uuid": "360e0fe8-97fc-4625-bb11-f61178b2da19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525603, "uuid": "b8e5c530-e1df-4858-9ceb-bd17802e1803", "value": "0aac44324aec30f0098ce053ea0a0b44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8feab8-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680524703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524703, "uuid": "9dc0294f-1bc6-41ad-8c2f-7c2985c0f5ca", "comment": "Malware payload (AsyncRAT)", "value": "7b97ca6f925df64756ec0bd8ab3c1590", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524703, "uuid": "257e597b-54c5-4301-b6ce-b72bfca12e5b", "comment": "Malware payload (AsyncRAT)", "value": "27c9474b8299b3b07e74c0c0f2fbcabb229e6be771f162d0ad4377282e6563ce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524703, "uuid": "15f72ebe-e5ed-4bf6-92a0-a86b35850036", "comment": "Malware payload (AsyncRAT)", "value": "16db68f25d3db425e1a8137ec269a8f4ffb9c456", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524703, "uuid": "acd8881c-9203-4cc0-84f5-82933ead7b7e", "comment": "Malware payload (AsyncRAT)", "value": "579b02bec8d22d667a6e592f21cfaa1f18781b0c1c23d68b1a038356d1bdc17d40394a35309aa5ef1eb87ed715155507", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524703, "uuid": "8604d322-f09f-460b-a4fd-89165c699e06", "value": "T17ED56C5FA6B850E5E06BC279C4068A4BD3F2B8730B31C3DF10A1869E4FB76B14D39665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524703, "uuid": "8aed36be-628d-4fee-8320-7c2f7fbeb0ff", "value": "e6360e9b7a461166f83852282b66eb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524703, "uuid": "0af0c0f1-e674-4ada-9a91-3154e058df3b", "value": "49152:uYlCdR5hVPPM6rbTgfc7e/f9uJoIVnl2RS+GeYMydeIQITIkWrIAMDNt3USnhimJ:uYlOZTt8fiV8gNNSS8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524703, "uuid": "cdf0e9a7-58d0-4e45-bfc0-68ad8061cef7", "value": 2803200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524703, "uuid": "dd75b3ff-f162-47f1-be4e-7bf46e4cd479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524703, "uuid": "ea2ee302-51cc-4fef-9059-ca972731f564", "value": "7b97ca6f925df64756ec0bd8ab3c1590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f86a95c-d1e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680500115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500115, "uuid": "f818fa6b-6137-4111-a316-6f9715ccdb68", "comment": "Malware payload (NanoCore)", "value": "37af043c15037de0304fcf5ed28eb768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500115, "uuid": "67eb682b-2423-41b2-bbc1-a0e7a9ed2367", "comment": "Malware payload (NanoCore)", "value": "2876998fe70b951757cb3a2394b271009228b83c58ddf201ab1cc41b6b96e741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500115, "uuid": "75bec0cb-f27c-4ec4-b458-3a527e225613", "comment": "Malware payload (NanoCore)", "value": "345ea75b23dc54de90797821341f891639f8bd76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500115, "uuid": "eab862fc-5467-4560-82c0-c34d54aeba91", "comment": "Malware payload (NanoCore)", "value": "d6ecb48bb3ff09410e87d17d3d1e7433fb914b30d0b78850ed0bf60f89756972b026b184c0d43c35be4019d4a663e8e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500115, "uuid": "0c091227-dc0d-4729-a964-dca3b571e055", "value": "T1D2E4125932AC6A2BC67D05FF5112A10683BD9A36AE06D3D65CD87C9D99F2F80C402EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500115, "uuid": "413ef6f7-94ae-46b2-88e7-637af5ee4015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500115, "uuid": "a42d1596-340e-4a3d-b088-d7a6bcdf21f1", "value": "12288:QkEtzLwrZ9aV1SmSxiIUf1APyAXgwi6Aq1SRLdrVTrI3skclvztOa7ehitb++:XPaymki/f1WXgwi63SRLd9OsBvsfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680500115, "uuid": "b21c7ae3-44b1-44e1-91a5-b6987239e941", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680500115, "uuid": "6030fda0-886f-470d-a8cd-11b7bebd2f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500115, "uuid": "f1876789-ec90-405b-82ab-c91e5e03d050", "value": "FeDex#095KVkFEFzENS9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9aff724-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680519674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519674, "uuid": "4e053f2d-c07f-49bf-a9eb-a1c90cc19f9a", "comment": "Malware payload (Vidar)", "value": "defd00318625a7b161f5428e930b8f29", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519674, "uuid": "a6da7953-adf4-40c6-9837-8f4eed3a023a", "comment": "Malware payload (Vidar)", "value": "2919e8f90781b1e2c1f6d7fe3e39bb5903d2aef9f0e702f5a6bba8085179158b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519674, "uuid": "388164d4-246e-4ff0-a998-7b8ce472d34b", "comment": "Malware payload (Vidar)", "value": "8159e45d63ea27fb90fa243cec693d1e8061524a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519674, "uuid": "f13a5b24-0cb7-4d22-9219-98d94dafd893", "comment": "Malware payload (Vidar)", "value": "3825c7f7a46e706cc97d61866b3153cef3efe9a83aaff23349bfb89480f7b9e304ab3a5bbb8d64d686083cd36f6cdbe7", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519674, "uuid": "5a54bd84-b22f-4ac2-8e59-9052d892c5c7", "value": "T1159533F6E7826CDCADB2F039D3BC57AB40EC8D48AA794C06157B353140529B6739738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519674, "uuid": "028c8775-fac9-4ef4-9374-19546b206065", "value": "49152:xetwgC+HyP3u8Xxf0nVhznSOoW8KTcWbfmGEEWN:xwwgLSG8XCfLUumvEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519674, "uuid": "21041aff-7a83-4d57-b827-ddd7c8e0b71b", "value": 1925454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519674, "uuid": "eafa3154-b783-47e7-a050-4bdff66d2a2d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519674, "uuid": "fb56a404-37b9-49f7-96b0-22effce3d8fe", "value": "Loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a990d3-d24c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680546027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546027, "uuid": "648cf06e-01a1-46d5-a2bf-7b38e8f876d2", "comment": "Malware payload", "value": "f214af41dab7502064e2c69db18793b7", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546027, "uuid": "1743c4f2-93ae-4e82-ac2a-10e6384468a4", "comment": "Malware payload", "value": "29a6ddbd2969db11bdf93d2bab6bd68aaf42f79568fcff9d1d1bfc5718bb3578", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546027, "uuid": "aa0f6599-1c39-4001-809f-0bc675b68e7a", "comment": "Malware payload", "value": "35ddcdf33412e1f35d8140b44ccd8587d95b0b40", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546027, "uuid": "bbdae0df-38bc-421d-a0e0-90a1d3073d8d", "comment": "Malware payload", "value": "c8bc6823641de5307e38067ff635b6df3585a4d4f130d78e5c00e69b3c7b62319f5e9fada8fe6c22bf3f5df72eec532a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546027, "uuid": "0510ff0e-e62b-4038-938b-7473e738bdb3", "value": "T19825331AE577E5AD687060B9D2C411CACD7C2CB572ABA3FB972BFD0F0079AA1C214494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546027, "uuid": "c659caf0-da30-49ff-a75f-d6cc77efb64f", "value": "24576:MPaI0XIB78Hq2SN4pCz81oLnzBmTbq4s+EJZIT3o36fx7JswfqqQP:MmXIdPX4pC4eLz+iRZITY3Mb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680546027, "uuid": "5ce1cd41-02a0-4e95-9777-aded502ec1d1", "value": 996862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680546027, "uuid": "3ec2d90d-aef2-45d5-b95d-e751e3b4f5c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546027, "uuid": "18f039f3-b9bf-4c99-b07a-024d7d46ffe7", "value": "Shipping Documents PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1490769e-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496150, "uuid": "b415084b-3536-4a44-b192-86030fe5815b", "comment": "Malware payload", "value": "e04766a80d557fbd555a1e856fba3f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496150, "uuid": "bb37ee95-73e8-41cb-b484-8333cfb75eb4", "comment": "Malware payload", "value": "29f5c8c508366d86ad98669b3be51920ec72d88b466869185a1d51e3499fa02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496150, "uuid": "2f97e4cd-e4ff-4fa9-987e-87c18479c919", "comment": "Malware payload", "value": "074d2e7e7092b9316b2f17ae022562cb7e5bf2b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496150, "uuid": "9a6e1010-41a0-44ee-991f-18cdc8327fbd", "comment": "Malware payload", "value": "68ec12e5c30235f4c8906386cb44ff97f83e7e66988d0b61a6549b4a6d6d90bf113bf80c1b8b0384ede1cd316c65c2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496150, "uuid": "3cca245d-4fbf-4a66-a91f-c9763f8cb82a", "value": "T15123C517FF481C15E23585F11C65A6BAB9E7582010549E0311C8EEAA2EB1B43FEF933E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496150, "uuid": "327efb35-f31b-4c67-98ed-3c16cde4d89c", "value": "384:Y+T+qMAK9WqI/74eLpPtKQJ3bkR5cvBkTzGh8zF9rIg5txxVJoyLlF6h:Y+TKyZUM3KaubrN5PxVJFLlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496150, "uuid": "93214c03-12bc-4daf-9229-a0a89b9a7b89", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496150, "uuid": "0fc78064-6b3f-4f10-85e8-dbf9cd521e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496150, "uuid": "1693e972-e824-4a21-a268-9a78e6ddd700", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.VB.18960.969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702635dc-d1ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680504035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504035, "uuid": "1c3b5395-6de8-42fa-b190-51a9df1c95d1", "comment": "Malware payload (RemcosRAT)", "value": "1b0a703fa915336e899bb29afcf96858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504035, "uuid": "e009ff73-2c58-4e95-8c34-d9da628c7fdc", "comment": "Malware payload (RemcosRAT)", "value": "29fd451a165ea9920d326acf59e0546008354aa58e70106014d7c98d98973da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504035, "uuid": "e2dcefea-2ac8-477f-bc67-3cb4f4788597", "comment": "Malware payload (RemcosRAT)", "value": "b847e0cb101d69cd4d46c666152550c72dd04e40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504035, "uuid": "b0e834d6-044d-4abd-bb9f-fcea0ce51092", "comment": "Malware payload (RemcosRAT)", "value": "cfa0473842f8c5976de0648331878b8eed7dbdec3cb7484bf217f48c881c38b8bbfc38c37783ba6e817f764a02c38c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504035, "uuid": "05eefde4-d73c-4aeb-aa17-9f0554ed6cc5", "value": "T1DF34029763F8D427D7E3DD311E73E9768576F3012434062F2B60AF623926B92A809397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504035, "uuid": "29dbb3f5-312a-4ce9-a480-44d97f5111ac", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504035, "uuid": "a38df46a-ce90-42c9-afdc-43dfcc872db4", "value": "6144:A1kalCH0kU9MznAhKED4KlrBs1wfCTxuIfENY8NWt63:A1oH0kU9MzAfDXlrByfktNYSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680504035, "uuid": "f3f62267-1baa-4717-afb5-85a9186cc56b", "value": 231824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680504035, "uuid": "e2022ccc-f210-42a0-b79a-1fadc9280c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504035, "uuid": "3611586f-1371-46bb-bb60-7e25bd8de69e", "value": "Spaebook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12039d7-d236-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680536866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536866, "uuid": "cd25d36c-5ce2-496a-8e8f-94c5fcd6d70f", "comment": "Malware payload (AgentTesla)", "value": "247f3b0bca91d926a4c89fb8f730e5e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536866, "uuid": "a2c1679b-4b1a-41e4-b0ff-99bd4beb986e", "comment": "Malware payload (AgentTesla)", "value": "2a2c485b35334153b9fa9f373dce72eed4f1d2dd4c0652760b8185cbad5ba0aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536866, "uuid": "370aeff1-3c1a-4d22-a28c-2d502c7798ef", "comment": "Malware payload (AgentTesla)", "value": "82b18f874db86a8d3e4877c1904948592897761f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536866, "uuid": "21e94fa9-0cb4-4698-bc6d-b5cb09085157", "comment": "Malware payload (AgentTesla)", "value": "2911ed889b10e0ace65d4053a5f8ea249418b080eb6b121ce72757668a12929d566b735dff88c0869ec0bb1c896642e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536866, "uuid": "06a10b08-774b-412a-acf8-d9950b71608b", "value": "T1D4F42225327DB722CC2D8BF700B35A5513B6BE5A1092D7BE0CEA18CA6D32F944905C8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536866, "uuid": "595e3bda-9c04-4e08-8f50-158a8e04d468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536866, "uuid": "23886b70-a9db-40d2-93ad-e01eb16e146d", "value": "12288:45CBWKdq1FbwwJLwrRq1JsQT2aRtB55fSAAEwvfLZpV7I+OgEUDwwGXwRbqz:LfrpFcf2aRtBj2Tdpa9GUWbqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680536866, "uuid": "bb7e43e1-818c-4606-a9dc-ed97562763f9", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680536866, "uuid": "39756155-c342-4d01-982a-5160830c9120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536866, "uuid": "29aa44aa-6cd8-4048-97ad-6e51efecb1f6", "value": "Technical Datasheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0a8cee-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680526709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526709, "uuid": "070b8e22-45a8-40c1-b747-4fe23f7186e7", "comment": "Malware payload (Mirai)", "value": "787ad093f07dba42bb170b2d3442ea9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526709, "uuid": "1e80f0f3-c7b3-4840-b371-df97ccd17d7a", "comment": "Malware payload (Mirai)", "value": "2a3e8ca9e92302a3209a39701c9b974a71c35b6a25fc90f1febeb9a95854e414", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526709, "uuid": "7ce8b880-0e80-4d30-af91-4013a2853247", "comment": "Malware payload (Mirai)", "value": "48c0b01c17d1ce22d5296a3c94939212fe8da355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526709, "uuid": "5b7f93db-c75d-4bb6-8a97-4257ba40faee", "comment": "Malware payload (Mirai)", "value": "838333a40a531ec23f3bcb55e5b6e1fb10a3999911c7595203fe2acadd1b7460ffd9686d667596451b25d379552a2b3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526709, "uuid": "ee12121e-e0b1-48fa-bfc3-88bb2af8ab35", "value": "T1C582CF3061AB75A4CBE10435EEED8EC6571B0BF8D1FC36D227586B78894110651FD2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526709, "uuid": "3017a976-8bf1-4a0f-8f6a-9bd2d106faca", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaVthymdGUop5h5lb:2dV0P6+kom0tVAoNvm+to1Vts3Uoznlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526709, "uuid": "d9babf8a-4eba-4df0-aa66-948198377974", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526709, "uuid": "13d18787-219f-49c2-ad25-39be86284cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526709, "uuid": "5526fd18-557d-4b23-9004-3578594fd10d", "value": "787ad093f07dba42bb170b2d3442ea9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb6cce7-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496137, "uuid": "0cd85586-ba59-403e-b7e4-4028307bf65f", "comment": "Malware payload", "value": "64b182c66762b7f4121f27a7f5e21afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496137, "uuid": "f7ade053-e81d-4d55-a638-8f6d47a389f3", "comment": "Malware payload", "value": "2b1600f2b2b22fbba29da23b6f6ef0e4b7ed41e6731be78389686710e84d9c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496137, "uuid": "c33ce143-6bd8-41d5-aca9-e07283519bc3", "comment": "Malware payload", "value": "423b7ea0bee6089c00ad02256687033b1e60efe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496137, "uuid": "1a190372-24e9-44b8-9314-57238a3813f7", "comment": "Malware payload", "value": "bcf6c29246b95dcbd2fc7806184082693df4be79028ee324f13617592e92de76f5528802bceb4058a9474b91556c6521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496137, "uuid": "5bb61075-c004-4266-a13e-d3197ad6ecd5", "value": "T153943C10BBA0C039FCF601FAE6BA855CA9167AB19B3C60CB62D1628D17755F59C33393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496137, "uuid": "4e6d4328-21d7-47a0-a607-67610a3963ef", "value": "e353d85ea304de3f0851935b7754351b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496137, "uuid": "312a90c0-cc3a-420a-b6e8-0078fc56fd1d", "value": "6144:3Y3aPIlURpn8ysOUopKzh7grShXp6hRaD5qV+N5jNZtmuEZScaYgd:3Ymwsp8ysxYK9k4p6hKlN5x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496137, "uuid": "e4964ef7-4938-4045-9ab4-a85010966ee7", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496137, "uuid": "30d318bc-26e7-4bb2-802b-f521f17838f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496137, "uuid": "50352ea6-a33e-4e8d-b8c3-f757d9205927", "value": "SecuriteInfo.com.Gen.Malware.Heur.376.26331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0ea729-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501290, "uuid": "10b7c359-68ed-44f4-814c-b045437ec745", "comment": "Malware payload (AgentTesla)", "value": "5371c1f1d44a4ebb0e31b8f681342797", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501290, "uuid": "d09637ae-b7fd-4c22-b63f-e6a2f3ad42ad", "comment": "Malware payload (AgentTesla)", "value": "2b1725a1d4b74a010922cd83d4c187e2aca403af51ee7af7b3d7590c3bc25b4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501290, "uuid": "7d0f6180-a963-4552-aa6d-0a275b3484d2", "comment": "Malware payload (AgentTesla)", "value": "1315d693a9701578b3ab325c8b05b84189086e5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501290, "uuid": "b7a4cd5e-f942-45cd-bf94-785bcecf527e", "comment": "Malware payload (AgentTesla)", "value": "5b9cb4fe88708943b3f6ba32bbf5bca15287a98a85e2023af249e467f978ff35d2272abb3fae61bd6c84fe02bafd8642", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501290, "uuid": "01b58f6d-9550-4e5c-9bde-6ff1366cbc40", "value": "T105F34A2892897D51D32D4074CBB012480BB2B1478617E7AD1EA1AEF63F46FD7722FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501290, "uuid": "d0828155-699d-4127-82cd-5436fa4c5a93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501290, "uuid": "0834fefa-ea18-45c5-afc1-d62fed4e5063", "value": "3072:j28G1zo/o9Ex14SzkCDPBcciqUEClmKTpGoazzHnJp:jX/om3o0aqUvkPHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501290, "uuid": "54954c91-98de-470b-b15c-22517578cce1", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501290, "uuid": "c524f968-9d2a-42a5-908d-f6996a3538ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501290, "uuid": "ad976161-7f3f-4837-b92f-6c0bf267f6a1", "value": "2b1725a1d4b74a010922cd83d4c187e2aca403af51ee7af7b3d7590c3bc25b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab3c881-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496134, "uuid": "57f7a638-84ab-44c1-9697-fd9fa826cd4c", "comment": "Malware payload", "value": "96c49893f3871e7460bfa86ace150f2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496134, "uuid": "0f446e80-0ec5-4255-af13-ff89f64d683b", "comment": "Malware payload", "value": "2baaaa4d51dddb1a662101c016efb7425409fd714952fec11af76b973a2d9564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496134, "uuid": "7f6c5f5e-519c-478e-8e14-d8492f4d5fe9", "comment": "Malware payload", "value": "4a4e6b2f418169d2bc81fc1b01f625d75a9cdda9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496134, "uuid": "5c12761c-ed99-456e-8f62-b5f158423680", "comment": "Malware payload", "value": "83a96be4a2f5b8f991782e1e46e7afc150f7d3494236910c51ac8f8138987fe30b0da8a13912cc8f01c0ff745ffd2602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496134, "uuid": "de5866bc-11b7-4fbf-a4cf-a300f3928441", "value": "T1AE53E827FF141834F65102B0AD76A1659E6BFC364C50ED4642557FA8A8B2E03AAF072F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496134, "uuid": "64d6f9ce-c203-4da3-9ae3-3fa9de60c822", "value": "1536:T/32UnkpZzEB9Dr+FENEXmVwZXATnV74:rXjUcEXmVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496134, "uuid": "c422230a-c9a9-4b6b-acc4-87f065a3bd46", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496134, "uuid": "51c4e9c4-5d83-453b-8e56-8027c640dd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496134, "uuid": "509809ca-b7d8-459a-8f39-fe409fa0e406", "value": "SecuriteInfo.com.Trojan.Crypt.17979.27557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd49fce-d213-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680521667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521667, "uuid": "fd8c2261-6047-455c-ac26-fe2264a1a302", "comment": "Malware payload (Mirai)", "value": "ae7c1de20be7178247515bd9cf20a3df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521667, "uuid": "0a8a07a7-eae4-4889-89b1-c5a9666d4d90", "comment": "Malware payload (Mirai)", "value": "2ca2d571f9299c6bbdb7797efce58015475e5073a026b672284cc586a0738366", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521667, "uuid": "ea17e821-7b7a-4cc9-8100-6a70645ae897", "comment": "Malware payload (Mirai)", "value": "efc0be62aaf369870be2c34d7513ad81bf456686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521667, "uuid": "0e2f62bd-1196-454f-b6f7-a58b6cb6bf7e", "comment": "Malware payload (Mirai)", "value": "8949ce28b6a04c729973c85eb3cac0c72d18eaa763fb2a0aec7336fedda8a7cb65750b0871669aeefd6a547f29c502f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521667, "uuid": "ea5115f6-15f1-4663-96c6-f979d8dcf196", "value": "T1D1A2E015BF18868BC832693455D9EAD61292FC72F2ECCD592940C15FF0B33E92474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521667, "uuid": "22f27576-46c8-4463-8b0c-7cb91559fdc4", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKp:M98o08kxofBE+ZkXaqGbp2F2TWul0c5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521667, "uuid": "af592159-cf22-4d30-ba64-2decf74f1808", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521667, "uuid": "644868a4-3fc6-4518-8308-34183030a6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521667, "uuid": "92f3dd6b-d780-441e-a6dd-1c9557538e9c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f96d958-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680501323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501323, "uuid": "98c4a5e3-4cbc-4e85-bf38-0584094dd483", "comment": "Malware payload (RemcosRAT)", "value": "e2b2fdac800b3b22b418d9acc54defb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501323, "uuid": "7b21368b-c165-46fa-8aec-bde112b59a49", "comment": "Malware payload (RemcosRAT)", "value": "2cb1878faa0fc824a60b93e4b2dceb1737ef54369bcb3d2df6d68b120fa7a81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501323, "uuid": "b0a824ac-f05c-419e-83c5-84814514c6d8", "comment": "Malware payload (RemcosRAT)", "value": "172c00ce858a134fa932476e445fed004943a5e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501323, "uuid": "3b3b17b5-2ecc-47d1-a9ae-966bfee6e1bf", "comment": "Malware payload (RemcosRAT)", "value": "c376ce9c0ebbb29b17cc61808efad01ee718e0be9e855335cb90177afe1f0c888200bf9788ff7605d613273176510c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501323, "uuid": "79548385-7b94-424d-a524-74d16cad6774", "value": "T1C6B42316BFF5AC3FE1AD97B22A770A898375C4136435873F13019D11BAA26F0AB5D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501323, "uuid": "8ed3cc31-c31d-4869-9923-a531d20daece", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501323, "uuid": "ca0973e2-bc21-4cd6-a34e-37f15a2e5231", "value": "12288:BYqI7GB0simR+llpGs7c6Lrq1IyeslD1tZOsI/PgZSKJuppRV:BYqI/mR+tHq1IyvtZgwgKJuf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501323, "uuid": "ad6eb7a7-6ecb-4704-8ae3-6e5015d9d192", "value": 542957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501323, "uuid": "feff8f3d-bd9b-4578-a304-94262b93b863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501323, "uuid": "fcfd49dc-89eb-47a5-a34c-4284f48da624", "value": "RDG9090009980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d2760a-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680523477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523477, "uuid": "af3843eb-a5cd-4681-ab28-f05ce6523d05", "comment": "Malware payload (Guildma)", "value": "158314a6c690c2b12bf8553c8d690db2", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523477, "uuid": "4b3bd76b-78a2-467e-ae15-d46c683e44e6", "comment": "Malware payload (Guildma)", "value": "2dcca416a81264b6df52f04d6198c355c4bf1798f5aba02ba381587cb7748ef2", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523477, "uuid": "d13e4df6-4d35-4a28-a029-282cf3eeb399", "comment": "Malware payload (Guildma)", "value": "5d9ac07ca36149f060ae47a157e7445583470afb", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523477, "uuid": "da6ef5b3-8502-44e1-9300-18092578db60", "comment": "Malware payload (Guildma)", "value": "84473b730b216eec7e994fc65e8fe6f08f92cdcaa1d06c666865d38a3fa9a03d81ecae320ffc16859b5a6399f64f6c14", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523477, "uuid": "f0ad0abb-4970-4b41-b27f-d06d93350fda", "value": "T186F0ABCDA1212DC1C62C08719ADA1F054D2C3E8A6F0D108E968D23C80514C489D8D970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523477, "uuid": "6bd0c77c-48c4-4c97-8a86-a98ad1710dfe", "value": "12:8rflM8OBE6ZGzgud2JGjdvL7UOmAom7XzVPVd9JpHvy:8loGzhdWGRLgOFom7XzJ9rvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523477, "uuid": "e5009142-4911-4cb3-932b-4f889db7106c", "value": 483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523477, "uuid": "11b1cd29-6541-4861-b970-2d94d5faf030", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523477, "uuid": "87888844-7933-4e1e-aefd-b53cb642e2ac", "value": "Documento_Recebido_2023642.497390.24595.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275ad8c5-d1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501765, "uuid": "170cd8ed-cd1d-45db-a27b-210a090bff1e", "comment": "Malware payload (Formbook)", "value": "9fe061e76ac64a95a4b29a8cf483f623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501765, "uuid": "3cd77ace-968b-4ce2-9ed1-23b06c9441a1", "comment": "Malware payload (Formbook)", "value": "2e423af6933fc3a0ea48495c544378ced38053a65b5d386648e4e083d1b90198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501765, "uuid": "b6b5aa42-36d8-488b-a579-295f60694c2b", "comment": "Malware payload (Formbook)", "value": "20d69d1dc46191b90829468dcbf1fb5f97687d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501765, "uuid": "8010d5ee-b828-4557-a15c-8a1358eed2d9", "comment": "Malware payload (Formbook)", "value": "32aba45b6d238e8cff6e84a588e9c9616b32aeeaad97737b9d08f17da489e1b1739a3db83565ce08c8ae0581cb9ae1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501765, "uuid": "7c64cd9c-75de-4cf3-bcbe-1383cb7e2b87", "value": "T1D205D0AC3690B5DEC417C9368994DCB4AB20ACA69717C21395C72E9FBB4D5CB8F110F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501765, "uuid": "1df19d3a-8257-433e-863c-4c77c322b1b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501765, "uuid": "bd51c690-e042-4bd4-b62a-2a45470464e3", "value": "24576:BsPBYzimXH2oPa/JIGmU/xTn8toPhIcvTfbU7nSH6:AmPa/6U/xCoPh3TT4nSH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501765, "uuid": "98a74533-f7e6-4215-a6d7-b2367e3dbe79", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501765, "uuid": "3521ae36-66cb-4d87-bc6e-faa7514d06b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501765, "uuid": "297eb5eb-100f-4f61-a0ec-6c2f0e1529fd", "value": "FATURA DE PAGAMENTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac52756-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680524910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524910, "uuid": "d4261e66-3134-4c74-85e7-6a263ac96ce7", "comment": "Malware payload (RemcosRAT)", "value": "719e3c1a9d39bb9c2b64eee13015ac9f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524910, "uuid": "c714bebc-df93-4551-8129-63e28b7cd674", "comment": "Malware payload (RemcosRAT)", "value": "2e4c6cc30705e1398ea19d064bd7cfba58448798a81f3c89b86fa66750904a7b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524910, "uuid": "c4eae344-3644-4d14-a4e4-8c3c60f6cc82", "comment": "Malware payload (RemcosRAT)", "value": "7d479edf5dc249fd73f6b27280e01e2410c262ca", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524910, "uuid": "e8ddc92c-1f53-48b9-8308-8e466905cf20", "comment": "Malware payload (RemcosRAT)", "value": "8df3c0488500aa9ad153b4e825a51563716be4bdf7cd34fbc6442b835260f22a0e69f1f49bc8898cedde3a12359fd7d7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524910, "uuid": "a7ab13ec-40c9-4c0d-be92-88780d3ffaa4", "value": "T15A152210331D6B2BDA5F46FD44716086033E8A77A306E7EE5CD468797AE3B24091AEC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524910, "uuid": "30df3994-36bc-4e5c-80c2-1bf7ad2502b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524910, "uuid": "e28c55d3-14ac-4a9d-8b3c-8b596b4b09a5", "value": "24576:wxbHSd3/vVz+wypdSPhA4oS1VQYzyjv5Djii:wxTSd3n0wdpieVbyjBDjii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524910, "uuid": "71f9d7ea-49d9-40f2-9aef-912c3afe3bd2", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524910, "uuid": "cb315e4c-4e73-42a0-b2cc-225efb5ab588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524910, "uuid": "8c661944-b52f-4ad5-9989-5cc6af08f89c", "value": "DHL EXPRESS_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b7d9b8-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525432, "uuid": "aee0ca8b-3b9c-4395-8974-8fc92c36aef4", "comment": "Malware payload (DanaBot)", "value": "09e2a3bcfb19338b5c9103e863c471b9", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525432, "uuid": "80c70aca-35a4-48e6-895f-919b9d39b8ca", "comment": "Malware payload (DanaBot)", "value": "2e8ff0fd7db6032b3811141e96c6ec8a3243bf749a176e94ccb366356a6de130", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525432, "uuid": "0127863b-463d-4615-a46f-317bcc5d3c29", "comment": "Malware payload (DanaBot)", "value": "43783fe816e9c12d3c98c914382e884814302a0c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525432, "uuid": "71f3eb6e-d631-40bb-a936-be1b566da460", "comment": "Malware payload (DanaBot)", "value": "98f9f075253e1994b7dc7a0a4034c941999ef6b5d75e069c4c5ee9cfc5f744bd85e0de0a195fa2b4445bf03a15c7dbca", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525432, "uuid": "dd66f3ef-9b6d-4889-a83e-6211caa5f519", "value": "T12636330131D29870F921A2319F2A86F416ADFD50DD167E9E5B08BC3F5A73270D21AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525432, "uuid": "48a97b07-a83f-42ed-b89b-19b0bd065090", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525432, "uuid": "f8d019ee-224d-46a3-8202-5e2a0c390372", "value": "98304:dn5BBOhJkrdkZxri1G5EEix8k84DJhNzYej8Bt://OhJJi1cm84vWej8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525432, "uuid": "3f53e5b3-63a5-44cc-8b64-c297eea3ca93", "value": 4948480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525432, "uuid": "537bd667-c5e3-41d7-a476-a8b1aea2f0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525432, "uuid": "32559dc0-d7a0-402f-b281-a1a0766eab9e", "value": "09e2a3bcfb19338b5c9103e863c471b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e20d47b-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526741, "uuid": "307d6923-0695-4265-a4ee-0e0745e2fb1d", "comment": "Malware payload (Gafgyt)", "value": "1415cb35a79be9fb91b15bf5b3d180c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526741, "uuid": "7c9729a8-044d-4a31-822d-71062060a5fc", "comment": "Malware payload (Gafgyt)", "value": "2f9ffe915b4b79689664aa21cd7a0ea66589d10f847d6a9103b5260f808e0588", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526741, "uuid": "e311c55a-7e1f-4c1f-8663-4db3e02142dc", "comment": "Malware payload (Gafgyt)", "value": "738e830decfbdd775a405db0e7ba9d8ecdb1fa15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526741, "uuid": "a5c7d04f-2b31-4846-aaca-8e2f02e4c25b", "comment": "Malware payload (Gafgyt)", "value": "a95f008e4d4c9d1892617b0957e5954af1b905a65565eb86c35e38ab7bbdaaa6eb13bcba4e964773b05df7dd718c4cf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526741, "uuid": "162c66dc-c192-4409-9d85-1520dc3d4eba", "value": "T144C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526741, "uuid": "85adbdda-c0c2-4b00-b486-71b66a64e139", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAeRdc0sfm7ypwYujl3IdnuW:ZP0DNPA35sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526741, "uuid": "5497621a-a4c7-468b-bbe6-c35c0a29a0f0", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526741, "uuid": "495b5260-b63e-4cda-b560-53004e30d8ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526741, "uuid": "012a3ccb-2c19-46c9-9181-b117da92b2f6", "value": "1415cb35a79be9fb91b15bf5b3d180c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277f4de9-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525817, "uuid": "123f5da0-f55f-47f2-a496-f57819d021cb", "comment": "Malware payload (DanaBot)", "value": "0be1cc248da931b6f3306800c1765769", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525817, "uuid": "ae13faa5-3858-4c57-a9a1-8683e7978b44", "comment": "Malware payload (DanaBot)", "value": "3008bf9dc4f01b97568471d59c65eb096ba4ff1657d8a51e1772e62b461b2a0c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525817, "uuid": "26ff6686-d803-436a-9b8b-894780bbfa7e", "comment": "Malware payload (DanaBot)", "value": "b8d0ce7a87219567d02cd23a4bc5b0b5d4018add", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525817, "uuid": "5a5b8f36-6e6b-4891-a202-50c90f5ba74d", "comment": "Malware payload (DanaBot)", "value": "4ce24a7a6ac38a8ed3936a2de590efccddc2d5457a6bb190ff35041642d02e43348cdf6cacad2d14a2c69a2b2888180e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525817, "uuid": "49d8dc42-5d83-4aeb-b256-403884ffae44", "value": "T145363321371698BFC73905F391AD867897233031A439F643BA092A9FD937AD39736748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525817, "uuid": "efba9bbd-945d-4abe-a5f1-f613f662d36d", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525817, "uuid": "c1f00df1-a1a3-4f94-8348-9d26df6d3d80", "value": "98304:Tdyfaffo55a5rDrlvVA82X5Q8BaTYq9JiTxfFFh6Q0Gwlz1uTZ1u6PW:TAynI5qPhtkprBiBuoNlzE3BW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525817, "uuid": "ba4c172d-d7ee-4de7-88bf-f5dd954b4aff", "value": 4899840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525817, "uuid": "6c728a17-ea33-4bf5-9f23-66796ca17f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525817, "uuid": "c292b107-e0a5-42ab-a833-31ce798d8b42", "value": "0be1cc248da931b6f3306800c1765769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8ffe42-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501314, "uuid": "234a31af-4b6d-4b74-baf6-94941891c9d6", "comment": "Malware payload (AgentTesla)", "value": "6484dc4913b3adb16c159b7ea00ff294", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501314, "uuid": "16f39945-e6cb-454f-8acc-b1c05f4b051c", "comment": "Malware payload (AgentTesla)", "value": "30272b6380cb51f1ea1c8ba3c294fe504fb80179d4ac31cfa8eb641919137eca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501314, "uuid": "6eb2e2a0-4f46-49c7-9c41-28f4a0525c7d", "comment": "Malware payload (AgentTesla)", "value": "9870c0cfa3aa9afa49cc996cb2e8fa89486e3f23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501314, "uuid": "66d72770-1e63-4a21-9b06-939682f9dd07", "comment": "Malware payload (AgentTesla)", "value": "682301cb8865ddcfdc8b8751d894002d179051ab7d5c524c0fb10bf6313e21be3b99d4e5bc06c149b545e4081bac954d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501314, "uuid": "b7d0e231-e0fb-4d55-8194-951f9d458468", "value": "T1E935C4AC366432EFC467CC72DEA85C64FBA0747B631B8507906F11AD9A0D887DF111BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501314, "uuid": "a048a743-d71d-41a9-aeb3-bbd7d2888792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501314, "uuid": "c57da628-4702-4ced-b4c3-6556ad0f8766", "value": "12288:/VKgbTjDbjZniAWt1m8nF3p44ZUf8O6PiyywVjjZNaUXcEGQLZCD/EdptyW5QHqR:kuTjDvFiAWt1mIzDifD6PUwVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501314, "uuid": "a4de1848-7a28-48a3-8677-a1a0ef82d84f", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501314, "uuid": "708a39c6-023f-4c6c-b592-b6fed42e8ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501314, "uuid": "ccc0342b-fd2c-4c55-a328-e934ec05cf66", "value": "POM21002942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9606c07e-d202-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1680514406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514406, "uuid": "9d8f811b-a938-4a47-98e3-957c94116867", "comment": "Malware payload (Gozi)", "value": "68d4bfeb87777e1c8766088077822341", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514406, "uuid": "d58cbdb5-31c5-4f4c-9ee3-7debf9c265f6", "comment": "Malware payload (Gozi)", "value": "308110773533c5740fd92d77094da83152f98230cd9635bc8f7dcd7dce910c75", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514406, "uuid": "a7a4d1b1-28d7-4ec7-bf72-22e29f6bf3d1", "comment": "Malware payload (Gozi)", "value": "b7d12612d8ef6aa44b1bcbdea0e6979769841300", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680514406, "uuid": "9ea3f54e-38ae-437f-b468-c080b4fd544a", "comment": "Malware payload (Gozi)", "value": "d65b242f4d90c91868d447169b3360f1437921b6d7ac026813fd1218c3bf36bd9688b739c8a95cdffe32daae4defcc9f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "MEF", "colour": "#034353", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514406, "uuid": "f203a5cf-a4a0-4c72-b1e4-b4ee21649817", "value": "T1DB048DC353A07C51E4168B7A8E2EC6E4670DFC51CE9DABAAE2146F2F04BD162E173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514406, "uuid": "b2883380-d1cc-4e95-b474-d7c33a162459", "value": "0c16d61a145a6038e0c4acd3e1db8764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514406, "uuid": "d98e4a4d-2227-4828-b656-0e32f64bf7af", "value": "3072:MB324Mujr+zpEwSQCah3vidXxwz45BGyEG:F4vDwSxOWxwU5BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680514406, "uuid": "bf0171eb-a537-492d-b785-e1d91db74bec", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680514406, "uuid": "7064f732-feb1-4ddf-9638-58fd4f3a81f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680514406, "uuid": "29f25415-5e14-40a6-81fa-2e894ad414c2", "value": "server_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407b0542-d212-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680521135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521135, "uuid": "f14a5b03-d1a4-459b-b2da-61d1649a5942", "comment": "Malware payload (AgentTesla)", "value": "5aa33c0ff774e15ceda6fb3f19f4bc9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521135, "uuid": "f0ebe8f9-1634-4fd9-b875-9f7f3467a544", "comment": "Malware payload (AgentTesla)", "value": "31172a6da2d4b232acc28aac3e7345a428f73aa67430f5da1ad436ddc48eba33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521135, "uuid": "77b7e486-82f7-4fd6-93ad-6a928fdb37c6", "comment": "Malware payload (AgentTesla)", "value": "e473649407f5dce2f99f5ef8b26210f73f887292", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521135, "uuid": "a54c88a1-dd41-4cc6-b5fa-9a3efacb26a6", "comment": "Malware payload (AgentTesla)", "value": "843577e564a83d0364355adc266705f1d5ada522ea56ec5887e71b292acb7fcccb286abf006687eca9fa702c96fd5bca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521135, "uuid": "5c4c150b-a272-4ac4-95ff-1db559b53f46", "value": "T1B315BF4778C421CFFB53DE31C5E46EFD6492A9A206068F3ED91642D85A2C243BE918F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521135, "uuid": "2785ee7b-74b2-4dd0-8e97-41bce3bb81ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521135, "uuid": "21bf57f0-a5d3-444d-b60a-bcdd95968ec0", "value": "12288:EQwGNnSZcCyKxaP0AO9ee5dR6MOMeF2qSafV/wcE0yE9kkDpTQ7UpikAOROPrXkb:EQTgZc9U4OBPtSfVoe9kR709k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521135, "uuid": "4f749a54-ecd8-4893-90f4-c9adf0179430", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521135, "uuid": "11d1e760-949e-451e-a11f-c1c9d72bcf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521135, "uuid": "524756b0-1c59-4eec-a829-73f8f74d42e2", "value": "31172a6da2d4b232acc28aac3e7345a428f73aa67430f5da1ad436ddc48eba33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde9b458-d236-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680536861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536861, "uuid": "b6ca2d8a-5a7f-4727-b361-c749f832cf34", "comment": "Malware payload (AgentTesla)", "value": "74228895ab5b5f47a04389aa3265a055", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536861, "uuid": "40299e50-35d6-4483-9310-49ea4c95a8fb", "comment": "Malware payload (AgentTesla)", "value": "31fe8ccf1b8eea1306fadc7a92ef30950be92104b27d5a62de2cfbf1f73dd7ee", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536861, "uuid": "2cf4cd99-bf63-4044-b2b8-0c65fb9da4a6", "comment": "Malware payload (AgentTesla)", "value": "6b0a074becc31feccf7cefbe770a974f5a3d2b85", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536861, "uuid": "807a302a-201b-4620-bcc9-ba5e8b9cb552", "comment": "Malware payload (AgentTesla)", "value": "12c4413d282e220308f5e53769c789ff3f46989c19e25326fc4c6fb367165dbcbe10fb36ac8e31c3bf69cae07280b7f2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536861, "uuid": "dfd7ec70-2889-4eea-b506-db5288296dc1", "value": "T120E423627AB47BC2D8089BD105B60DD1D2D56D48012A9BFD8DA585CE37A8CE20D4DCFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536861, "uuid": "e3347c62-d301-4020-9d5d-943bbbac34ce", "value": "12288:f2nvQkWKdq1T9n4s1PsQk2aRtB55fMArEhvfLZpV7I+OREUawwSXwfqAUiW:f2nvQkfeLq2aRtBjXMdpa9x1zXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680536861, "uuid": "0146847a-2a9f-4acd-b264-d45208dbf952", "value": 682940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680536861, "uuid": "c406c012-a282-485b-8eb7-b7ff5d5e7604", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536861, "uuid": "8ba8a10d-5ada-451d-b94e-3fa70d851ef0", "value": "Technical%0D%0A Datasheet.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d98f2eb-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680524995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524995, "uuid": "94f4a688-71e5-42cc-abd4-c746bd3c05cb", "comment": "Malware payload (Formbook)", "value": "4205220a21e6f8478532fe05668312ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524995, "uuid": "6e2c846f-64e7-49f5-be4f-eeddda236fa2", "comment": "Malware payload (Formbook)", "value": "326165a2f6e94ec16dfcead4602ded488925b4d4bd32b04458bf2416cdf9b93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524995, "uuid": "e8e29a0c-668f-49f3-8cb6-e36e793058be", "comment": "Malware payload (Formbook)", "value": "7f0434e457e9d12ba998067c0e50b523fbfecebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524995, "uuid": "785d8f2d-2d1f-47fd-b75f-7090e4fb97df", "comment": "Malware payload (Formbook)", "value": "d2cb0ac7444c443acbbec8ee490c8b5b963b65885b5ddca450a8a3b8d3e6e43c6bb66a2806d7a70df027d3b41d72286c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524995, "uuid": "87276bba-a666-4205-b60b-d9feddf0ac77", "value": "T155F42315331CE335C92683FB1422A52967FAEA277453E33E4CE86CEF9C2AB544A54D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524995, "uuid": "9f251548-b87f-429b-b5ec-ce3cc6bf1182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524995, "uuid": "371d4052-a368-4b91-9847-79d00be3c55c", "value": "12288:y5CBWKdq1FbwwJLwrIe4Ghh/kVkU5S2QR1DlRftxL2S8KSvF1/8aJqxmkivs:9frpP4kB2QRtLf8pv8evs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524995, "uuid": "c691458f-0a45-4262-96c0-3b0b7a7c0246", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524995, "uuid": "652e8de1-73b6-4119-ad71-db31596d7218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524995, "uuid": "ba444ccf-5153-408d-9fb5-31b297db2d1e", "value": "Product enquiry PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0623e703-d252-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680548525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548525, "uuid": "7d4b1cfa-aa89-4148-9352-ad8253c16040", "comment": "Malware payload", "value": "09a29f3b529c5e9ab25a47973bb0900a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548525, "uuid": "b188890c-9890-498a-91ea-4055d52d70c6", "comment": "Malware payload", "value": "33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548525, "uuid": "890d3ace-34aa-403c-89e1-2ea5b811aee9", "comment": "Malware payload", "value": "b8dce851d01dbe0335f11fa8449b52a2270776e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548525, "uuid": "a37cd99a-737a-4f6a-a96c-5ffdee851618", "comment": "Malware payload", "value": "10664398560f555be5a524cb16ab6e8cb9796f61b8308c1f5967ef38f33e46cde24d6725dfd1d8367789ff179f9eae89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548525, "uuid": "6813d36a-98ca-401d-ba3a-25d7081a08e9", "value": "T109535F9C366072DFC86BC972DEA82C64EA60747B570BD243E45316ED9A0D99BCF050F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548525, "uuid": "1d9a5eaa-1402-42f4-9f85-b94b595aa084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548525, "uuid": "e1b40a74-d761-41db-ada5-b73f1eb938ef", "value": "1536:s2JbaiIZApuLzOgkx9MbEze4g3ViceSITKdU:dbahZApuL1kx9MbEze4g3ViceYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680548525, "uuid": "317032ae-e2f0-4341-8baf-78a585534af8", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680548525, "uuid": "8f0e9fd7-c7b4-498c-983a-08cf6f5de2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548525, "uuid": "257a4a55-4f5f-4c71-8331-eece754ebeab", "value": "SystemUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d15ba08-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680522364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522364, "uuid": "5573ecc3-1547-4362-9f90-1b98c45aef44", "comment": "Malware payload (Stop)", "value": "e858fdb644036df6b91573aee5688c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522364, "uuid": "4a3b1dd7-9324-4190-958b-62658a7bef60", "comment": "Malware payload (Stop)", "value": "332f6c7b9901126e8e2b4c9416b0df98aac1bf94fd6f79f9de0b8f7e141471f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522364, "uuid": "726085a5-f582-4432-865b-c017109bd903", "comment": "Malware payload (Stop)", "value": "7e4bd9b6d3a9e49dc0a4780e0f648db8b99e0dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522364, "uuid": "a4411c9a-6de0-4bfd-ae0c-fa8a606067f0", "comment": "Malware payload (Stop)", "value": "f493686e3c800e7285b63ac064f73e2c8f3ffd9770e3e8646ae4a2c57ac09a459f1ba3fceb0811d34db397db3dbf6956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522364, "uuid": "44e6f173-0f99-4e50-926e-ffc3e3d95730", "value": "T1C9E41211BBE1C1B7C46BD8B80510EAB0A73D78B54761C9CB332C1B6E2F623D16A75399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522364, "uuid": "ea0122ab-d627-4c2c-9ff4-1d667cb7caf2", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522364, "uuid": "b0a14dca-f100-47d1-89b5-9a73fe78effc", "value": "12288:uAzZmWoVkSNqYQOb1ygsqkuqBz+U5qnSC65JqVDUggqFutA5F:9sWo4xEOt3BJ5KS9qtUgghKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522364, "uuid": "82414826-e7df-4620-892e-3ee2ffe3cb6d", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522364, "uuid": "e27d2461-f598-41d7-bc21-5c2ca42122f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522364, "uuid": "515be0aa-483a-42ff-b6d8-44d21c1d2e0b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e6ee1a-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (jRAT)", "timestamp": 1680524935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524935, "uuid": "79e38e40-7a03-4b58-bb97-588d88221329", "comment": "Malware payload (jRAT)", "value": "83c59dfbb14ce7fd85a0e3d0723a7ac7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524935, "uuid": "da4b0cae-d79d-44c0-afc2-ae3bb132149f", "comment": "Malware payload (jRAT)", "value": "33600e7ff79ef19d1f0588f592db665be6251bd9b2cdfa8c508c227bbc19c250", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524935, "uuid": "cb84889d-6898-4101-8b97-febe437fa1e1", "comment": "Malware payload (jRAT)", "value": "46f1c07e9620a6c1b954d89c7e5bba442398ae22", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524935, "uuid": "30413936-837e-4c6a-aad9-f44364b7790a", "comment": "Malware payload (jRAT)", "value": "884e84b34142bad6a4414742d7c392b14775d551858de7a348d67ec10696e15f722c563f5ebf7bc57e496e2ddf0680db", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524935, "uuid": "28786ba4-beb9-436f-8bdd-089f8739a63e", "value": "T12DF4021FBD84E8EFE31341311266C71A6904837D9891BFE72610BBA89872E640797FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524935, "uuid": "4913a477-aa2c-4641-99fe-c2aaac0bcb07", "value": "12288:mRvrLJvZLl+YBVeUYz4rVSmp/hqRorElQyur+gVX2xi7o7SAN5ZG9AYY20J223hp:SLJvZHBVelc9dUNlurvyWo1ZVYHc2Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524935, "uuid": "ce20c8de-9c28-4b24-b431-960a06a1e400", "value": 761221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524935, "uuid": "55d8550f-03b9-4ca3-9bdd-aca5db28d1f8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524935, "uuid": "2070d551-6c5e-4331-a90e-a08af563ccfc", "value": "\uacc4\uc88c \uba85\uc138\uc11c \uc5f4\uae30.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7ceac8-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680501478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501478, "uuid": "245a0c5b-4fc8-4e65-b514-b7fa65fb83f7", "comment": "Malware payload (SnakeKeylogger)", "value": "aae978fa430e7e480ba6a2474aa99f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501478, "uuid": "76e806b9-26f1-4483-98ee-dca854f52bd1", "comment": "Malware payload (SnakeKeylogger)", "value": "33a8bb74d0ef4be5a6f3845bf87f406a2b9757535a09d65e34d1c73a4b133429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501478, "uuid": "542284ff-ac68-4a3b-a507-6faeff776e55", "comment": "Malware payload (SnakeKeylogger)", "value": "512e8437fa82dc6f0110a1e01f8e6d82ae552edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501478, "uuid": "f3ba31d5-02df-4be1-a76e-c2102881b5d4", "comment": "Malware payload (SnakeKeylogger)", "value": "efd5407dd0fd716a0a7a85df78c6f4d2e071570ed8b8a14afe303e53f105dcb4226ae4cea711da7f9ec27968d339b3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501478, "uuid": "271c1b69-a2e1-4eee-8506-5df2ac5c0cc2", "value": "T1D8155DD1F150889BED6B05F2BD2BA53011A7BE9D94A4810C599DBB1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501478, "uuid": "6c9486cc-869c-4ef6-bd5a-f83747efb341", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501478, "uuid": "a46fdfec-e029-4d31-8a52-91f548548aae", "value": "12288:GqQtzLwrXsLosreM0yl3eBM9sZbfAQyGYc/0UlaCNw4bWWkwwELtS+MU:XPil3eB5Jf1TYElamw4beELoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501478, "uuid": "d4c2cf4e-ff3e-4208-8a89-09d16bde8b13", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501478, "uuid": "50f9000d-9a68-4400-bd2a-db79f8439855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501478, "uuid": "8ba4c0a8-99ac-407f-a8a1-679e8fc86048", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14295339-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1680501303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501303, "uuid": "da6ac687-18dc-4a5d-a637-d53fc7ffdcad", "comment": "Malware payload (DarkCloud)", "value": "b93b1b136bfbcb94a552a8825bec47e7", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501303, "uuid": "782bde76-bd5b-461e-9e9f-7ab11f079fe2", "comment": "Malware payload (DarkCloud)", "value": "34156e9640ee92864054de0fff80e356510e6216c317a7f8563f14f13b52978d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501303, "uuid": "0a419a4f-77aa-4ab4-b6b8-fae6890a1640", "comment": "Malware payload (DarkCloud)", "value": "70dd3fcdb0aa87b4c36aa803f1b6413c6158ee69", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501303, "uuid": "31743593-0a2a-4b22-a562-d2fa16f12dfc", "comment": "Malware payload (DarkCloud)", "value": "adbf5aa5f0404a1d633b1528cd3e7b8b12deed3243bde455f28f5d1907f794c33d0dc0e98eeadfd71a3b76c4a4207172", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501303, "uuid": "88ab1174-3f71-4a94-802c-69987bce9976", "value": "T1D7250114E6DE9109C119B239D1D3C2BCA361DDD1D962C6D27BC8BD4FB6BEFCA5121082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501303, "uuid": "a29b9133-f969-41bd-9819-c3d10bce9027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501303, "uuid": "d0ed498e-5cc0-4a95-bbb7-90f486a0a771", "value": "24576:oMaAanRi5PmrnOhs2+p+VHaIgDwajpoximX:QnRihmrnV2zV6IgDRpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501303, "uuid": "62d952ea-1f8a-45b3-aad2-4be7f4a47196", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501303, "uuid": "a23ce53d-45cf-481c-acfe-117dadfe8bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501303, "uuid": "3c74c3b7-8a5c-45d9-a063-31b3f3b661af", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9033fbc-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680523565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523565, "uuid": "6b7986b7-77c2-4341-ba1e-2c3d2c8210ca", "comment": "Malware payload (Rhadamanthys)", "value": "0391e8c10b8645661dd026745e781764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523565, "uuid": "beb1911d-bdec-400a-a654-0e5a92aa6bd3", "comment": "Malware payload (Rhadamanthys)", "value": "354daafa30184c71c5d0e6c5ffec36cff1f15d5419a5e2845022fed41bf2a823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523565, "uuid": "4b8b2f32-0ab1-4e8f-80a7-8aea6b3a1fd4", "comment": "Malware payload (Rhadamanthys)", "value": "4b4f560f38e67e025a0ba13ab64e6abb56c56191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523565, "uuid": "1804a608-eab1-40e5-a3b3-bdbf63fbb8e3", "comment": "Malware payload (Rhadamanthys)", "value": "221e2bf917581f6c3a3c45218e4942a8f4dc7f66fe33e2f0d1fc86f1da67faa5db6cd9494370d8b30279aa4ed04b1923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523565, "uuid": "8ff50bcf-de68-464b-ba89-b0d880688025", "value": "T1EB44E0217B71C8B2D81285784B25CAF4633ABC71AF91C38733581BAE1F716D17A7B219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523565, "uuid": "43668004-17e5-42b9-932d-172200a68b13", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523565, "uuid": "50249813-77c5-44f1-9b2b-16f2713f07e5", "value": "3072:J1v6EljgL4AhNBTR+POzCfjbmbhu+7bjTZoN68QddXZ1evo1DzAXCmdOY95vb+:asgLrTR+PybvjTZMAov2DzA04b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523565, "uuid": "be156dae-ba7e-4ad1-a50a-a780dba7a552", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523565, "uuid": "9f649a25-aac6-46a2-87ec-8e196fb7d374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523565, "uuid": "95c4717d-7992-4b95-bebf-a357232bd19d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105c93ee-d1ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680505592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505592, "uuid": "f4cc0772-b939-4bc2-996a-244e5a3ae3f2", "comment": "Malware payload (AgentTesla)", "value": "ad6a82e1467192626a165a91fc3f70fa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505592, "uuid": "a4e51054-3dc7-496b-9e54-d5650d503051", "comment": "Malware payload (AgentTesla)", "value": "359aba069a1a5f72fa545ccdaf896ee30c395951032b5f1bcbb247550e363b6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505592, "uuid": "b70019c3-e077-4c2c-9c39-2f6d41ccb314", "comment": "Malware payload (AgentTesla)", "value": "a780e048ef2e8092396ee4cb5afe3c4f5d42b267", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505592, "uuid": "9a5568fc-8a68-4de5-9b30-df60e5c25da0", "comment": "Malware payload (AgentTesla)", "value": "2e3f89783ccb0cc7687c8ca80d695281fe503c42d70ac00dd97613427e04f837dba3193954a16bc3c9431d0c1ae2623f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505592, "uuid": "6286318a-4caf-406c-963d-c95f722e7cd6", "value": "T19DC423CB856AA2C7C08A957F956ADC062D7169C90107C1A7EB34AD7800ADD7FE630D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505592, "uuid": "cb841470-4733-4405-ac77-8b0d3380c789", "value": "12288:qHMmso67S9nf/vZKUffgN/gi+Mn501/no+E2KHqPVHxsnx6vpLSX:OVso6gXZrgBT+M501/w2aqPVHxs4pWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680505592, "uuid": "21972c56-5df8-455e-a7ee-f7465bb05eab", "value": 578226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680505592, "uuid": "4ca098ba-a374-420d-a503-b1c9c663509e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505592, "uuid": "db3f35b5-0d4e-4fd3-b28a-7192d44c502b", "value": "SOA 22011~2302.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc59f1a-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680501291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501291, "uuid": "68cdd4ad-c64f-4fa7-85ac-a93371ece708", "comment": "Malware payload (SnakeKeylogger)", "value": "bea1189263b295ac592c4e4ed570217b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501291, "uuid": "3d2138c9-438c-41fc-81bb-16896e00455c", "comment": "Malware payload (SnakeKeylogger)", "value": "364d90e88783e00f11a0315f9e73772647a95714d2198d05d24b66dd4e4672bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501291, "uuid": "bb3c34ca-75c4-44b0-b49b-489b81d0e6bb", "comment": "Malware payload (SnakeKeylogger)", "value": "4c1ea24e84107052a61c687909c79853f8409a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501291, "uuid": "d4729f77-198a-43eb-9411-cd37e04ec246", "comment": "Malware payload (SnakeKeylogger)", "value": "a59ee462e793b2840d95251a0ce302693dd3e9bafabe5aebad74197e2fc27f34412869ecd9200df9ab51ba692ee5cff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501291, "uuid": "d6c1ebbe-7ad4-4938-9f3b-ae3ffda3471f", "value": "T19DD3F81D2BF89900E5FF9A7305B15121C775B842192BCD0D4AD2F5192B7EAA0CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501291, "uuid": "085fedc9-0367-44fa-b4c8-03405fd12d6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501291, "uuid": "cdab3871-7017-444d-9dc7-cf3a0b13da4c", "value": "3072:WAgAEzhRftlo5RNmVb8cCmJTwBOOHFbY:Ly7UXmVbrZNOlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501291, "uuid": "e5dbb9d4-5905-4114-97ab-1c421fc3c24f", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501291, "uuid": "d4273f35-2d21-40ea-bf70-8e85f6abce9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501291, "uuid": "a27ed722-3546-4157-b073-ca86e7148e4c", "value": "364d90e88783e00f11a0315f9e73772647a95714d2198d05d24b66dd4e4672bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e4b510-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525623, "uuid": "cee79468-d1e1-4e95-bb83-95b6ae431578", "comment": "Malware payload (AgentTesla)", "value": "3573cfa28e62b14b3a8189063065c8bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525623, "uuid": "8ad22a14-c603-4a5d-82fa-30a86e0c3f83", "comment": "Malware payload (AgentTesla)", "value": "3678eacb8a54a9b0112aae9c691b5ddbbe86631d17689abd544a1acac76c1ce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525623, "uuid": "eb5f673e-8bf8-4f0b-9038-24c1b1346eb6", "comment": "Malware payload (AgentTesla)", "value": "16880f808ff4cbf50575f2cdba5ed4d2d13ef517", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525623, "uuid": "05d11aca-061c-4dd5-b55f-afb8b9a2a8b6", "comment": "Malware payload (AgentTesla)", "value": "2a9ee9c24d6eee0a072804f2fea81be1feb5db4c43315f74487b3c14a4776af573043a36d68058c9e26c10d67705372b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525623, "uuid": "5bb5eaf1-2f74-427e-b67c-dc6dc3ef21b7", "value": "T15B35C4AC366432EFC467CC72DEA85C64FBA0747B631B8607906F119D9A0D887DF111BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525623, "uuid": "78eed31c-ed87-4862-8346-167d28afc290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525623, "uuid": "c3707094-bba5-40fe-ac85-f95340252613", "value": "12288:dX9JvxrmCjZ+yywVFUS6tleliDFjvLdMcKT5i7ZfgpopMcTpVdLjZkdE2ajTIbIQ:1J6uuwVFf6tlBFdMc4Q7e/+XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525623, "uuid": "ce28b360-44b6-4eb9-aae1-2562ff324dba", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525623, "uuid": "f1f04de9-d07f-4668-80ed-070f523f2362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525623, "uuid": "0cfb67de-f092-4fc7-8dab-b8143cd779d7", "value": "3573cfa28e62b14b3a8189063065c8bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f36a382-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680523414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523414, "uuid": "5eca3405-ade8-4c49-818b-626c2dbe4882", "comment": "Malware payload (Smoke Loader)", "value": "8efe681507bdd29b6781d5358df5cba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523414, "uuid": "0f7ef53a-2357-4b5f-8573-447068186713", "comment": "Malware payload (Smoke Loader)", "value": "36ce85796436c7137c5b4aedae0cbf6b36580b4dd5b3455b25476e38a33f9e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523414, "uuid": "5b8c1a55-fd8a-4575-8bac-510411b7a7cd", "comment": "Malware payload (Smoke Loader)", "value": "34573179e2822f1209c2329ca46a52a7b5a4faa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523414, "uuid": "00eb73bb-0e5c-4efa-81fa-67fe96da8bc8", "comment": "Malware payload (Smoke Loader)", "value": "104fbad63b0965e2a9adb7e4c07527334cc1034a79554036efeef95ada9a73e436cba1b6725c6b2c0b0495f3fff88854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523414, "uuid": "505aba69-0818-40c7-bbff-6b258fe6282a", "value": "T112645C0246F46830E13F46328F2EC2F56A5EBC629F557B9B267ABA3F09701B1D522705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523414, "uuid": "cd39c0a8-0cf7-4104-8584-3f57248bade8", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523414, "uuid": "1393c7ca-d26f-4d6a-b514-343b2ebb9fba", "value": "3072:7kSGFiunpSb5NXGgQT83oHSkDooJc78AaT4fYpIONSj5aU83i57edEPS:gHFiIpSblrYoxYAxfGIOuG3oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523414, "uuid": "69618ed4-74fd-49ac-adc1-67f37a212943", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523414, "uuid": "411a2e34-8a28-4805-a7a6-a62d1f922a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523414, "uuid": "4bed4430-0cce-41a2-b045-246d67e8efef", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381b09a0-d257-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680550756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550756, "uuid": "73e8f8a5-955e-4fa7-be66-fc167cabb50e", "comment": "Malware payload", "value": "ee033dda317734578eab43459df9a3ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550756, "uuid": "2120be74-202a-4028-bfe3-6d9ba8777a2c", "comment": "Malware payload", "value": "370b1e1476192d5ad59f3f236b1be8bfc43ff88068abcdad756b8c26ee32611a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550756, "uuid": "f4cd1ee6-eef3-4b5e-9e3b-678f7a91bbc6", "comment": "Malware payload", "value": "c9ad77121c5a353a75b82470eafe4455a1db0cf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550756, "uuid": "be152ff7-6fe1-4dd2-b557-8f83630ea393", "comment": "Malware payload", "value": "5d92fa8d7e973cfb5ed62a3cec5f100c6a191b711d05450c899a571463c3679583df958d2e667381790eb822caea3446", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550756, "uuid": "d413f5e2-8b39-415c-bc15-da3d76b8f270", "value": "T17AA31877A71C4753C4D759F12CEB3BF08F69A5F3A2936185613EAAC04732AB02812F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550756, "uuid": "abe600eb-da5d-414a-98b7-195576c6cf72", "value": "1536:iQeh+/i8P+Vw1Scf7G60qbAQIBvizC7HPDigUmXxVqDystKfz1e:iFE/7ScffvUbD2gUmXxVqDyIKfz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680550756, "uuid": "21a3fb74-c221-4f1f-ab4e-cced6f0e585d", "value": 103317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680550756, "uuid": "031d070d-5dc0-42e5-8ab6-c827f2b853e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550756, "uuid": "2508a39a-125a-47f4-8d8a-f226063b0a0f", "value": "ee033dda317734578eab43459df9a3ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688b1c54-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680503163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503163, "uuid": "ce4b111d-8368-4922-8f01-e4b5afdcfcb0", "comment": "Malware payload (Mirai)", "value": "55394a86866a34649dcaae484131b747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503163, "uuid": "c36132de-b629-4e3a-b06a-f3040c368b73", "comment": "Malware payload (Mirai)", "value": "3758c930da48da81bd214f422905e03e644dec68cc7b258345a87a56c88d794c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503163, "uuid": "84f044a8-f074-4f15-a86d-2c72153026d3", "comment": "Malware payload (Mirai)", "value": "7d93bb2d3fdb5a12c20a60c6342301df559ecd42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503163, "uuid": "c816a18e-ab7d-42a8-ba1a-8b37fbb3d9c8", "comment": "Malware payload (Mirai)", "value": "315d51fd40080bc96ba1c9af2cac6539722feea18d61403bd76b01b7209b3baf3844be78a711f0168c345777756cc237", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503163, "uuid": "d77d5915-e2f0-414b-959d-f6c2db27ccac", "value": "T11D438D36E96E1E74C08641B074748EB56F23A5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503163, "uuid": "d713ebfd-152d-43ef-b165-66412e7dcbef", "value": "1536:9aa0brW/Od9hlCRjKK1KQXACspfDCMx2+W2:9v0brWGd9XlKcQqpfDQ+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503163, "uuid": "2ce244ba-6411-4af5-89b2-c01cbb9423e0", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503163, "uuid": "b4d2c3a2-d7b9-4a03-8c4d-c91a88a155d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503163, "uuid": "1985da79-caeb-4afb-894a-f4cd8c25ce29", "value": "55394a86866a34649dcaae484131b747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bbb4bf-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545648, "uuid": "996437f5-c255-4b74-a94b-3786c7fc8953", "comment": "Malware payload (Mirai)", "value": "b66d772e2fa6308efc5019754affb94a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545648, "uuid": "bfa8d629-c007-4bd3-aae0-8cb7f09f1d9b", "comment": "Malware payload (Mirai)", "value": "38052de17ce977ac48398a5461d0379c91ffbfe9da4bd16c69ab81c5e780a817", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545648, "uuid": "09f0f9d4-ede1-4d4f-a35c-60c1586c9ee8", "comment": "Malware payload (Mirai)", "value": "32b913be11bc336745e49bb2a75c73afb1393a1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545648, "uuid": "c4d5c0d6-b4bc-4882-80ec-97ff55496a71", "comment": "Malware payload (Mirai)", "value": "d160a4c0cfcfae64a7cc7dec86a19a4baa459f95d66c2fb7ac349c63f7ecc0406da341b57151a1d30e989b2521272cb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545648, "uuid": "079c07e4-493c-4f94-9f5d-4efa3f8a0b0c", "value": "T14903F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545648, "uuid": "12304ea0-0154-472a-87ae-25ed7860644d", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTI/NMwWq:AfWb8G5fblUlfbgeaUv+fEXHWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545648, "uuid": "15e3720b-1f9b-461c-a5dc-fd0ed6cb901b", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545648, "uuid": "d118717b-867d-4565-af4d-da4201a2812b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545648, "uuid": "69be6e5c-6670-49f0-94f0-d8a6219623df", "value": "b66d772e2fa6308efc5019754affb94a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d77feae-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680522069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522069, "uuid": "b0df0720-b13a-4e2f-8ebc-6e84cb5f1bff", "comment": "Malware payload (Stop)", "value": "629d744dcc7fe6b57e76979833f8499a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522069, "uuid": "bae86118-2230-4459-ae52-93f7b0063fbc", "comment": "Malware payload (Stop)", "value": "3853f8e43a5fa3145d7b35a689cbc6e419ea576600b65062beed7d8cba279ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522069, "uuid": "90e92eb5-0f76-4eea-bc24-d14dea8da0b1", "comment": "Malware payload (Stop)", "value": "b82526d6281e68fe0498d17fddc3a251ba92544f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522069, "uuid": "2edee957-3ff2-4469-8e50-d32a9fa59042", "comment": "Malware payload (Stop)", "value": "bca3fb278e42541c1e392cf2c6fac1deb3520e5b277e820c3ec7ddc0af85937020b1629dfe4f588774479c898ceba195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522069, "uuid": "b65c7ad8-971a-46c5-8ef3-208e6e738d82", "value": "T115E41211BFA3C83AE40DC9741C22D6B1A6BDB46587A68A9733042F7E2F702D17739719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522069, "uuid": "4d764d83-32dd-43dd-9e6e-0abb04275d8d", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522069, "uuid": "5840fc29-0def-476a-add9-58a3ad4f1e19", "value": "12288:M6qQySPKq2IgaXpZUBvZdJpUV4dCz7BG4uFB:M6qQvKq2jaZ+lJroW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522069, "uuid": "811f3024-ceda-4e71-a5a1-dad160dc73e6", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522069, "uuid": "785c6b8a-7b16-45ea-b367-81817537b22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522069, "uuid": "03c682bb-a70e-4fdb-aee8-0a844afacad5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c058f54-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496136, "uuid": "4a32d956-57af-40af-8dc8-81c77d24a5c7", "comment": "Malware payload", "value": "f4a98a75c7730f4d89c8a31cd8c1987a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496136, "uuid": "aecad06e-567f-4e8f-b486-6302ebaa5bfe", "comment": "Malware payload", "value": "393e7bac15d42b02029adb6dbc9b80cd4b11430b136001b39c6b1ab3551a3e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496136, "uuid": "3602e904-f8d0-4e0b-9d61-6729be4e1932", "comment": "Malware payload", "value": "f163303cce101aab181e5cd77172c0a889d2cc59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496136, "uuid": "36951476-73d1-488b-9da1-2141258e4085", "comment": "Malware payload", "value": "ebd3acc558a9705e77c82ca795fa2bb92193e5cd60f14261bd101c2e69fe8a7fe689850b2e2d69261cc991176da9f049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496136, "uuid": "26203999-524d-47bd-8729-54e197908969", "value": "T1A4A34943B5448863EBD2047092486B1BAAEFC9BBE174241FD5413F866DB4583CFBBB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496136, "uuid": "231447de-2ca1-4c2a-86fd-a2506e6c63f2", "value": "768:OA9k9LaKlvsAThK8jzna5+h7ATGnaquU+fDgBCf5HPqVTjspyxxBPNBxobGEIGFS:nk7L0UETGnaqU5uEpyxxxxoe+dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496136, "uuid": "9637a033-f88c-4b3a-bb2c-c5cb7840efe7", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496136, "uuid": "126f3aa3-ddf7-46c3-9935-ab4da6a10a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496136, "uuid": "7f484b0d-89ae-4e84-9455-881b21eed357", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.13266.24573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c91a59-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524684, "uuid": "c42bb6b8-ba08-4dd8-b144-bd259613cfb0", "comment": "Malware payload (SnakeKeylogger)", "value": "8ea3e13b41f0708e97e04b0f9b23f3f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524684, "uuid": "0bd81344-82d5-45f7-a811-4ad76e63f394", "comment": "Malware payload (SnakeKeylogger)", "value": "3a121896e1f2a3dda1daf2a56fce467abaf3bcd8f7d6ca38399e0cb1152b6f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524684, "uuid": "84e9a4fe-9d5d-44d2-8b5f-b191027e46bb", "comment": "Malware payload (SnakeKeylogger)", "value": "23b70f3c995eca312f67385f05b3039557e5d688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524684, "uuid": "6009aa40-1028-4bb2-823e-6487b04b5a94", "comment": "Malware payload (SnakeKeylogger)", "value": "85d0e93cf61c95a291cf761a7180b41bbf6209f8b9d7e599a2a0f727870c0e12e8049c63999bf959072cbe1d64520c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524684, "uuid": "02f3a249-ec69-4bc3-9991-3296e05cdec0", "value": "T16A155DD1F150889BED6B09F1AD2BA43025A7BE9D54A4C10C599DBB1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524684, "uuid": "32cd10d4-07dc-4449-99ca-9a3235ee4a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524684, "uuid": "85016a09-5186-4eca-9597-0714b514e180", "value": "12288:sztzLwrxWKPPK4LSys5oMJ3E46FPvnajk7IOq5YB:TVPPq3E46FPvnRS5YB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524684, "uuid": "771edf47-4a59-42b7-8213-1d3c0ba1cb3a", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524684, "uuid": "a8523786-0712-4299-8391-0fc2aea49310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524684, "uuid": "f620be86-0bd8-4bfe-8872-22c61481fac2", "value": "PO#8754302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d81da8d-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (MyDoom)", "timestamp": 1680501292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501292, "uuid": "a5956672-f2aa-4150-a8a4-62d0b5879204", "comment": "Malware payload (MyDoom)", "value": "42af771d17c6930023b7cd8e8e93c9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501292, "uuid": "68286c8a-53b0-42ee-ae94-6c8944079f45", "comment": "Malware payload (MyDoom)", "value": "3aa059b61b9297e62c4d8bfb984cba611f41847394b8fd56c589c820a70bb8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501292, "uuid": "4e324c8f-1ca7-47ad-8df3-3f5c9da22e16", "comment": "Malware payload (MyDoom)", "value": "40b2f02802198562efc1de4f47e8e4f5c453754a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501292, "uuid": "6565e1fd-0007-456a-b79c-60ba3bc5ebdd", "comment": "Malware payload (MyDoom)", "value": "2966b4031076235f9c8ffb7bead0b6d5b6c7f3d4cc4a531f7d182fd354e10d783b2a6e970ff729018ea2eac75f8252d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501292, "uuid": "09cfc1be-8438-4e59-8314-13db70d38f46", "value": "T12D437C73554095F3C58244702A81EA62AEB9ED771749E343F6D0AA5EECB84C76B3CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501292, "uuid": "abe3737f-4cbe-4679-b65a-a6aaa2226692", "value": "7ee89a85ea0ffd700fd28e6cfa3d968f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501292, "uuid": "5931eec3-2e78-481f-8906-94489fec746d", "value": "768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH:aqk/Zdic/qjh8w19JDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501292, "uuid": "59fa3751-3df3-4c7c-9528-7a5099799f66", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501292, "uuid": "e2dec76a-aeb3-455b-9212-0db782fe7e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501292, "uuid": "e6b77119-7fac-4fc4-90a9-3b247df2094b", "value": "3aa059b61b9297e62c4d8bfb984cba611f41847394b8fd56c589c820a70bb8b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f365d7-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525511, "uuid": "e10da3d6-5b47-46c0-b356-eb4b7ec6b869", "comment": "Malware payload (DanaBot)", "value": "890d419cff115b34377b096b482b158f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525511, "uuid": "133db8ac-30cb-43fb-ba0b-5eab5921a67c", "comment": "Malware payload (DanaBot)", "value": "3acf09fe9107cf9428d8c8dcb924d7d1e31c6a06e815599e750871b1af7c4e04", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525511, "uuid": "2a4f9a3d-10d7-416c-b06b-85e303a5e061", "comment": "Malware payload (DanaBot)", "value": "0fe2803723881f99dfd508f5f6e342bf865fa989", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525511, "uuid": "fafee94b-4eb3-479b-86d0-8803097c841b", "comment": "Malware payload (DanaBot)", "value": "0b3eeb7ae1c2f285d92654316c3988209d9873fde7c2f19247c72c661234d5761cbc84264226ac54d35b46f94bd3d0a5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525511, "uuid": "e358900c-014a-41ff-aa56-f35e1d4de772", "value": "T124363302A6A0E991D1139E32CE1FC3F4921F7D056C26BEEF0720B47B9B789B1D256359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525511, "uuid": "98af605e-7b92-4617-ac6b-574ef6e525bd", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525511, "uuid": "ee9d9bea-9c41-4750-bc05-f2d2fd1566a7", "value": "98304:6zjabvVDmRkRBACsNFAgdChDVYgaAIsroDegqlsGQP1Tc9cwhbVt:zTdmZCsjxsD/0sJgxt9Tc9cwhbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525511, "uuid": "2eb0e666-5397-4c2b-adb9-83ca8c6536ba", "value": 4947456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525511, "uuid": "417f2904-571c-48cc-b62e-c9956a755c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525511, "uuid": "3f37912f-54bf-4bc8-a144-e651414c9b7c", "value": "890d419cff115b34377b096b482b158f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce74072b-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526527, "uuid": "4e2ac59c-efbe-40dd-ad43-9bfd967f452c", "comment": "Malware payload (Gafgyt)", "value": "4c879ade1c521210c12d412a625a50b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526527, "uuid": "9e5336c9-789c-4d2e-932d-6392e8a7ed4e", "comment": "Malware payload (Gafgyt)", "value": "3d6ac8d6669223ed6923ab02678039853091646a2e97e96c348845ffdd7f4452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526527, "uuid": "a7d2cfc6-66be-459a-bff5-0563c279eb60", "comment": "Malware payload (Gafgyt)", "value": "e1152c877fa38a7358c9007979a9fb83ac8de651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526527, "uuid": "990a2204-5d88-4747-8d51-643eab260388", "comment": "Malware payload (Gafgyt)", "value": "1f827a4407ceccbabe4737fca0d265fbf5a53a7ec217d12be725cfdd5a98d4014b5372c6cec41951a507e334baa9be79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526527, "uuid": "1946b701-b001-4948-af53-5617a4474cfb", "value": "T1F7C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526527, "uuid": "834a4398-fb05-449e-9be9-a22ffca14d71", "value": "3072:hQrFRNfuLrGhEPOD0kg3gNlmBoHQuQekQnYW:IFzuaEGQkg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526527, "uuid": "ab524ba1-04a0-4d6f-ba45-7c1ab71aacda", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526527, "uuid": "e8a3ee88-3557-476c-996a-f0dffac73e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526527, "uuid": "ded16a56-b238-4c52-a2c1-79b5256237fd", "value": "4c879ade1c521210c12d412a625a50b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbb6eae-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680533589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533589, "uuid": "6ef00459-b70d-48d7-8fed-fc6f133517ec", "comment": "Malware payload (njrat)", "value": "fcb6d1595bd28ad804ae6602f95bbf2d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533589, "uuid": "d13d034b-58e6-4d22-96ad-532c526d58e2", "comment": "Malware payload (njrat)", "value": "3df6ef416509ff882ee340be5fb7efe8b41aa8ba5f54e9cd798c5ea509ade15c", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533589, "uuid": "b980b22a-0d48-4503-a6e7-2f9100e59f37", "comment": "Malware payload (njrat)", "value": "1a95cf9be1bfd458e033304a9e21dcafd2590bb4", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533589, "uuid": "9424f470-a883-4c82-87c8-b5f669ba48e9", "comment": "Malware payload (njrat)", "value": "c85e559ba981eb74f645cb35e4d743e4a81a7118e1626c75626d84a128f82c7a16e42444fe9340c5d8381ca53d3eb59b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533589, "uuid": "0dde96c6-7615-4105-9cfc-1ea2f39e1d0f", "value": "T13692D60013D082F6CD7803755962D66157719E8789E6DA1EB4CC6D0F3F73D0A82BABB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533589, "uuid": "bceb9e5b-c1f7-402c-a745-758c885e2b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533589, "uuid": "3e2a2f33-2663-4312-a2d6-9ff272b7ddda", "value": "384:LJoowAXKsk8rNxeL/PSfi3BpzxmyAe88pvP96uaKSmKJX+ptYcFwVc03K:LFwAXKVpfp1myAe88uKSmKJXKtYcFwVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533589, "uuid": "4cc72bcf-8444-4656-9f21-44380bace649", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533589, "uuid": "11205d54-5ad5-4090-8e74-b693687d35f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533589, "uuid": "a817de9e-8bbc-4377-8e29-6303b04a0b79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331f5f77-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524548, "uuid": "12364f3a-5853-4794-8a03-63ef8215a1ba", "comment": "Malware payload (SnakeKeylogger)", "value": "806b8727fa5b82b31788d0cb19d02a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524548, "uuid": "753e4d57-d331-4cd0-8214-29006e6126df", "comment": "Malware payload (SnakeKeylogger)", "value": "3f532c71983108b99522f1a36b7f02c8b026181bc90acd813a7d4b506969873b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524548, "uuid": "d24b2ae7-3002-4cc0-8928-99c0364cba9b", "comment": "Malware payload (SnakeKeylogger)", "value": "1919e9fa9d9b209bf5f4ba4ec07a58284304fe7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524548, "uuid": "212ee691-a497-44a4-bddb-b3aa3e40b676", "comment": "Malware payload (SnakeKeylogger)", "value": "79a05e5ed125bc9c1ef1fc9457efeca08cbe989d1cdde2f524897b270a16352af1aae904e1fb4c3af3a8da11cef586e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524548, "uuid": "cbc0ce08-1397-4e5f-928e-b03a186f05b7", "value": "T123E422283669F73AD87447FB5063960503B6AA2B2053D77E1CCB5CEB8D22F94CA55C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524548, "uuid": "eb6440a4-ee26-4ff6-9c16-1fa064f4a05a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524548, "uuid": "6dcccc6f-f370-40f1-8c36-395dddef0326", "value": "12288:l5CBWKdq1FbwwJLwr4F49TPuxthxbotH134JyA6EYVZo0szaojqnIcpu2ojP:OfrpcF4Ju/bEH1IJyJ66Ic0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524548, "uuid": "1be45b6b-71f2-4693-9c3f-b6e27341ddf6", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524548, "uuid": "7940bd2e-ec87-4e50-a104-1c99c92d7f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524548, "uuid": "bd58b79f-2933-4697-89ff-3dc6c2e4beac", "value": "x35SSsMqjmCaWNZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb4d815-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496164, "uuid": "376c83a8-0596-49ef-ae92-e58e3fca90d0", "comment": "Malware payload", "value": "83022e0133fabfbd686d3e35d46ebd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496164, "uuid": "5f31ba9b-bd16-4a2a-86f4-d32fa7175820", "comment": "Malware payload", "value": "3f8d29682f22150dde700c13c6cd67c7677a894f46b0e53e9fc51ea34387ef44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496164, "uuid": "87e54bed-91d2-4487-84ab-3406f1cd4a4e", "comment": "Malware payload", "value": "c0b35191c2197da7968148f8dad3f97abf35723a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496164, "uuid": "4dd275f2-2f8d-48e3-8f1b-ecd8fb753b57", "comment": "Malware payload", "value": "cf309cbae74a0793361e55d36256a661dea91cfc76ac168305a0bb721e4cb870bd87f65c050c3dc08a1b65bae0a20855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496164, "uuid": "9721eeba-e474-4208-9c22-7a98a300cd26", "value": "T1DB55CF55B9F166E0D7411BB00D666276ABB9FC910B04CF87B268FD5CAA330C0A5373DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496164, "uuid": "2e65fa18-0b8f-4159-89d5-dcc0dd02f993", "value": "12288:pZ2aHJNQz4EgDGFc+Z2b3hnnyQ9psbgt1KaY9iAPwozP3cvYGs0iXJRVm2:p/N4gDGFZZ27hndg6KR/lcQr0iXJRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496164, "uuid": "5d32a72d-e111-46db-be60-70a69a9d0aba", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496164, "uuid": "638d6f4c-b663-47f8-826a-5368b8f61747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496164, "uuid": "a1be7634-d29c-44ac-b39b-d07b52c061cf", "value": "SecuriteInfo.com.W32.PossibleThreat.25436.27496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c59e432-d237-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680537019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537019, "uuid": "68b3c26b-d24d-49a2-a197-526c48a167a8", "comment": "Malware payload (DCRat)", "value": "43a7788887c7f33f64c3e86210d13618", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537019, "uuid": "c83a65d0-50ed-49e9-9caa-6d4d6fee02d3", "comment": "Malware payload (DCRat)", "value": "41f0b266c4b8d14e6e2533021d084d61023d1bff5827777734eee769409b69fd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537019, "uuid": "0aa7256c-38fd-4a42-9021-a0a85ae904a6", "comment": "Malware payload (DCRat)", "value": "4f073c3e9c6f7cf2ffa4393097a96fb0723fd998", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537019, "uuid": "695e1179-eda4-4e01-ae72-34ea20ac9d07", "comment": "Malware payload (DCRat)", "value": "7f258916d9a96d83ed83829752bb7b9a28396896eb56c020d0de70a882112e9934386045a85d022bace705ea70f8d314", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537019, "uuid": "b2086e91-f384-47d6-ab8a-50a458c39b2f", "value": "T1CF050203FD918872C5521D315B25AB12A83CB5201F95DEDF97854B6EFE221C0EB36FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537019, "uuid": "34f0ada4-10e3-43a7-8236-4c265151da11", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537019, "uuid": "3db76182-638f-4969-bd9c-63addd0e937e", "value": "24576:eGHCm8uPdJoxu7xBLY5ea/T14N0WBQXDEV03:juW4Qxi0C+N9iXYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680537019, "uuid": "526689d6-59a7-4c62-8ed7-f648c97b772c", "value": 820762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680537019, "uuid": "dc14c635-2f96-4c3a-9e8e-da176bb7ddd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537019, "uuid": "1cdac6dd-f243-430d-a0c6-033e1a30ce8d", "value": "41F0B266C4B8D14E6E2533021D084D61023D1BFF58277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c21db8a-d27a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680565822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565822, "uuid": "ef3e9b81-415a-485e-82f5-1944cd543f82", "comment": "Malware payload (RedLineStealer)", "value": "caf478735aae2ffdcb3fd7d39090416c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565822, "uuid": "91d8ca4c-bab5-4366-9cec-2b4ccf96b411", "comment": "Malware payload (RedLineStealer)", "value": "4297e18ad26395f9f82b716d9e0ede9ea6b38bcb0fa2be7fffcd6d43e71aaf87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565822, "uuid": "8a68ffc1-b716-4fcf-8841-3065f321ddda", "comment": "Malware payload (RedLineStealer)", "value": "ac5e9d83541ac820938aa8d393001070af44f330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565822, "uuid": "3ece3825-50cc-4170-b80e-6350a71c0420", "comment": "Malware payload (RedLineStealer)", "value": "b190895aa5c4fd6bb2007823add5068438c6a92c2464c9f65d098d56de51458896752f955e09984a284c1711fe54c456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565822, "uuid": "9adf9510-ad06-464a-b267-6effa8d3f9cd", "value": "T1D394480E6A84B473D4A23D721A715711553B69200AF48D8B6FB82B1D8B337F39E3176E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565822, "uuid": "b7ce5aa0-8167-4bf1-80e6-fac8a4022d8d", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565822, "uuid": "f4151c17-8c64-4954-affb-ae053d52807f", "value": "6144:5TouKrWBEu3/Z2lpGDHU3ykJYdKD/3Y4x5SJ4EkOe:5ToPWBv/cpGrU3yhdKz64ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680565822, "uuid": "01202b08-27c0-4bc3-ab64-44919ce32f12", "value": 420840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680565822, "uuid": "987f73e0-0a5d-4276-b539-0eda88973088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565822, "uuid": "7b36a73b-ffa9-45cc-a17e-58009c3e9529", "value": "remittance advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c2e3ef-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1680533592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533592, "uuid": "d1f7ed47-bed5-4823-914f-3314abb15d39", "comment": "Malware payload (LaplasClipper)", "value": "ebb91f36dddcc249a0a99fe6c91b3327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533592, "uuid": "5881eaaa-3d97-40e8-8a39-3ab31a7d0117", "comment": "Malware payload (LaplasClipper)", "value": "42a55a367750fc5e5c7583b413d02166bd5fccfc48c124e35d650b1878f25bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533592, "uuid": "6490280e-7c13-4884-8a62-2fd6534bb823", "comment": "Malware payload (LaplasClipper)", "value": "46823571b6adc8278ae0031ee8843a67cb8eda47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533592, "uuid": "b714e59e-0580-4114-a69b-b02060ddf32a", "comment": "Malware payload (LaplasClipper)", "value": "22b7aec115e4cc97c6fedd0cd3f758d3d4d8be24562987664e5a9a1d672a361cb0146eadda8f0eef3e074ef777582151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533592, "uuid": "5f841cf9-a41f-484c-8219-55bc7abf3cb3", "value": "T1DC348E11B9D1C472D472123609F8DBBA5A3DF9210B7249EB73E40F7E8F206C29B35A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533592, "uuid": "e91fc1c0-2391-4750-83d1-28415cad0df2", "value": "f8c12f7b1b7b68b646d178437ec9f983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533592, "uuid": "afdd6707-f507-4f72-b125-00ba9a8477ef", "value": "3072:wXUhQztlGtv5H3IboGhDuqaoBHZ9AWoKIJaBnS0sztA4lmS/r+KWVOAg0FujDFkF:MzM54bisZ9ACIQBgz/ldnAOtsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533592, "uuid": "bbee05aa-e3c6-4560-a342-bd069d00f1c8", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533592, "uuid": "d4b239b3-5cab-4554-937d-005a50b22018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533592, "uuid": "b67de147-1378-492c-9128-f3f99c0e73c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f180b5d4-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502534, "uuid": "9c3ce028-abf2-404c-b1f7-0cbb3426c500", "comment": "Malware payload (Mirai)", "value": "b726adca0e785aea2cb5e168c1f0a5af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502534, "uuid": "af194df3-bb10-42a9-ac6e-7ed0dc8ed7cc", "comment": "Malware payload (Mirai)", "value": "42fae824c78bf63ea8e8cecf9f414840fb03d91462ffc7afa3400927cb80b78a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502534, "uuid": "28b2161f-44c9-4fe5-830b-2b8f82baaeb4", "comment": "Malware payload (Mirai)", "value": "7cc3b4015f17f6ffac8a244ec51d581beb1653f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502534, "uuid": "7b628124-9576-417e-8a4f-996079e7c470", "comment": "Malware payload (Mirai)", "value": "e43e3fcb82e25ce4f18381c795fa87a61bb0870fa7feae21e78c9ab7e382fbaab9da4bf31e0a8f51db8268f12d6ea71b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502534, "uuid": "bf75c68c-b132-4d7e-af0e-9398e58b6283", "value": "T13383A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502534, "uuid": "d3b9d80d-b119-4fb7-9594-5d96ddad3207", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTU17ZDYovZ73x/nL8y8O:Rakdn2Eo3ePu5GTqRYo99Be037W+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502534, "uuid": "f6dc89bb-127c-4a75-95ae-ac09b91b048d", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502534, "uuid": "df42128a-7b77-41db-857e-b0b81fce2b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502534, "uuid": "4013c365-70bf-4e73-bb7a-5188772b214a", "value": "b726adca0e785aea2cb5e168c1f0a5af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ef53f6-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1680501310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501310, "uuid": "921b3805-8916-4f2a-a67a-5dde83f548e0", "comment": "Malware payload (ModiLoader)", "value": "616766559af63faba9405d0b12a74746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501310, "uuid": "8489ffbe-a2df-48fd-b66f-8148f27c3050", "comment": "Malware payload (ModiLoader)", "value": "4498da76509e6b2062980a910edcef9f620775c7b7aeecde984f157c00dae4f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501310, "uuid": "93f1e7e9-edda-4ece-9139-90146a09deed", "comment": "Malware payload (ModiLoader)", "value": "14b8871ba7809703ff7ef0db025e27b7256a3600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501310, "uuid": "173fe733-2655-4001-bd1d-fe900ac2efb1", "comment": "Malware payload (ModiLoader)", "value": "158807c3ea9c8cc7b76ab8986a39d63c04e421f2644c6073dd19de7165de9d8016250d3202671dbb9015aed1dd49b5d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501310, "uuid": "79bce696-c830-4be2-86b5-1b32e6b425fd", "value": "T197058E25E660E933D35A3A78CC4B93947C2ABD612E1764423AFC3E5CAF356903B24177", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501310, "uuid": "2d22966a-1d85-49d0-8e6d-6072bbb26a1f", "value": "5710d974d303962d4a1254e8085feb40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501310, "uuid": "631abb16-5858-4693-b344-e986421fdd71", "value": "12288:1xkn6YuwDEgW0+K4tvzxn58XdUpGHnSieAi+ZQ643VaxBP:nM6yG0+hhzxnidiGHSi3luS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501310, "uuid": "c8d042ea-cea3-40f4-9679-d9e3497b144f", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501310, "uuid": "8c9db19f-1151-457b-8976-224c35bcfacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501310, "uuid": "f4b51479-e14e-4984-98ba-d9ad77f05764", "value": "Nova lista narudzbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dff6d5-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525486, "uuid": "53fe316a-906d-445f-98a3-10343cc04f97", "comment": "Malware payload (AgentTesla)", "value": "92b778e6419a8f632fef4768e97f7075", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525486, "uuid": "09ab39cf-399c-4cd0-aa93-d08e9156a2f9", "comment": "Malware payload (AgentTesla)", "value": "44ef1bf0090143868b6397ac30c5a5f3ea6b83dc8013cb4b57c691ddb5d88b9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525486, "uuid": "e8f77e0a-1658-4140-a1eb-1495d23404fc", "comment": "Malware payload (AgentTesla)", "value": "7c4d96617b6ecf6188273603b549ee166f30cfa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525486, "uuid": "ca785fe2-53b9-4632-8f08-95272ff9c19b", "comment": "Malware payload (AgentTesla)", "value": "dab865187ded0ed73040db65d8f2c85a574464e5c5fb1fbd14a1c0cbfe2a309432455fabfb87692c6b5ab11f56289158", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525486, "uuid": "867c4bca-1dcc-420b-ad24-b8aa126b81d5", "value": "T1B6D41248322C9E27CE6F86FE9125500943759636BA0AD7CA6CC5A8BA75F3FA44401FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525486, "uuid": "e9417445-42ee-4917-bb2a-a1e047a81742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525486, "uuid": "0b646b31-5747-434b-81a5-4cae26c07f81", "value": "12288:johtzLwr+6groWG01dZ33daezVE69Lb7gKtaAEpf6QCtOy:hi7J3z3t869Lb7ftaAEpfPC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525486, "uuid": "89d58f29-a60f-4a33-8880-39c63036dc90", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525486, "uuid": "9d629b19-8eb4-478b-9981-8127d330a45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525486, "uuid": "5c5de7f9-f506-4f42-9bd5-f69cf96d7b2d", "value": "92b778e6419a8f632fef4768e97f7075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07680e4b-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501282, "uuid": "5dfd5103-1916-4834-9c99-710647cdf865", "comment": "Malware payload (GuLoader)", "value": "8ee10213a8319fdec8c2229e264a01d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501282, "uuid": "47c83c50-c4af-4456-b52d-52c82b433255", "comment": "Malware payload (GuLoader)", "value": "4506e6e700c4e9b899f09c826a0d34a4a601654ce891dec0fe5a62dbb89f82e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501282, "uuid": "7b2d7327-b866-49de-8538-c186ac8b8b1a", "comment": "Malware payload (GuLoader)", "value": "c4e084201355eb124444d2ef58e049386fd0fb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501282, "uuid": "23177e75-9b98-45e3-a049-8b8892863f61", "comment": "Malware payload (GuLoader)", "value": "f92f0af78c3ec670a444294426a2b825eb759a31b40172e2e6e934038527365e214d820eb8bba2d90db0b586ffcb4aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501282, "uuid": "9b8fd4d2-236c-484c-9afe-755026c39d34", "value": "T16B7402B57A488EA3CA750AF144371E8559D3DD1203E2628F1B247B9C7C7B382972F993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501282, "uuid": "498228d0-4aa2-4520-9286-7a62707227b0", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501282, "uuid": "6a2c2ccb-2a66-4de4-b314-e9a4dd1295ef", "value": "6144:yPXlu0E/c84v3K/qVkEizYgANMNMK9QlOMMWVJvVyn2hsXWyVjrKr:5/GvK/qDiLBKfIWVJvV6C/ypa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501282, "uuid": "fdd304b6-4bf7-4bd6-a7ac-9a950244392b", "value": 347176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501282, "uuid": "52c46f94-bc4e-4b6f-bbc5-0928bfcfcade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501282, "uuid": "4f3acb6e-244e-4b70-8481-e1bfbd730470", "value": "008100179377_INV_AWB_20230329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1500273e-d1ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680505600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505600, "uuid": "d24cf468-7abc-4106-8898-95c4a1cb8147", "comment": "Malware payload (AgentTesla)", "value": "d3fea9f328fda4aacb4b5076701ce969", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505600, "uuid": "d5cbacb9-1381-4277-b841-ebe4dcfb41a0", "comment": "Malware payload (AgentTesla)", "value": "45981fd05046a30bdeb47e1976b3eb1c82d445647213095ca17168e1eb35be7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505600, "uuid": "8329e5be-ae7f-46e8-9645-5132660f3234", "comment": "Malware payload (AgentTesla)", "value": "fe23b935f871609c836b1b5cc4c598da2785f970", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505600, "uuid": "c91bffa9-520f-4af9-8ce7-24084a2a7010", "comment": "Malware payload (AgentTesla)", "value": "295dfc5355af0957614e33cfc516bd4ccb539429761d39b1cd3ec3f5aa3020b9968a1bb8c148015f9f4efbbeeb414598", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505600, "uuid": "5a2a2db9-2dec-4837-91c9-9a553870c75e", "value": "T1FBD402AEB62DB227C9BC02FBC421B15D03B0D92A6143E3DA8DC464FF54A77D089166D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505600, "uuid": "a5e8093e-6bd3-46a7-88c7-f3ad9a2d7053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505600, "uuid": "3eb49244-f095-49ef-8bfe-956c95b0ca05", "value": "12288:4D/OVtLVzLwrm1SR9nSzvGvr8+MF561/To+E4eK9QCZ:iwSYvGvr8+M/61/k4l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680505600, "uuid": "91c9ebd2-3863-4e73-a76e-d95168d7f4dc", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680505600, "uuid": "0cfc0c2c-0337-4249-aebe-bcc9bf10a3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505600, "uuid": "79f8b2c9-fa57-47bc-bf80-f80682a7fbd0", "value": "SOA 22011~2302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472508b2-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525011, "uuid": "e31ceb40-5656-40e4-8191-d6959b3343d1", "comment": "Malware payload (AgentTesla)", "value": "3f1c97d2f5200204e711e812b63b2b99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525011, "uuid": "216ced78-3c50-4a16-8b45-056af164ac15", "comment": "Malware payload (AgentTesla)", "value": "45a156f54da1d261e560ed2ebfd861aca470562ccca7878f44421de8089c224e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525011, "uuid": "933ba9cf-c09e-4313-8e1e-3b3c4cff2268", "comment": "Malware payload (AgentTesla)", "value": "b7edbc37fd17d4b1d890ffa5565b548f4aebb40e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525011, "uuid": "fed6da61-b6af-4778-b220-f22e86e1690b", "comment": "Malware payload (AgentTesla)", "value": "27923a4a9cb53d7fb5f05da1fe189a5595f52352b1efe5b45cc4c14f3810a7ee57109811ef9fdfed8ffb8331e9cbe343", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525011, "uuid": "1a47ad64-db5c-4484-8851-50f62f25dd1a", "value": "T13B24021986F47D5EC86EEFB620DD44201FB4B365FA82CBC72D0964590AC93823FA2357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525011, "uuid": "06be1a38-d87e-49e6-876c-9face93515f2", "value": "6144:fYYUtx+U3w8fg7Mv2D7mtGB8BHVQ+zJcM/PA6gLnqI:fFUt4eq+2Xmto8BjF9AuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525011, "uuid": "dc979b2a-c413-4e32-b4e6-405be22f538d", "value": 225512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525011, "uuid": "6bd15383-ed64-4de7-8f73-480904001226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525011, "uuid": "73789a28-dcbc-473e-8e39-ca2d09ad9235", "value": "Dekont,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ef522d-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525601, "uuid": "b6919925-ccc0-45af-940e-35a615150a96", "comment": "Malware payload (Mirai)", "value": "32ea1682db7ca44cd904260ef5c38e75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525601, "uuid": "fb84d8a4-e3c6-4bfd-84d2-cf599005cabc", "comment": "Malware payload (Mirai)", "value": "45a59b4105b6fe22ea5752203922b547ce669d0eb0f1d4ce411c8994f456d7e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525601, "uuid": "a4ef59a5-8a8f-4863-9672-48c6ba21082d", "comment": "Malware payload (Mirai)", "value": "c85d554159e9888c8bbd5d0b08ec13255648d239", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525601, "uuid": "50448dfa-b527-4a86-af83-09ad22a98542", "comment": "Malware payload (Mirai)", "value": "32735d92bd407dc10158702665e8f5ea353dd4b03ae72b63d08fde8e740049b726767549f5edbd47e93184ed032b26ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525601, "uuid": "34e8d564-3259-4e40-8def-985d63d498b0", "value": "T1F6336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525601, "uuid": "e596530c-7d02-4e1e-aac8-ad83187be87f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525601, "uuid": "c75b95d9-f6b1-475f-afe6-8da64d172615", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525601, "uuid": "ea2b6427-4a56-4f59-9ebb-b29846f59733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525601, "uuid": "34f3c023-8c14-413a-a047-b59185ba9f3a", "value": "32ea1682db7ca44cd904260ef5c38e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a1e928-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680528492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528492, "uuid": "ad2bc4f1-c65d-444c-82b3-825a4942b9ad", "comment": "Malware payload (Formbook)", "value": "419686a82483666aef999c303eaad364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528492, "uuid": "9e480ab8-09bd-42fe-a1c0-6a790a3fa59c", "comment": "Malware payload (Formbook)", "value": "4665c6ecef9d50ede04cfe2946684aead2040e9e1321d6324801e18673f67271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528492, "uuid": "c8bf31a4-8e5b-4f37-9814-31244733d745", "comment": "Malware payload (Formbook)", "value": "e9cddce3b067f44da00cc4989b2bc765114693ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528492, "uuid": "c7426c67-ad6c-44e8-b153-580b140aadd2", "comment": "Malware payload (Formbook)", "value": "e088498b8bda7c555930e09b965fe5b51babe73712c6f71bcd83f90085ee66c6dda8a5a41b4f1f68e179a3dffc3b0a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528492, "uuid": "ba48f231-388a-467e-a573-9b347c826b61", "value": "T1DEF401743BAB6339F47617BCC1A43A919729B3B32B67C94D04B511CA0753B138E90A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528492, "uuid": "1e56fa2e-3ebe-4caa-91d5-89c5ad0b3d58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528492, "uuid": "81e74787-1f7f-43f3-902c-7c68bf1b872a", "value": "12288:WVemYMUnFW/NXb6D5Oqz1+UzJx/MxQV+yRD6v4jzVuMI2T+5tuTGlcra:WVeUF0Qg0ULp+y56AnkM7TktWqcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528492, "uuid": "0d6b1ec6-6860-4be5-a9a8-3e54357dc121", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528492, "uuid": "c3d39522-c913-418a-93db-d3b8d98f4212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528492, "uuid": "0ef431f5-f75d-419c-a0aa-8fea85727680", "value": "4665c6ecef9d50ede04cfe2946684aead2040e9e1321d6324801e18673f67271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4641b0b9-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526728, "uuid": "c0f7f486-2b02-438f-889f-97263bbc6d22", "comment": "Malware payload (Gafgyt)", "value": "f451b5b54d19f10ce49e1b7386b7f69c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526728, "uuid": "bfc145f0-76b9-4490-859b-888cf4651a74", "comment": "Malware payload (Gafgyt)", "value": "468d913f288f64cdb1a7136c957f7d28a027ae3124498f9e4c85a14b8c192048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526728, "uuid": "d46712ee-a6a6-4753-93b7-d7cdcd3e95c2", "comment": "Malware payload (Gafgyt)", "value": "37f65d64e3564eef91f28fa7780876ae83c2d730", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526728, "uuid": "cdca6064-b1be-4b22-91ea-77ebe8e107f0", "comment": "Malware payload (Gafgyt)", "value": "8ed4f851830865cb2f27fb6705c9726db6439817332b57007e79047c3f93eb0e0c484ab5e3894084fa5a6f316d33cf38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526728, "uuid": "058dc58f-0097-4ad7-85dc-dd8514b0dbb0", "value": "T1DDB31792F900DFF2F00AE67608C34A257670BF660F536A66B21739A79E721C43827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526728, "uuid": "a15b790b-b812-4677-b3d0-ebadf9c228b3", "value": "3072:DG+3MNBCpCTyRQpimmrytKQs4OWlKhRm2pgYMx3IPtW:DHCTyRQuytxseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526728, "uuid": "64d3e0d4-1b98-4f6f-b630-8760ab88669d", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526728, "uuid": "c1394a1a-eebc-4fde-9284-8302c99ea5c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526728, "uuid": "b49ed6e2-b226-47a7-8d98-10f2eed1c524", "value": "f451b5b54d19f10ce49e1b7386b7f69c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16172872-d1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501736, "uuid": "6f289563-cf61-45ed-9340-f9e68e81e01f", "comment": "Malware payload (GuLoader)", "value": "08422117b96b96d5164ef061bf874307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501736, "uuid": "3ceda5ef-c0b6-436e-a4b4-f285982b1362", "comment": "Malware payload (GuLoader)", "value": "46903e776f2014fcd877ba071d2707c749ddae140e7682f5cc00c894914f3303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501736, "uuid": "0126978c-dd0d-42f5-a5e2-c97600ab76e6", "comment": "Malware payload (GuLoader)", "value": "3ff48d4a298db79468ab8716a9814f2fe703e031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501736, "uuid": "a3cc7f49-4741-4071-989c-de025e9bb307", "comment": "Malware payload (GuLoader)", "value": "c881bb9b181705e5d99f5a3c2ad4fe0a79585e056eeddd70fe1271076bacfc68a7ed1239698dcd3600544f4fe5b890a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501736, "uuid": "91296095-ae9d-497c-8276-40a0fbd83ef1", "value": "T151F412653F94CC27E79016B4A1A4E7BD87B4E9642D69D30399E53DEF7530B228C28322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501736, "uuid": "c3d09887-0237-4536-abe3-967ef408674f", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501736, "uuid": "9b9eaac2-c8a1-4095-a761-3b893354afea", "value": "12288:/ghti/pIS61qK7fXHUoTQDsqRaKbygMG9IFqnWAQsZufEIx5tx715v1:4O2A0fXHUSkdRPy1GRWAQRMIxTR13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501736, "uuid": "49d48615-4990-4909-82a2-35166c4d82cb", "value": 785185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501736, "uuid": "b2d1ed91-db23-46e8-a1fa-37116dcb91ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501736, "uuid": "81d403c3-e8fe-454d-8aaa-d63bebb7eeb8", "value": "JUSTIFICANTE DE PAGO30032023pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd2808f-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680524994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524994, "uuid": "cac9e816-f3a7-41de-8f13-7b6a0b08d245", "comment": "Malware payload (Gafgyt)", "value": "6001bb7728a45b366404daaadc1b817d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524994, "uuid": "80d5392e-5371-4f6a-8028-d2019a530e8c", "comment": "Malware payload (Gafgyt)", "value": "46b8635c70f11f34e223612e0241ef470bfed57ec0793b923cd4a3f720718086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524994, "uuid": "d7ab420a-d144-4ba9-95fb-05d3df0bd3c4", "comment": "Malware payload (Gafgyt)", "value": "cb193eff3ef449e31f200ee87f38682c76410542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524994, "uuid": "8df6ae30-f5ca-49b5-8355-bb5c99bc875d", "comment": "Malware payload (Gafgyt)", "value": "9849ac7c35ee8128da6d939ec726d3868b88e29eb0462039834b02cdbdf1c702e0914bdd505d3e40081417f923874304", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524994, "uuid": "ce8d5d91-dc7c-4ba6-a092-f0b37a2958d2", "value": "T107E38266BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524994, "uuid": "c9ab7e98-8263-4744-9824-0c4ee9f6d8b6", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVkpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflKgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524994, "uuid": "47914220-35e0-4818-b220-6776b0895d77", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524994, "uuid": "3a5d0550-952a-4f65-ae62-e8f5d91791e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524994, "uuid": "2cf23dca-da33-44df-830a-48341edcb2ed", "value": "6001bb7728a45b366404daaadc1b817d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058d6027-d251-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680548094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548094, "uuid": "06911c5a-570b-4335-aff0-45bf5a8e1794", "comment": "Malware payload (Gafgyt)", "value": "c2bd76e251e8bb0c23aeaddc29cc9009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548094, "uuid": "07b15126-682e-4ba5-a964-96ef0d088cde", "comment": "Malware payload (Gafgyt)", "value": "47bee2e3d9bc2c9e8e7b162e20896d15f295d095438dd4bae89efbd9fabef977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548094, "uuid": "dc643573-b882-4ff7-88b2-ee873ee13d48", "comment": "Malware payload (Gafgyt)", "value": "ae90fc5754e5c2913bbab2e57948fb91163de6ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548094, "uuid": "279fdf92-6f65-4731-b9bf-6502e4e4e6b6", "comment": "Malware payload (Gafgyt)", "value": "b39797279e4307d2f52db1b679448d2570a646191c392c49a56fed63c2be78ee97460fa5a9eed6a402fc1368d77b32b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548094, "uuid": "5398b7e1-2a87-4d95-b228-3577a4de5419", "value": "T1CDA30837A552C77AC0C362B417CBD9619C23B4FB8732721B33B96DE42B1A9C92D59B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548094, "uuid": "e2ecc104-e70c-4c1d-aeb9-3e02604e7a31", "value": "3072:Nkzqmj28SfJ4NLLBDtCJSgDoGum/KWOXA7aZYpe:18SfJ4VxADoGum/KWOXA7aZYpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680548094, "uuid": "f0bc5ea1-e52d-4b99-a8c8-9a65fabe12dc", "value": 105027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680548094, "uuid": "6622c83b-0612-4664-aae3-116d2bb13fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548094, "uuid": "c88791a9-b6a8-43b1-b296-261970947160", "value": "x-8.6-.Hellfire", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3e327b-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680522255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522255, "uuid": "697a9209-3f9c-4f17-a9bd-d9b373372376", "comment": "Malware payload (Stop)", "value": "f22ae52f2434a2203e71423aa189e7ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522255, "uuid": "e138362e-e902-45dc-9244-a1e2111a6fd7", "comment": "Malware payload (Stop)", "value": "47c30977596a3c9dfaaeb86fae2200bd2929ea03b7092cf32c96fa9768b98aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522255, "uuid": "829651be-1ec5-488b-a6ad-59a236758835", "comment": "Malware payload (Stop)", "value": "c45f5f08879e47e6a48257eb125744ca4b1a1472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522255, "uuid": "a14e69b8-651c-4f6b-9a68-ae38d753e263", "comment": "Malware payload (Stop)", "value": "98f3fa4b1a1c1d98ef672f2afc4ef63b67bbb46eaf88ab3ddd0b783ee91fbac6804fa1c9c45694262c6665f14d9a1bee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522255, "uuid": "f708dac3-9ffc-4d85-abaf-4e6de55f5f1c", "value": "T13FE41220B1A1C4B3C51B49784412D6B0272FFD325B69CAA7239807BE5FF13D16F3A666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522255, "uuid": "dd4b2bb1-37a1-45c7-9ab2-f92ada1dedcf", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522255, "uuid": "5d9d6b74-30f0-4dbb-8ea3-dc52259fd5f5", "value": "12288:KIBIrGI9DHyzc7euF198J7r3LufYERt3EsaJaocxfLLrp/On6p:ty9hHyzc7eC9Q7ufYE/3EsK5MfLLrdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522255, "uuid": "71619521-9b81-4a43-a56b-cba7d0fde600", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522255, "uuid": "35887440-720b-4f82-824b-7704132b4f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522255, "uuid": "34bd5c93-d109-4c98-a676-9ced0d6cd59b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a467e4de-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525597, "uuid": "49dfcc09-e180-4642-9d1a-f0746f542a07", "comment": "Malware payload (DanaBot)", "value": "c60c185372478640db3719e3fa1af4dd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525597, "uuid": "7d4d5b81-8613-45ed-ad31-cd5c33e281ea", "comment": "Malware payload (DanaBot)", "value": "48144fb85cd8a60239303d999fb051a1f4752c4f56a5d7d8abeb1566733ac32c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525597, "uuid": "3cae36cb-ed79-477d-a1d4-bedc52322563", "comment": "Malware payload (DanaBot)", "value": "f0c95e2722ccda1e675396e33bfb88fbc4201065", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525597, "uuid": "7273e047-4c9b-4111-a704-2f32d584d59f", "comment": "Malware payload (DanaBot)", "value": "91c32bb8f3a92bc34df2f17171bcb0aba7e5a6cbda3641443e85f9eca403bb41df7d2636df5442ef39fcf76b7d1b14cf", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525597, "uuid": "14631694-0d9b-4688-bfa8-a884e5ff708f", "value": "T1EA3633D29AE470B0DB2107734D1DC3E6296F7CA1CE06BA5A23DA753B4E34365D2A170E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525597, "uuid": "73de0628-68ab-45b1-aa73-11d357eb3e33", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525597, "uuid": "c124e66d-2a35-4f73-8d74-9aeb4b47db93", "value": "98304:YnS0FE58IEdB9p5aCvPJIsKpl1hoE6/RFm2G1krcAS89kdbHByot:CHdfDBaP1WNmKTUcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525597, "uuid": "43db3d8c-36d2-4708-b383-9830330bfc94", "value": 4947456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525597, "uuid": "972e1d4b-3c9c-4531-8478-76ff0d91c898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525597, "uuid": "d49adb2f-9af7-434c-a337-a713064ded46", "value": "c60c185372478640db3719e3fa1af4dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f77f472-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525482, "uuid": "50cdc02d-b978-415a-bc70-69850004304d", "comment": "Malware payload (Rhadamanthys)", "value": "ba088732d44be132a71090b44a92a184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525482, "uuid": "b9ff2b1b-39d4-453f-ba1a-472c5fe9bbfe", "comment": "Malware payload (Rhadamanthys)", "value": "481920cc54ecf2c808fbf29cff0376e792afe6b10bb44737ff4b782b4e735db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525482, "uuid": "4f75413a-fa3d-4d9d-9628-8dd7da24c818", "comment": "Malware payload (Rhadamanthys)", "value": "138578e60c5239c5ce779b65638705f9c85aa18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525482, "uuid": "438aae2b-0157-4096-8e94-fab55ba825dc", "comment": "Malware payload (Rhadamanthys)", "value": "55f88ba7cb9f12249da6f94b89aad51ce7fd45aa4d37c75bb272af4a52b6d9a6c270395a467b46a11f23bb739dc6f160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525482, "uuid": "7cc02f1e-5098-470a-9da0-bb57a0087cb8", "value": "T12564C04267D0A870E61257334E1EC3F4262EBE6D9E157F9E2795BEBF0D341A1D222306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525482, "uuid": "398fe8c3-5422-498e-a939-7f1632ede224", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525482, "uuid": "8877d0e7-b414-44fb-9b9f-b32321dd151d", "value": "6144:gwQb1gglc7q4S84O31Hy41FhgmY5Ztkjt:gw41flcFS84Y1Hz1wmY5Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525482, "uuid": "5fcc81e4-6ad6-4a74-9c05-6134e32d6367", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525482, "uuid": "93b04cf0-386a-4855-9070-221209fc0afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525482, "uuid": "70f4ac8a-6dbb-4a02-839c-f2d15a208928", "value": "ba088732d44be132a71090b44a92a184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73358ce3-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525515, "uuid": "62d52c02-fbc7-4804-a8d8-27eaab2c9400", "comment": "Malware payload (Mirai)", "value": "4fc9160d69c64fd299097ee744203f47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525515, "uuid": "d94a10b8-72cf-464e-99a7-abed02a8fa95", "comment": "Malware payload (Mirai)", "value": "492e5150a9be87a4d834b1c6870fdb044e63ba7cc5026745a14d08488a40b9af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525515, "uuid": "d1ca21b9-39b6-44e9-908d-1a5f6863205f", "comment": "Malware payload (Mirai)", "value": "3c55f60045f7ffce463d14c62b7a8fe123ea3852", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525515, "uuid": "3d2546cc-3ca0-4c7a-a74f-8a381cb5c848", "comment": "Malware payload (Mirai)", "value": "bb3c6cc71a956bbd9c92514818e016f8ba60a5815c19cdb0bd47932c7696fc18bdf360dfeb9b295dae7ec9880a5ef2e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525515, "uuid": "58bd56e2-8f30-4eed-9e73-8d00ac13aee3", "value": "T184432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525515, "uuid": "082f2891-093c-4073-a192-db8404562f69", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwT:RqtmZPuutfbltZFBSJsBcfDSTFI+BET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525515, "uuid": "8b4fe4ef-6a5e-4a9c-939e-7f86a0c57e4a", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525515, "uuid": "f6b4a4d6-2a17-43c3-a4aa-87268e79f6e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525515, "uuid": "cd7737ad-f70d-47f4-90f9-fc2c4980f0ba", "value": "4fc9160d69c64fd299097ee744203f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3c4b25-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AnyDesk)", "timestamp": 1680533504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533504, "uuid": "941eb4f5-9bbe-4bfe-ba0e-fbf988aff1a6", "comment": "Malware payload (AnyDesk)", "value": "bd1c7369830ebd781ed5eade64f8f9e4", "object_relation": "md5", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533504, "uuid": "fccf1098-0a41-4b25-a041-a9192b907e7d", "comment": "Malware payload (AnyDesk)", "value": "4a9dde3979c2343c024c6eeeddff7639be301826dd637c006074e04a1e4e9fe7", "object_relation": "sha256", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533504, "uuid": "c393c6a1-972d-42c8-975f-9364b5164d56", "comment": "Malware payload (AnyDesk)", "value": "4f65118960bd8bcc744d62e6f464f8bc82c85a9e", "object_relation": "sha1", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533504, "uuid": "5621707b-7e49-4cd6-bc49-8a0c8aae79f1", "comment": "Malware payload (AnyDesk)", "value": "5fb5bcefe785a6d8fd7f3f26ed88125d1e0eb64359b5ebf9fa7e2ec20338e20159725a944d3e869102aabb90bc62073e", "object_relation": "sha3-384", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533504, "uuid": "6b838c6c-8bd1-4769-8650-2c8ea55cd886", "value": "T194063390D5ACDD37CA4B4230FF92C6214E47AB4D1B6D5F4D432250366312E9ABDEB4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533504, "uuid": "d25b43fc-1838-4848-a4cb-a8cc1d475fea", "value": "98304:jd4d0XlQTMYKcmV540bSdjvDrE1nM7ecLtuM6lyUI:jd4d6oMUmVC0s7YM7x4M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533504, "uuid": "f091de22-dbea-4fe4-a73d-5017e03ac456", "value": 3766512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533504, "uuid": "e7816741-a9e9-4d21-ad90-b1adc8c9b168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533504, "uuid": "06c90c29-75f7-4e1c-aed7-c806c96e72ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dd0ad9-d225-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680529547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529547, "uuid": "d9e4136c-8ab4-4059-bae2-718faafcbe78", "comment": "Malware payload (GuLoader)", "value": "85d4938850ebbcaac0e71855adb522ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529547, "uuid": "6e786cde-6cc7-43d2-830a-c78a692833e1", "comment": "Malware payload (GuLoader)", "value": "4af7a6a64c88b2b820f1d3481e7a6e16bd26bd22abd4c9bbe521564378c13150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529547, "uuid": "b2aaadb8-3434-4392-a99b-1714addebfe4", "comment": "Malware payload (GuLoader)", "value": "d13a6a5fa914a591d03097a5b19516de66ca3a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529547, "uuid": "7e08b905-8a1d-4ba9-84a4-9407c6244976", "comment": "Malware payload (GuLoader)", "value": "4e88a1951c8961d3c93a0be86536b08e63e29e8e1fd37b2c8b4fa90907635279416bf2af2d84004cdac6003bb7495dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529547, "uuid": "dcba4c30-34ec-4291-8f32-2f09b63ea2c9", "value": "T119A4E0663B19D803E35021B48A51E7BD5BB87F982C5A8B03B6E07E9F7538753AC1E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529547, "uuid": "1b33ec45-dea1-4ee9-9450-75ef4e8d1a58", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529547, "uuid": "9c6938fc-19d0-4a33-bae9-c74925753b2f", "value": "12288:AIFEzDgNxvJtKvJ5RZu86xkfWgKF+MRy+:VEzDgNxvnkR/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680529547, "uuid": "3ed82050-1408-41fa-b670-01345f39b48d", "value": 468342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680529547, "uuid": "aae25bc3-27bc-4c80-9a28-a96684810ff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529547, "uuid": "c8e0d567-ed20-4db1-a67d-143c35f69894", "value": "4af7a6a64c88b2b820f1d3481e7a6e16bd26bd22abd4c9bbe521564378c13150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3b4f99-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525555, "uuid": "5528b7fc-ce42-49dc-bbb7-e23263d82924", "comment": "Malware payload (Gafgyt)", "value": "bf06b67f5a47c05cbad171e7c0c38bd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525555, "uuid": "fa82c998-4547-45be-be83-b0a55fcbc9f9", "comment": "Malware payload (Gafgyt)", "value": "4b9e9f2caa43ab769514fd7b050cf3f6cd214349082e688694c7e62550ed012e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525555, "uuid": "59aa099b-5263-4626-9734-919d0547b62e", "comment": "Malware payload (Gafgyt)", "value": "6effa17831582b82172209270082ec1bf85ad098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525555, "uuid": "3f5cbc7c-595e-4dd7-bfee-1ea2239c1c92", "comment": "Malware payload (Gafgyt)", "value": "18073c9a206a35a7365ac8115aa1507f719b0851ebcb84fd82dec0298aefcbd2304cf0416b70fdaede035288293f75e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525555, "uuid": "1418ebd6-6007-4ede-929a-f3eb499f8197", "value": "T160B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525555, "uuid": "e2d0c518-f747-4e7d-9d00-673843d06397", "value": "3072:WD3l+XQzPeV91310pWudiKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCiypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525555, "uuid": "8c886d72-bfe6-409b-9276-9c746139364a", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525555, "uuid": "08cb221c-c047-49e4-83a6-ea5088515e87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525555, "uuid": "bbfe2f56-73c9-4964-8a82-70f7a79028f5", "value": "bf06b67f5a47c05cbad171e7c0c38bd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da759a2f-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680525688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525688, "uuid": "d428d84b-778c-4731-9e78-4ae81719914b", "comment": "Malware payload (Formbook)", "value": "673050267de4c8be5859237473cdaf50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525688, "uuid": "cecd5c3f-e615-466c-ae3d-faf452ea83cb", "comment": "Malware payload (Formbook)", "value": "4bb5c10fcb7717122975cc15514a7ffbfb875edf44d773e4f903df9d1dd5268c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525688, "uuid": "835a5312-3b1e-416e-861f-60c0242d4d1b", "comment": "Malware payload (Formbook)", "value": "1ca1009fe6a04f13af4070ed438f9799611f798c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525688, "uuid": "28cad9f1-0d18-4159-93c0-b9d748896e31", "comment": "Malware payload (Formbook)", "value": "3569aa04b3ab9588d285b5774e06439675375a7a43f11b297ceadab0775479c29fd7da40bce5531d1ffa288ba60ceea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525688, "uuid": "64ef0411-b464-4602-9b52-6e8335cd4349", "value": "T1A984D0C5F900D5A6EC2A97312A36DD3226037C3E54B4291D2BCE3E7B3EBF0529416A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525688, "uuid": "5bfa7779-71d3-44aa-b738-82962b1f5319", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525688, "uuid": "6d673dac-2946-4fcf-bd5e-da454c00538f", "value": "6144:TYa6SIMWTixbkPmme/0Mcj1k3CCImbNCo7ArthYieU5rwk17u+o5tZtYv7tOpyXe:TYVMW2xbk+mtj1oCRmRCZ0ipf1S1tWEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525688, "uuid": "fa83359a-bbc0-4644-aade-26827b02307a", "value": 375928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525688, "uuid": "2acb97f3-085c-4b36-b0fe-47af3e6841b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525688, "uuid": "7555d2db-ccc9-49e2-91ba-05580f0b1bbd", "value": "673050267de4c8be5859237473cdaf50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f0c242-d213-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680521592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521592, "uuid": "f28d2ab0-3818-4ddc-9569-d245a0a9a34b", "comment": "Malware payload (CoinMiner)", "value": "814ea55c72992dadf16d26a257c3306a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521592, "uuid": "9b527638-a330-4956-bef3-042275bcb2bb", "comment": "Malware payload (CoinMiner)", "value": "4c6cda13cc66679084dae4cf3d724f0de7f07572c6c41010c7c187cb265b7f6e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521592, "uuid": "0977f91a-e375-44a9-82e2-39f4328b5a74", "comment": "Malware payload (CoinMiner)", "value": "6eb916e669a418c013bb3ef75b2be7e05605acc1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521592, "uuid": "6889114a-f45a-4beb-84ff-fa3f772a26fd", "comment": "Malware payload (CoinMiner)", "value": "351d3ec73efc217a114766c4de6307e4157929dae9a2479613f6ecf28be0887c67c6776ca8f031240e7e02d9b780f29f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521592, "uuid": "0fdfc42a-49ed-4750-902b-f23e98fffde2", "value": "T186F5330E28925831E7D7DA70623A0B921BE7C125FAE456B31417C0E6CDF3D07B97A58B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521592, "uuid": "83285d3e-53f4-4e0a-8189-b340f34f2acb", "value": "4f0aa5246671bac81facee87baa42ea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521592, "uuid": "6db098fb-28a7-46e9-8189-b50a3dfab649", "value": "98304:bK1xSdXvKNmorEZCXZcVrx5EibycA63ZZQi/hmnbpHWXA:8mohXZyTl+d63pmVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521592, "uuid": "02d46d98-070d-4ec9-bea9-5f458a3a67a7", "value": 3576504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521592, "uuid": "dcee278a-c523-41c7-9346-31e64c6f2ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521592, "uuid": "cfe876a6-5046-4c02-b975-6acc22d96c12", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226c7f69-d22b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680531822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531822, "uuid": "ee72968f-dfc3-4c05-a9e6-b9f2c0ddca92", "comment": "Malware payload (Guildma)", "value": "7882abd8f9f06fe7008e8bfe2c7ad97c", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531822, "uuid": "13ee1d62-f2b3-41d2-b5e5-ecc58f9c68c8", "comment": "Malware payload (Guildma)", "value": "4cf60e5e1d766256a294868e0c0e4a99da08c0af1a015a1b473016af8be90a6f", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531822, "uuid": "cd1ac8a0-23a3-42c3-b1c0-b0e7056b04f9", "comment": "Malware payload (Guildma)", "value": "a2719404f4ddb142ba0b25dbec9a6c0e10081f6d", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531822, "uuid": "f79f421e-2862-4851-a6b1-acd522cf9ad9", "comment": "Malware payload (Guildma)", "value": "05a22aa73715d812f009b157d5e65a4d0fff512fe5a5f5672781d3a8c0476d675b916f18e828cb36c487b58a04d08709", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531822, "uuid": "800c1d0c-a86f-4cc6-bbd3-2c9c2dc7bb74", "value": "T135B2CECAC7A4A4399184EDD7B5F4A88DDFF5CD9F246032159C84484DEF688EC23B871A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531822, "uuid": "da0b4758-5dac-4ab3-9030-85092d26ec03", "value": "384:XIJJfaH8Ectculgfv9MTiaeurm4B7uW/LcprV/Zb4xe6KSlN53T0Cu8kEwqhGkkS:X3H8Ectculgfv9MTiaeurm4B7uW/wprW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680531822, "uuid": "5f4c37ec-24f8-44de-8c96-ac33f7b30182", "value": 23783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680531822, "uuid": "76eb1a14-e0a1-4711-92ce-efebea5d5d53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531822, "uuid": "161af4d1-195d-41e2-a46e-4c16923abfbc", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241fe5c4-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501330, "uuid": "b702051d-962a-4c61-acd5-e7a900a43548", "comment": "Malware payload (GuLoader)", "value": "4e779addb4aeb32182ad139fdf0b5045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501330, "uuid": "1b872f72-9dc5-4fbb-9a2f-affd62d79f33", "comment": "Malware payload (GuLoader)", "value": "4da86275e812956ff0873926fc947334e4a398a623241028babaabf252a2ea0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501330, "uuid": "758b7845-b114-4c01-b286-d6631ea9b61b", "comment": "Malware payload (GuLoader)", "value": "8313c21225aaaa03d09947843d44e33d3e513257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501330, "uuid": "35af32b8-b288-479a-ac4d-232565dbba3e", "comment": "Malware payload (GuLoader)", "value": "82c87396dd464a03457dc01fea557543e479e13f913be2bdcab06b1250485ed1926ac440769d581f6e845a2430ecf35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501330, "uuid": "51f75815-aa61-474c-8755-b91d341b69de", "value": "T1A2B4E0783BF88022F8E1CE718EE2C1B5B5247E9068F662D327107B7ED831651635726B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501330, "uuid": "b6c8b74b-db68-45a0-ad4d-41059413ad9b", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501330, "uuid": "8a3fb1cf-b7c1-4262-88c5-481d0ecefce9", "value": "12288:nz9GxaChlC3qKOcVbNUW+YCt/JSyhtrVtYHe4P1vg:cC3iKNUWuSyhtTYH7P1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501330, "uuid": "244aef9e-b7c2-4b6d-82bf-93e67d6f0b04", "value": 516408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501330, "uuid": "1a46805c-c53a-4d27-8bc7-4e6870a8717e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501330, "uuid": "4bcb9527-947f-4c2e-8776-42c074d057ad", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23113e1-d1c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680486617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680486617, "uuid": "56441b36-941f-4a1e-9146-b3218daa6fff", "comment": "Malware payload (NanoCore)", "value": "a64494bfe6e3a4db500c4e9677419bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680486617, "uuid": "b2ea4d54-9e41-499e-9cfb-0ea7f3633337", "comment": "Malware payload (NanoCore)", "value": "4e4c1dc23a79c047de52afc33110f34b5600d8e83b2ad3d87ff6de5c29f32461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680486617, "uuid": "9b093663-72d8-492d-85a9-02edab77809c", "comment": "Malware payload (NanoCore)", "value": "9e05a5d77600b6b7af031e12f7f104abd3fea9dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680486617, "uuid": "284ea0ee-ae8d-402b-90d9-def8cf05b1ba", "comment": "Malware payload (NanoCore)", "value": "195ab6d5be654ee031cbd030bc7050352ef6d9312f4db9fdc88f66f552e5feb02661545ca514a4b820d3b6b9179e1d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680486617, "uuid": "918de17e-c459-48e4-adfe-096eefdc3859", "value": "T1F065C043B3A580B2FE46A2F3BD65B786477D5D354133402F23A93C79AE721B2421E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680486617, "uuid": "35ae9c51-3897-464d-a939-ab69dc895968", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680486617, "uuid": "79fc7463-6918-4090-b6a9-b708c84db861", "value": "24576:dA7LDMKOYac6idXy2xwO6cJ0qzaEOhm3Au5ZUYbqU2Kj5N:qMKO3cVMIwbcyIaEk9IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680486617, "uuid": "24abc5b8-1db0-42d6-83b7-7bde44e11e87", "value": 1486920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680486617, "uuid": "3a69a2f5-a0e8-403f-82d4-85624944451f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680486617, "uuid": "729f4745-912e-49e5-ae38-110da0b5a93d", "value": "a64494bfe6e3a4db500c4e9677419bc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76359d28-d234-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680535828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535828, "uuid": "7e5962ae-5cc8-4333-8a0c-fbafabef6d01", "comment": "Malware payload (CryptBot)", "value": "be0c3c5f9610595a52ca4a79aa4619c0", "object_relation": "md5", "Tag": [ { "name": "be0c3c5f9610595a52ca4a79aa4619c0", "colour": "#EE966A", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535828, "uuid": "83b5ece7-d978-40e9-81ef-c90ce420300a", "comment": "Malware payload (CryptBot)", "value": "4e55151d81e24af0e44c7af3d5a3b9ddaf58591819736998b53d285028b654d3", "object_relation": "sha256", "Tag": [ { "name": "be0c3c5f9610595a52ca4a79aa4619c0", "colour": "#EE966A", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535828, "uuid": "1444a0ed-2792-4177-a704-be99c08fa563", "comment": "Malware payload (CryptBot)", "value": "77cb0b975b144792d5ab88c45400d92bb388f4a5", "object_relation": "sha1", "Tag": [ { "name": "be0c3c5f9610595a52ca4a79aa4619c0", "colour": "#EE966A", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535828, "uuid": "efdd9010-f53f-4dd7-9df9-206c21213c0e", "comment": "Malware payload (CryptBot)", "value": "c7ead041342216cdb562164c9f3143500574ca1a7aea6afba87c6981d3401239ec09e052c13a3b63217dc0c0efcb99b6", "object_relation": "sha3-384", "Tag": [ { "name": "be0c3c5f9610595a52ca4a79aa4619c0", "colour": "#EE966A", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535828, "uuid": "dc773b15-7181-4fb5-a3e3-9a4d1962b085", "value": "T150069E75C1776F6FD87A61B0D87040C9A98C3AC9C338825A7B8E711FE3BC0A52F55662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535828, "uuid": "fb85ee06-0f8d-4ebf-a5bd-64c4ec020c6a", "value": "3dd425be495656a2dac22f72f136f555", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535828, "uuid": "c3da75bb-6fa8-4c23-ad95-b419ee87f371", "value": "49152:8of9rERmZQEgLaTUbS2TOQxaviYU85lRgg1vOup0J24MvvXZl03gS:8ofilpTlYQup0HqZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680535828, "uuid": "851853c9-e7d5-48e0-9e9c-d81600414212", "value": 3699712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680535828, "uuid": "dfa71ded-d483-48f9-a580-5d5c1cb7abca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535828, "uuid": "aa6a2309-ad9b-4ce4-8f29-6cd84a8c39be", "value": "be0c3c5f9610595a52ca4a79aa4619c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d92a1b5-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526686, "uuid": "2a001e74-bb99-4959-82e0-eecf44c917f4", "comment": "Malware payload (Gafgyt)", "value": "95fd7cc91470af0759b235772c16f782", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526686, "uuid": "55ed4bde-0863-46c2-bde1-138420bce02f", "comment": "Malware payload (Gafgyt)", "value": "5067e1e1c603faa42b4209637f8cfc572edd436820d53806ea92ed6d7c186d05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526686, "uuid": "d0dad0b6-16c0-44ba-9ebb-40e695b68d67", "comment": "Malware payload (Gafgyt)", "value": "df1b06a66400f72149434b3c34bd37240a151f29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526686, "uuid": "6b18d5cc-7112-4529-a50b-0fca23e4d9f4", "comment": "Malware payload (Gafgyt)", "value": "17efe4411604e13e8754dab7d9c4b717622b109d8f3f35efccdbe4576497d113ab5637f624540ee7681fe87f51ec883f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526686, "uuid": "5e7e10aa-828b-41c0-ac89-0a2bd1cf07e5", "value": "T117A34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526686, "uuid": "55ead467-f967-4fc7-9b2e-6bf505e3d964", "value": "3072:YWCjQrLpnr85EdT9Oa8vqbVr7c/CEgmqAgcVyZIcBI:Yf5EdTbpr7cWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526686, "uuid": "54e99495-132d-4fc6-8e2c-991b10d2ce93", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526686, "uuid": "8e9636b3-38c6-4d19-bf68-11ee6efa8c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526686, "uuid": "a029317c-7892-4ffd-b8b8-03dec0fb12a5", "value": "95fd7cc91470af0759b235772c16f782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39548f32-d266-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680557200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557200, "uuid": "c549961a-3680-41ca-92ec-e1e36ec68ce9", "comment": "Malware payload", "value": "de79624475e627a75515d8c4785f459a", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557200, "uuid": "83726973-ab07-46f3-87fe-db0c244e34f6", "comment": "Malware payload", "value": "51633b56a20b38c202e402d1173f227c6111954e957654cf71d70d08d85f35c4", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557200, "uuid": "a7d5e394-5e38-44a2-9c3e-34f2f9f4b76c", "comment": "Malware payload", "value": "d9de193341af8bbf10f4659800d59244fdc10a9b", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557200, "uuid": "e6f78aba-ee43-4fd1-a175-af8a7c9f06a4", "comment": "Malware payload", "value": "6046b030f529f9897d78f09e0864272421d41b5eb7860fe093680b884a25ab6b0964057443dec8a6ad649fe896660a81", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557200, "uuid": "01e15bae-3479-4879-b2b1-9feaa22ee30c", "value": "T1067633F690A16311BF4908C79069D6F205966CA4EEF11F72C8BCF9892074F987EF65C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557200, "uuid": "64c8107a-96be-45a6-9b65-b43e198d1529", "value": "196608:XO/UjXuM2InJV6ZutkG/bB0BCqdxkOPbMEWV+:XO/UjXuM2In+Yk8Sgq/kO4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680557200, "uuid": "d720e107-71c5-4124-8b98-3123b7fe8e95", "value": 7432180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680557200, "uuid": "abe2f1a3-be43-4cab-9812-e8f640f3f997", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557200, "uuid": "266e7235-fc9f-4d49-9e97-27a909d0a240", "value": "ID-FACT.1680556827.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6a5715-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502472, "uuid": "91b7345a-b3fa-418e-921f-a50cad3a47c8", "comment": "Malware payload (Mirai)", "value": "2975803055678247beb8a80d268a798a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502472, "uuid": "9352fbb2-65c0-4037-b944-dc237fbea880", "comment": "Malware payload (Mirai)", "value": "51721730d42eee88e9b8d281c10ca318334e925372a310b0667cbfd2f4d6b499", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502472, "uuid": "4ac71e47-0844-4b62-aead-ee1c04d5bad4", "comment": "Malware payload (Mirai)", "value": "33c06b8802b278f9f25e7dd1959f7d04edba3df6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502472, "uuid": "377838b1-fcc8-4970-a1fa-35b634613ccf", "comment": "Malware payload (Mirai)", "value": "8e91e41c1954aa13d6f6bcc81905cd27d266ebcd9463b24385a69ecf80a0461ca8d8d41c469fc0b9bf4e9d95ec3ec9b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502472, "uuid": "fcdf12f7-bce0-48ae-90dc-2bc45ec7889a", "value": "T1695302B17909BA68D4594932C36D8BA8BB82DFFC74D37531164C0368DBD1CE462AB8D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502472, "uuid": "a65a9f7c-e67d-47d2-b45c-6f7731dab665", "value": "1536:yqFTR5KO5NocPauzK7n3tWt8ietChYivciLBNyy5B:H5Z5NocPFEnGqMNBLBNyYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502472, "uuid": "eba4839c-eb69-436e-b1a0-95a8ca8765bd", "value": 60884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502472, "uuid": "4aad4304-79d3-49b3-a1d7-799c9258bf79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502472, "uuid": "4930bd8e-4842-4327-aa22-ecd69db018a8", "value": "2975803055678247beb8a80d268a798a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17399cf5-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496155, "uuid": "3a7e8c18-6dc0-4d8d-a80e-3c59571aa29f", "comment": "Malware payload", "value": "ae6d534e977401108b99b32fa01c75b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496155, "uuid": "6aed4456-f719-4006-8795-6a3d33e6abf3", "comment": "Malware payload", "value": "53ab5fde22cd610a25764e6011b6145c1b2338c3bd0420470e3f8457515e16e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496155, "uuid": "b61cbfbd-5681-41d8-971b-b8cc092c2a1b", "comment": "Malware payload", "value": "a6fbcf79eed7f3db583feb8017f4bf9f02ad11ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496155, "uuid": "08d69b46-38e5-4cd0-a6d0-8678d292542a", "comment": "Malware payload", "value": "9329c1785a6d86ba2464bfa7dd1396613f25e5dfe311c61af2a647ff7af419e5adcd2f853ea9f69490d32b33cd0a0851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496155, "uuid": "c9f67ebb-460b-4ce9-8fc5-4008ce17b197", "value": "T120D4BF03FE544A85FC79593214258D725A632C29E100696776CCBE1B37B3193AEBE32F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496155, "uuid": "ebbe6e35-c90c-44b9-827f-8b1053bebbe3", "value": "6144:zlzC4EFTlzCelzC7lzCnlzCyXlzCStVlQ+mdvfokXp2RlznXnNk4aZpB6g0Myo74:zlbylblGl6ltlRe5gzn9kzQCN7RuX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496155, "uuid": "34200be8-45c4-444a-bf44-ee78a953f6a0", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496155, "uuid": "ef280e51-177f-43c6-9a22-b1596e2f1c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496155, "uuid": "280f43ea-ce95-4833-be95-ba3d3fd66943", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen2.4713.24652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae4f714-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680532319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532319, "uuid": "bd9ebf43-4693-46b2-ab86-895d6dc2a1f0", "comment": "Malware payload (AgentTesla)", "value": "67a54b81cb3866fb01b694027ab3b44a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532319, "uuid": "ec7b5217-0c1d-42f7-886b-aa8417bac719", "comment": "Malware payload (AgentTesla)", "value": "5403a3c011c4f188e702aa8c8c02bb9d69d55e9da0e40f232c3f7a00cd3b6cbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532319, "uuid": "aa7721e4-068d-4a35-8c56-1687c62933c2", "comment": "Malware payload (AgentTesla)", "value": "f0ec8070184b89eff79774b3f174d454d321b478", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532319, "uuid": "17c32149-3847-4c62-86e0-8e61d34adb56", "comment": "Malware payload (AgentTesla)", "value": "168ddf64b0135ef8a574eb713d8a06cf9e6f84999eb60920b0f7599320ab8bb8443aa046b5082f05ee290f060bf39e9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532319, "uuid": "157a3398-fae9-45cd-bf01-4dd14bded433", "value": "T192F422083001BB26CDFA8BF760279A6507B579376513D3BE1CC558EA5833FA88B52E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532319, "uuid": "caef7110-b653-4731-a07d-463efda3ac8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532319, "uuid": "9bb0f4cd-d07e-4cfd-abb6-85c7b216a46d", "value": "12288:w5CBWKdq1FbwwJLwrbUJeltWz6IH+ljDw7qcq6vgf5NLZJpN3qgwDWvepMHsqJN:Tfrp3UJeHWeIH+FDWXvG9XpNaPyH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532319, "uuid": "68da4fad-b12b-4eb5-9774-f0aa4790d321", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532319, "uuid": "7b7523ef-2632-4508-bbe9-a893903b0b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532319, "uuid": "6374539b-c1ab-414d-948f-3d8d483a8904", "value": "0792112_868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cad6f41-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526631, "uuid": "41351e47-65b2-452e-bae6-d96cf5561f4c", "comment": "Malware payload (Gafgyt)", "value": "f9600e90885b56ce5020b49e6dc6911c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526631, "uuid": "3cbed104-b592-4fd4-9606-dca8542cfa0d", "comment": "Malware payload (Gafgyt)", "value": "547cede53a86815cdbce364e559f527e71adbed2ceb6c134a8c2a3596f917229", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526631, "uuid": "9838d833-3ea8-4ceb-8698-661b173e74dd", "comment": "Malware payload (Gafgyt)", "value": "db8a2357fd829de28004f6e470968acc2db368f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526631, "uuid": "ad51a739-d471-4f2c-b79c-4b1c3841caa2", "comment": "Malware payload (Gafgyt)", "value": "2848ed2b624cc172b2c41259067d2964eb3336289c2ecdea7e063424eef777ad1a5d37424f10f3d0dfdc6b56d5403b89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526631, "uuid": "f5cc9d55-78ba-42b6-944e-bffa40be91fc", "value": "T112D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526631, "uuid": "2b0e83f4-2bc3-493a-9a39-dbc3a1629732", "value": "3072:Sdf+fvEqa9FazYA7IboRh4e391CErktmCQA9FX9aH:ifWEqa9FaNh4e3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526631, "uuid": "272b02d2-6239-4dbf-9047-19fb9ea421d6", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526631, "uuid": "e70d335a-238f-440d-951a-c2588256a3f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526631, "uuid": "42827691-2e6a-43e4-8e38-a8099282179e", "value": "f9600e90885b56ce5020b49e6dc6911c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39d1bd1-d221-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680527878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527878, "uuid": "a1116e28-41d3-4633-9f51-5069535f7cea", "comment": "Malware payload (Formbook)", "value": "8d416e83a2e1724ef6bb4328cc5b3fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527878, "uuid": "9dbcb76f-4a75-4cc9-8a20-308c6bc7c3da", "comment": "Malware payload (Formbook)", "value": "55539014be63262397d727fb06f42992bf43a3429eea2cfbd671db0e0746e9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527878, "uuid": "2bc0b0d0-3074-4cef-b58e-bc9ac3d10fd6", "comment": "Malware payload (Formbook)", "value": "d482ac0084a342d69d06de912482baee4f415b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527878, "uuid": "0ebeacf8-529b-4a49-bc98-e94269cb7813", "comment": "Malware payload (Formbook)", "value": "fcc809cb842a6c4dfd51238c4d74e22d6741d75fcd7390265e308c1e84d6fc7a2a3a4a179901339aa9a4a23a1dffd360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527878, "uuid": "5e789191-2ad7-4a09-9977-626e469c1d40", "value": "T1C8F401392AAB9639F4315BBD95A02185577E2FB36727C88D44B631CD1B73B024EC063B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527878, "uuid": "0cbce23b-f8b2-4b89-bb66-6ac52cba4ad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527878, "uuid": "2217c100-b3fc-4dee-8a99-12da0bf68732", "value": "12288:7EsmYMUnFW/NObeGpocGzQlYwk8xw5ArM4WM3RDoColVZIW+2u6ixuCZqytaqkMn:7EsUAyelrxwaQ4WEpoXZi2ufxuCZqyt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527878, "uuid": "cb9d5572-40cf-4e87-b0db-2c5ad507e35b", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527878, "uuid": "e7845800-515c-463e-9eb3-5aee15b2a67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527878, "uuid": "59000725-de8d-49dc-a84b-12979debc731", "value": "55539014be63262397d727fb06f42992bf43a3429eea2cfbd671db0e0746e9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a359dd94-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525595, "uuid": "d8bffeb9-7f00-44e1-8415-a053974a234a", "comment": "Malware payload (DanaBot)", "value": "96e90ad27fdc10d923234e2bd91c1036", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525595, "uuid": "8493de89-540f-4431-bede-dab448636817", "comment": "Malware payload (DanaBot)", "value": "55a56ba8c0af72eb63e5e393cf8cabb11a94c09245cdecc410fd48b0b613e96f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525595, "uuid": "4bd1b7bb-95ae-4d67-a8a6-696aa03e9a47", "comment": "Malware payload (DanaBot)", "value": "120d464029e9673b7baa32e27e8d12a9bbfc9506", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525595, "uuid": "2c24817b-3e8e-4d80-8604-ade6b3341bf3", "comment": "Malware payload (DanaBot)", "value": "7cdf78f9f42bff3f078939561326224101c561daeb190c8ba21e391a52a9b7894133f39893dd713c5f4fbc00708cebb1", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525595, "uuid": "bc6dfb9c-208e-490e-86fe-7d4318c4b392", "value": "T11636334149E47570EB478A710E2EC374684EFC916E3CAE4D19A8FEFE1A34132D1763A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525595, "uuid": "c56475a3-df47-4a48-8358-d5f8175b8be7", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525595, "uuid": "24a654a1-e40c-426d-aa65-475f6d8247f2", "value": "98304:Zt9/zR2xEzLu96HtSaJf5ZAdPtaysx0dxr16x3UcSKW3yX20kt:v9rR2qzLy69JBudPtisu3UrKM0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525595, "uuid": "5ee67562-5c78-4536-b4cf-9814ba2d5bf9", "value": 4948480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525595, "uuid": "0782ca6d-897b-49d3-bb52-07a8d74774a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525595, "uuid": "d25285e8-5ac6-4c9d-87ed-d4c031fc8c0e", "value": "96e90ad27fdc10d923234e2bd91c1036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58140289-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545656, "uuid": "ed5c409f-9ed6-4fda-8eec-9c025b0940e1", "comment": "Malware payload (Mirai)", "value": "2e16c26ae7251879e22c3091d7580d7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545656, "uuid": "61688963-f760-4a9c-a875-9d84493cd0eb", "comment": "Malware payload (Mirai)", "value": "56265b26bf307d43624bf853b85b702a9e2615bc00d4278d8f1ed74b1d81f11c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545656, "uuid": "bdf2c88a-06ee-43f9-903a-352ce115b514", "comment": "Malware payload (Mirai)", "value": "5a23e17a6436cb3069cd77ea697096dc28a4c5eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545656, "uuid": "2e51eeec-cd14-4f0d-9bf5-e6820e805ed2", "comment": "Malware payload (Mirai)", "value": "0f8b39d5d3eb4daeeddbca094bf48c2dacb6081d04c5f9b2b81b27685c5173fed9541c68bb00ee906703de19ba572b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545656, "uuid": "f173bb2f-7b4b-4330-bd5d-e9ff370585d5", "value": "T1AF83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545656, "uuid": "e846e80d-b94c-4062-9faa-78c1ba4c0d16", "value": "1536:iVLyu95KRukj752dCexuV/8UZlDwfkJ4MYfWB:iVLyMgpFezxu5VD1eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545656, "uuid": "08072ecf-d534-41d6-9cac-bc44afd64dc9", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545656, "uuid": "a4026fa0-be3a-4362-8287-c9070827fe17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545656, "uuid": "0da5045c-83f4-4303-b460-061a8f422c5c", "value": "2e16c26ae7251879e22c3091d7580d7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052b1542-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525330, "uuid": "973e53ed-7202-4e2a-a5c0-7e468b4819d4", "comment": "Malware payload (Rhadamanthys)", "value": "5a71d1a7ee0c046df772cfd51a61e8a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525330, "uuid": "f32a5281-4cf7-4f98-a86f-76db09842131", "comment": "Malware payload (Rhadamanthys)", "value": "562b2e46cd1c90889bdbb5666a335683183c44d54aefb35fd2df03828de8a539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525330, "uuid": "ffcbdd6e-3778-4b75-bad2-4f71c03269b5", "comment": "Malware payload (Rhadamanthys)", "value": "69413eff9df3ce80f4bfa87cc445f0b591f0a1bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525330, "uuid": "b500c4b7-3612-4ad2-a22e-47011e340626", "comment": "Malware payload (Rhadamanthys)", "value": "7ba23b7cb9270dd06e1afd71bb1293eff4cc839d0464184f208260e0f305f8ca1dd1aac628d4426765a91349c75743a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525330, "uuid": "a6168db3-607a-464b-b36e-de2a7017e959", "value": "T13F64AE0256E47C70F53E6A328F1EC2F8261EFC628E197B9B2679BA7F0930161D572705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525330, "uuid": "6b672729-c3bb-4935-b213-af689c04f980", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525330, "uuid": "a92abec1-b185-4c37-b711-82c8e272315f", "value": "6144:8o37TM6Hetm2/UeiBbVjowMMw1hKaF8FeHy:8Q7o6E/D151hKOqeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525330, "uuid": "22abf5e5-0550-47da-9f3f-abc6681c4beb", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525330, "uuid": "ec9752f8-625d-4abb-bc1e-b2cb57b7c7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525330, "uuid": "8f95c763-495c-4115-a3a6-65db5ccf06b8", "value": "5a71d1a7ee0c046df772cfd51a61e8a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2353cb-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680522015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522015, "uuid": "d7f912c3-7db0-4b3e-880c-2a8d47127c3e", "comment": "Malware payload (Smoke Loader)", "value": "4a8d2ebb731f567dc839b618bf399a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522015, "uuid": "740b1b69-aceb-4623-bdb9-5bdfe5dac9d3", "comment": "Malware payload (Smoke Loader)", "value": "56ac884bba5a235be091a7a1c956610fc33c8f8cd6a2321d15040f37e87ef5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522015, "uuid": "b3ebef24-4c12-45a8-b919-8051fb9173ec", "comment": "Malware payload (Smoke Loader)", "value": "a1fba2b8b1d290fbc67132637fadedc7388185fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522015, "uuid": "9804d4c0-0db4-4e81-9382-2621980d98a2", "comment": "Malware payload (Smoke Loader)", "value": "d944eb57ba5d93e17419c48d4fbcabdf083d46eed04ea3d3d2d6d1b12ce9b9b4c087d2d7a92bc377ae92056b304818fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522015, "uuid": "2988ccdf-77a9-4925-88e0-d89c1bb23871", "value": "T12014CF213AA0C077E51B8D705839C660EB3FBCB18BA686DB3358176F1E207D19A7E255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522015, "uuid": "af93b973-e50a-4a0b-be3e-16ea5be7837d", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522015, "uuid": "0294ad7b-3ffa-45f2-9a40-fd3322cd45f9", "value": "3072:ofcAEQegPDq8qo9ta20XYULO9CwyoW7IUdeJIuc/a95vN0:k2SG8qiAXYUUCzomeJkqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522015, "uuid": "9da512ad-33da-4d77-8917-8ad870d92dbe", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522015, "uuid": "505bcc83-1c67-4ba3-8b9c-c3652661ff59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522015, "uuid": "84256098-ee4b-4a3e-a615-e5d4dd9e5f4c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c9c32-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496142, "uuid": "e92fa73e-080f-4ea3-8fa0-660f8246cb19", "comment": "Malware payload", "value": "138ac0d194c80b275e3b7dd574b8b827", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496142, "uuid": "2077250f-c0ba-4be8-9fea-5c8e735daab2", "comment": "Malware payload", "value": "56d2933a97b20c7cd9b0b689a1e6aaf47c7776e7f9e32f82cd7490aaa02b8158", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496142, "uuid": "acf81df9-2c24-4668-9521-4012c700fbd7", "comment": "Malware payload", "value": "905ac3977becea96539cf1d403de09c3b8e6a7ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496142, "uuid": "c6dd1804-0d79-47a6-8f04-46784b0867ba", "comment": "Malware payload", "value": "5bec3e6438fda39e26292987d3db8f325b0f94af1ca8bb166ad76486d46ebbabd804ca7d30bf89b7843a492c0d70d2b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496142, "uuid": "cfabd69d-c27b-4c84-b5f7-27a92bb9348f", "value": "T13FA423EA1A63D83CEA5D4476C07178D813E9908D8A76C1FD54C89C7E3C77BA8C1DA893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496142, "uuid": "954a5d5c-d882-42be-8d09-7dd63a9dd95a", "value": "6144:m11pmAq5ZCwg5E7Q0PtumgVAAeqyt5MvvVLq3PqxZ9m1uascPptCIt5leq/EPuxl:ErEPYmKeJMvvrxuoasanTV00vPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496142, "uuid": "d473a400-c6f8-486f-9f80-efb21d3b55f0", "value": 454235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496142, "uuid": "8e1a0806-c4fe-425e-8bc2-e4f33f6d5c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496142, "uuid": "3b1edc5b-4889-465d-9f20-0c241c64cc1f", "value": "SecuriteInfo.com.Heur.2822.26804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207da961-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525805, "uuid": "3582888f-bf0b-4736-b7fb-f14af068e1da", "comment": "Malware payload", "value": "6470d102e734dbcae0fba3ed46c60471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525805, "uuid": "ce2681cd-2201-44ec-9314-848ea638a18b", "comment": "Malware payload", "value": "5765695f5061e4068df787f878cf910317e1db67a3428bae23fb8d12d69552fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525805, "uuid": "9c414dda-0a7d-4dd7-a7ce-12f105a9227c", "comment": "Malware payload", "value": "2128c546d9b7ea5fdac598de5be0354206e23e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525805, "uuid": "da19c315-05b2-487a-b892-6ea811340895", "comment": "Malware payload", "value": "4b2c3f9026214f15cb86db1705e44e6a4e35b95416b065ef33aab705b54ef01f066246fdc10e0f48319a63927136f63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525805, "uuid": "2c5be8a9-61da-4ea5-8eea-1ac8224ad088", "value": "T1FDE5335AD58C4B7B2E64216C57719C4B3A6E5F161A2078037722A9A0FEFCBCDC01372B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525805, "uuid": "e8a4645a-32c8-476d-9a68-7e3d23e2e41f", "value": "49152:OF7LZIwAPEEc0VJ3Q1xUcTwWK6aJQ/43KFK9WBsqthbJCxCbYQH8InbjqqVr7x71:cL2ncElQ1GcTwWKCx4WBDbJCxCB7bjqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525805, "uuid": "78242f4a-dd61-4d1e-8ffc-1f4fd80370e3", "value": 3136011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525805, "uuid": "942ddab1-2ce3-4e79-97c1-940b1010e3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525805, "uuid": "a20a2e6c-d8c5-4ce6-b5c0-ac5171e77d7c", "value": "6470d102e734dbcae0fba3ed46c60471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6ceda1-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496165, "uuid": "360377d1-267a-4761-ba79-56051ba2c0c0", "comment": "Malware payload", "value": "9d844504a78049bc10ba03d2a1c6c0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496165, "uuid": "7acd2670-f690-419b-a40c-a162bf3845b5", "comment": "Malware payload", "value": "576ab455ab6f2d82eca236e36eaa87cd2e621e0d713d5d9b17db933084216d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496165, "uuid": "728c2526-09c4-4fbc-b1b4-42668b52ee41", "comment": "Malware payload", "value": "600737e05f7f9af931f57c1a4a6b51addee6bda3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496165, "uuid": "59f732bf-171b-426b-93a7-1b58c3878d6a", "comment": "Malware payload", "value": "047d7f0fe60c3096e6f6619fefa0d43ff3a78487d1aaeb90153999608846bbdf8bb7af7df35290d5dbab292e19648dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496165, "uuid": "82bee63f-7a95-4762-9b70-6fcb16c71cb3", "value": "T1A2158D6AF6E280F0D74225B105BB67769F6BA5171B329BC35264CA6C4D237A09C3F133", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496165, "uuid": "a2e1bb5b-2d44-49fe-9396-58029529b530", "value": "6144:tcN6AJOQhUanJqo4fwdWRND8jvradGbUtPfftPgKgRgrwY:tcjJrr4fwe2/8FPgK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496165, "uuid": "a6dbf05e-1808-4cd6-aeae-806fcd55ea1f", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496165, "uuid": "d663cf95-2ff1-49fa-a972-cd64d717cbcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496165, "uuid": "27686e56-f173-4e61-a8f9-e7ef27d52a7f", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.29115.17760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eeb1989-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680528407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528407, "uuid": "a2c6c344-22da-4085-9bc0-8671e495fb91", "comment": "Malware payload (AgentTesla)", "value": "8a16ed1c07b77b743749e470b82bc2c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528407, "uuid": "ee4a087c-113d-4deb-a26c-86760c4c0d2e", "comment": "Malware payload (AgentTesla)", "value": "5867d3ee084f07a5ba2bbd1ee94f8f40f89a3d497f36d4ba9ec3582db2d3b5de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528407, "uuid": "08002b0c-715b-471d-9e4a-2b005daadb95", "comment": "Malware payload (AgentTesla)", "value": "c5d8d11b75ee83418d464b343711dfbfb29f15ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528407, "uuid": "e5836c2c-8506-4ed2-94df-cbb53f365d09", "comment": "Malware payload (AgentTesla)", "value": "797dbca7f522f74579cf4c2c814dc1357e55c0d009ab9391bfc2815f0122100d2906c5a1ca2ede959d1e6a3faba2f2b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528407, "uuid": "4ac44087-00ce-4d1d-894e-b6e6f80b0a33", "value": "T1DFC2B1A55B8C4C61E26AE8B7824EE00E48FCF63634C245C4BD9DE2747B7D14E4B671B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528407, "uuid": "faf935ad-c665-45ea-917f-3ebc97feac25", "value": "768:dvBjrHZF2kaXDDjb0tnEnfHW/fTElUJjcmtWF1NLRlzj97liGzx:RxrtaXHYe0fHWfNfPVzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528407, "uuid": "1daa1ccf-ec34-4677-ba4d-b597197f4653", "value": 27543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528407, "uuid": "72abebd3-88e0-4930-8fa3-8132810b8fb5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528407, "uuid": "f955a401-06a1-43b8-9d89-04af388743f2", "value": "8a16ed1c07b77b743749e470b82bc2c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae7cb70-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680525501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525501, "uuid": "9f1c44ee-4529-48ae-9d1f-2dbe3982a1c7", "comment": "Malware payload (EternityStealer)", "value": "e2294e4d5bee6834cba1fe1a8e6822dd", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525501, "uuid": "f0fe4a8f-cfcd-4ce7-94d4-60f88126194b", "comment": "Malware payload (EternityStealer)", "value": "595556574c59022b9837a133c53c0a229eed297a9c338b70e8acbd99abcfa51b", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525501, "uuid": "31230922-cfd0-4ace-b977-73e7a4f3b87c", "comment": "Malware payload (EternityStealer)", "value": "15bebe3f370b8f18a200dd642d0d47db896381fa", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525501, "uuid": "44add043-83e2-4334-8e85-a5c666fbb8c8", "comment": "Malware payload (EternityStealer)", "value": "ed62bddf80d7e296f95c3867ef045b34fa694a41713cc2298fcd5942a64f183c6625716a8e48c7e9d2f6407961c7014f", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525501, "uuid": "038b67cb-d2c8-498a-a471-5cd95841e347", "value": "T184B59DAC366432EFC467CC72DE681C64FB90747B631B861790AF129D9A0D887DF150BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525501, "uuid": "678cd639-565a-4557-aa9d-d9aa16303325", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525501, "uuid": "cf391539-db05-4602-9e8e-be9d63ac501c", "value": "49152:EYAyudWEYZUX5w5rtEZmFeaXRN5c/gJZUm020E6p1kj9FBD:judW45wlGZoLRq+X09Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525501, "uuid": "7d6b61cb-0eae-4a82-b349-24dfd7b7c469", "value": 2465280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525501, "uuid": "2b3aeed3-0ac4-4e7d-936e-6f965b79dd48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525501, "uuid": "2124a271-611e-44f2-9ca5-3615706f36e3", "value": "e2294e4d5bee6834cba1fe1a8e6822dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f03d68f-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525588, "uuid": "a16ef53b-50c3-4cc6-8654-5029976a3eb9", "comment": "Malware payload (Gafgyt)", "value": "2db312c44f7243a4a2af92a8bd79230a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525588, "uuid": "651040a7-8230-4934-88f0-c756cd9b4fed", "comment": "Malware payload (Gafgyt)", "value": "598695d7329d4f1b35880f49e598682db3ee84377b2c674220275f8574c98868", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525588, "uuid": "1d5756e1-b3cc-463e-b493-17c976b5b5eb", "comment": "Malware payload (Gafgyt)", "value": "fa4760eebd5d7240b6dc92a8f526f97b5b392e57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525588, "uuid": "b6f354cc-43b2-46fa-b221-2227e8692c8a", "comment": "Malware payload (Gafgyt)", "value": "17aa6a5fc1c4e6a5b349efb679db98278d0635c77341b28dcaab88792e3c8d1d438e75264cb32cc178452c5f8cd9621e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525588, "uuid": "1747da8a-f4ca-4784-86b8-17822b88280d", "value": "T11EB31792F900DFF2F00AE67608C34A257670BF660F536A66B21739A79E721C43827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525588, "uuid": "f240f004-4dd7-4942-a3ff-cb69342ae69d", "value": "3072:DG+3MNBCpCTyRQpimmrytKms4OWlKhRm2pgYMx3IPtW:DHCTyRQuyt/seuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525588, "uuid": "d68bcce1-01fa-495e-a114-cc1e60819c2b", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525588, "uuid": "0007392f-ff0d-4c92-a939-a445c2d125d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525588, "uuid": "2c6285c1-4bdb-4d51-abd8-ab5988344aa3", "value": "2db312c44f7243a4a2af92a8bd79230a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6107555f-d1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680488118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488118, "uuid": "91c1369d-0c77-4cf8-beae-e2b18d43970f", "comment": "Malware payload (RedLineStealer)", "value": "a734e6f7e4484b9f663e9fcfab7c1800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488118, "uuid": "7cb0c7e1-b0ee-4918-979a-87b4bcd4c0dc", "comment": "Malware payload (RedLineStealer)", "value": "5aaf648b072c4c7a51efee906c6ba0ca0dd816ad692d214fd6cab54020c6d512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488118, "uuid": "ec8e047d-e0e5-45ea-9a1b-d270adb62067", "comment": "Malware payload (RedLineStealer)", "value": "c7c9b0c3fb29ec2660957b502f62e611fac74d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488118, "uuid": "7ec88cd5-80c5-4d47-a207-03ca628f038e", "comment": "Malware payload (RedLineStealer)", "value": "90356f83ec5e0251b7788ee5b0921b875a3888e95f628524401423146db3a2ed6cabd2a952aada8ca91e50a666a39b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488118, "uuid": "d97e4531-be5f-4b31-93ff-1a7535772c7f", "value": "T17C44E8EE7FBA55DAF268063397DCCC6403626CB3A8D0B2471588B6C90A31ACD41BFD55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488118, "uuid": "3da8a7c4-e591-4e92-aae5-bc72818cac0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488118, "uuid": "5b4ee4e6-8b8f-4638-ba12-7ac93ebcb54c", "value": "3072:zHpzSdK5FvUYv/xP6PTCdFaQ9Pkz/ikArQ:zHpzSdW3DkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680488118, "uuid": "3890e1ef-c1de-4515-943e-61e51b640864", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680488118, "uuid": "3a3e8c87-3661-48a1-8ff4-3ff5cebc7af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488118, "uuid": "c41280b2-d5e4-43c6-9e33-f60d566342d6", "value": "a734e6f7e4484b9f663e9fcfab7c1800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef87a55d-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680526582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526582, "uuid": "198e968f-6fa3-402c-b923-a96fc2c1787d", "comment": "Malware payload (AgentTesla)", "value": "ba67bb555e5e1d845b4e549df2c8b493", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526582, "uuid": "1cdbfbfc-5695-4c32-badc-1844975663ca", "comment": "Malware payload (AgentTesla)", "value": "5b58f94841a17d6f347c5d32f4ac2e2fb6d7e4954d65b5138ed7fb44c924c3a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526582, "uuid": "fe278307-05c1-46e5-a544-2d21f429bca6", "comment": "Malware payload (AgentTesla)", "value": "ff966c9355cbc922e0eb162d8dae6db2244267da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526582, "uuid": "b68d0f4c-5d64-440b-93f8-544e95e3792b", "comment": "Malware payload (AgentTesla)", "value": "3671f688bf4d9e5c9c30e15766fdfa7fc07a2410f686ba774a45e9a00889f32fca3a7837f4fe54fdb56ccd19f5136781", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526582, "uuid": "af39a3c3-87b7-4cc5-a8ca-24743d64ed61", "value": "T105E46D7D19ECD5A7D579D6754BF44C30A5FDA41B3A31CE2E39EA008906A2F02368336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526582, "uuid": "ab46d858-76ef-4c1e-a0af-a56655383f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526582, "uuid": "33a0b472-d962-4c44-9177-ab0bb2d5edfa", "value": "12288:HKPFSPmnULyywVBGh0NaHo3EpGs3TH8HzZF/gxMdib/:HiFS2UDwVBNNYoUpZTcFg/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526582, "uuid": "c7511d70-302c-498b-a827-46cf33705769", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526582, "uuid": "6b448141-407f-4507-8d02-97028ab51818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526582, "uuid": "d6143891-de9b-46d1-8088-fef10c1abeeb", "value": "LOS No 140491194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e704f61f-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680526998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526998, "uuid": "3498e986-55bd-4445-9338-24dc91336191", "comment": "Malware payload (AgentTesla)", "value": "925c0f515da9a950aae271a82493441b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526998, "uuid": "657c95df-aced-45cf-8bb2-baf0cd558bf7", "comment": "Malware payload (AgentTesla)", "value": "5be19a526bc4d972b4ce0ea323a03f8f364b22363c25c7f6250ffaf7904b90c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526998, "uuid": "387ccd53-54d8-43ed-93f0-9faa89133ff6", "comment": "Malware payload (AgentTesla)", "value": "6e353faae64a5d487497105d476de60c33b310d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526998, "uuid": "f3b16cc7-55d3-439e-a32e-3169ec03c538", "comment": "Malware payload (AgentTesla)", "value": "0444b0b3784a1513d6852ecf5abcb9d5177cb0574d4b127386382bcb39d723b7e906dc2c875faa1181f6e8a1160642b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526998, "uuid": "bfc66f38-fe6a-430e-ab8e-cffc37966ec3", "value": "T12A35C4AC366032EFC467CC72DEA85C64FBA0747B631B8607906F119D9A0D887DF151BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526998, "uuid": "5c325023-f486-4aa0-81c3-d93a3e23b695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526998, "uuid": "2e3a7064-88b6-4ec2-bcf0-16a14bb2567c", "value": "12288:1tPVSOmCLjZ8yywVjfiqM9gd5fGTntwLi76+JGV8jZVnDTDkym3qJGF+Jl1KlYNJ:LUOmC/gwVbxM9s2tyFVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526998, "uuid": "4bde951b-a759-43ea-990e-7ac9300596b3", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526998, "uuid": "bf44633a-8bd0-49f5-ae68-cb9cd2d14918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526998, "uuid": "bb8a3195-684d-48e3-ac40-0e595f469024", "value": "Ltd-2PKGS 702KGS 1.44CBM-2023-01-17-160-53565805 DEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd987be-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525533, "uuid": "d51d8485-1ffd-4104-9d6b-8e41854c63f2", "comment": "Malware payload (Rhadamanthys)", "value": "f61eeeb1817ef708f95ac268641e883e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525533, "uuid": "e4c0b095-b139-44e4-85bf-e36408f94b48", "comment": "Malware payload (Rhadamanthys)", "value": "5c6df33068437ee8f69f24fa37720e167b542427b7d592a3d39fefd0e19479a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525533, "uuid": "0c9e0711-e148-499e-847a-33b86a64e92c", "comment": "Malware payload (Rhadamanthys)", "value": "034966a8ff8ea4052c3b5e263ff6ffa61beb04e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525533, "uuid": "2cc80993-0d6a-42dd-8ef6-e5a9ed50efb1", "comment": "Malware payload (Rhadamanthys)", "value": "e71599d9103c83491ee9c7c2bb14df5cd49260222931e0da7f23df9b21f3e60d92b6b367142f11f0c9d4c58bba99e581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525533, "uuid": "2a0dddbe-079f-4454-ba44-ac288ea03be8", "value": "T1CB64C04267E1A971E2124B324E1FC3F42A1EBC65AD15BF9E2657BE3F0D341A1D222317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525533, "uuid": "14a8fbd3-2a6c-4f16-b345-6804f9b175c4", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525533, "uuid": "df6fd0a9-0d9a-451b-8fc3-27a89788f442", "value": "6144:an9eqNWyRVCBHnKffl+9IEIDYjI4jmjBXYEnkkZtkjt:a9eqsy3CBHyl+9S4y96kGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525533, "uuid": "98da95ac-2af0-45b3-94b0-08aebcc02b44", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525533, "uuid": "ba0b254f-4026-4fab-8782-b821cd7e26b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525533, "uuid": "756cc6ae-0d83-474e-89e9-e3ef3cdca79d", "value": "f61eeeb1817ef708f95ac268641e883e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0637bc9-d249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680544918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544918, "uuid": "a9299dfa-1fcb-4c6e-adff-a46f328fad0e", "comment": "Malware payload (Mirai)", "value": "e0017a936385559056f467bd2043676d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544918, "uuid": "0bf36659-c9a9-4c77-babf-5ffad14ccaad", "comment": "Malware payload (Mirai)", "value": "5d4b98a843d36addcaf610c02b996cb65bd215a8dcb1fc9499ea224a590b78ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544918, "uuid": "e94dec1b-9871-495f-914e-757fe77e6dfc", "comment": "Malware payload (Mirai)", "value": "b4ba13d894f49f93f1f1d72e3e8fec433c0c1b5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544918, "uuid": "6be17832-4178-4206-97d8-909625c016cf", "comment": "Malware payload (Mirai)", "value": "36b7397a9d8814f6616cd0c4aaff94a9e254638bd91842563a624d2eae555ad0eaa09a957123ac777dc6b48775b6d2b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544918, "uuid": "1ad3576d-2d08-42e1-9619-b04824dea18d", "value": "T14283A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544918, "uuid": "f0eb7839-34d3-4583-895d-70096e291c32", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTT7ZDYovZ73x/nL8y8QU:Rakdn2Eo3ePu5GTTRYo99Be037WJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544918, "uuid": "7b48b4a6-f0f1-4787-b4b4-516b4f07e507", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544918, "uuid": "c02ffe9e-8ad0-43d6-9827-4a6a9e969da5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544918, "uuid": "33cc80b1-0b6c-415d-9542-9fbae9de953d", "value": "e0017a936385559056f467bd2043676d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9592b74c-d236-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680536739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536739, "uuid": "5d63c9bb-df98-4689-aa7f-4f0c32567149", "comment": "Malware payload (AgentTesla)", "value": "7ff90a232ed79406484bb4ed486b59dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536739, "uuid": "498ef2f5-2ace-4875-88b4-7691f237bc5a", "comment": "Malware payload (AgentTesla)", "value": "5d87d27a8034f66903bcfcbb0c4d325072ff13579b5b1e36aee0e25d9756cc1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536739, "uuid": "95ce451c-3bc5-4dfe-b4ae-7cc4d2a731c0", "comment": "Malware payload (AgentTesla)", "value": "9f1a07f1766769eb43c17eeaee6f5b3b0d40101d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536739, "uuid": "8351e2a3-f2f3-4d46-93c1-e68ec4efbc65", "comment": "Malware payload (AgentTesla)", "value": "4f5e25105522778a46a87d0c12495903e9bfe5fb88ccbc74f0ece96abe4a6a3e1b48ab8773e2d370e84814d85379157b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536739, "uuid": "0e1a3e69-2910-48b5-b46b-07c1ad170c92", "value": "T106D4129A375D0B2BC95E4AFF917115894374D822BA07C7EA1CC8A8AE57F3B848505FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536739, "uuid": "e9f37258-e110-4c94-818d-e26078f0f0a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536739, "uuid": "c6cfecfd-9041-4ee5-b7ee-83e0c70f759d", "value": "12288:2VtzLwreFyRnPDDVgKGhYF7kPv+0WglDlUHZt4gfI4Jph8AaGWfJ+kDONxdb:nfdPnVgC1kPv+0nhlmZtjQ4JLJ/WKxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680536739, "uuid": "f2e1d199-d756-40cc-86b7-90d1deb8ac9b", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680536739, "uuid": "3a42ce1d-4d38-401d-903c-df37a4ca77a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536739, "uuid": "27c2f319-8d6a-4d81-a612-d6c93b17583c", "value": "Technical Datasheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d29246a-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1680524941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524941, "uuid": "d05d2941-0f5f-4078-aa14-d1db89431269", "comment": "Malware payload (Vjw0rm)", "value": "268465fb352ba7fcdc2962fa61ef4297", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524941, "uuid": "30cbcadb-923a-4440-912a-be5dec7a688c", "comment": "Malware payload (Vjw0rm)", "value": "5e1adbfff93bc6cb24e86022f3729ae05ed44fdf7057951117b87c7ff135aab3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524941, "uuid": "cfb6d397-67cf-44e3-9917-9c2d612a591c", "comment": "Malware payload (Vjw0rm)", "value": "7bf12c70c9f1a33dd3d4a1856dbb47b117747857", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524941, "uuid": "ca8088be-bcdd-46cf-97c0-f798b46c1c05", "comment": "Malware payload (Vjw0rm)", "value": "3468b3c9f2a6aa680ec529cb665a4d50972b73dc89e4ee300fdfcd137f51347258717869b2fec702872c6f5d0b67a5ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524941, "uuid": "3115f97f-c328-47fb-8f77-c443ceb81536", "value": "T11F3526C93E91238ADF3DD3B5C7027112AA68661E28D725D9BAD00B4DBFD18643D9C2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524941, "uuid": "aabec83d-b064-4877-bb28-5632ee0d1b5a", "value": "3072:MQI+0S8VOIWMXib7SWGbgLC+DWvBLwSwfoPp:MQoxJwQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524941, "uuid": "ba100f0d-ffc0-4c00-9e98-7915fedebc74", "value": 1089450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524941, "uuid": "6b54523f-fc8f-4b87-b429-4c1b55fd26ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524941, "uuid": "64a565bf-2d95-4726-a7fd-1ead7691b6f0", "value": "proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1fcf37-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680503117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503117, "uuid": "455c923d-fbc7-4583-9934-fe19325a0b01", "comment": "Malware payload (Mirai)", "value": "78f1b81ef8be268d3f6defe1ff3db2ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503117, "uuid": "2ae9213e-70f5-4655-8ed2-2226f148e5ee", "comment": "Malware payload (Mirai)", "value": "5e2ac63927dc164aab934dd897de6815bb77f36c5a745ae841bc4d3476668262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503117, "uuid": "3afc1aa7-c1d5-4d9f-92aa-af833cf6b048", "comment": "Malware payload (Mirai)", "value": "3c433ec55b26ac9e610f92c4d018562ca2b23147", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503117, "uuid": "04e9c83d-810e-4094-9180-c72d477196fd", "comment": "Malware payload (Mirai)", "value": "029f9a1dfd206532c394d7acafa41861bc66cf3fcd33a2b95716e09ae966655aeaa1ab29c7fbb9b5a78329947c8f7349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503117, "uuid": "e298414c-5f3e-44c5-aa39-04c699bad1a1", "value": "T143E2F128321795D7C5F2E67CE1E003FD7E741B93A092AC93200DD582AB446F8396A7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503117, "uuid": "568d651d-eb58-408e-9d99-c516bd7a7ab8", "value": "768:xE0kxZKFZHIqD54qYBzLUMKmbFaJgGlzDpbuR1J3:S0kxZuqqDCXwMK1VJuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503117, "uuid": "5d4445af-8918-46ff-809f-256c4b79cb46", "value": 32936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503117, "uuid": "79cb841c-df6f-43dd-afd0-322343403a6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503117, "uuid": "fdec9c62-5b96-4d85-acfe-c36b6fee1998", "value": "78f1b81ef8be268d3f6defe1ff3db2ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636279ec-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525488, "uuid": "0ad1139e-8af1-4cc0-a633-2db3d5fcb0f2", "comment": "Malware payload (Rhadamanthys)", "value": "f1e724391f8704156479f8463cd4f7f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525488, "uuid": "3ce0c78a-1b1e-4b71-9bfd-c41502421b1e", "comment": "Malware payload (Rhadamanthys)", "value": "5ed98386abb0326fb81a4200085addb06c7b26e02b51efaa624a12be47d834b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525488, "uuid": "099949c4-de70-44a8-a4cf-1ffd5ce04fcb", "comment": "Malware payload (Rhadamanthys)", "value": "36d5ef01969d145176741b7f161c0ef950051d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525488, "uuid": "8049e5b8-a545-41a3-85d1-fe71804a1932", "comment": "Malware payload (Rhadamanthys)", "value": "6f4a22d944e0dfeb487ad05db1d0a33a1fefd02d25277d9a019d94688f29b0238206ae96fdad982174afabfa0fd7941c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525488, "uuid": "c570bee6-cfac-4833-96f3-808986ed03ff", "value": "T11F64D06227E1B871E61247328E1EC3F4271EBC65AD15BFAE2645BB3B0D341B1D222716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525488, "uuid": "b6ffafb1-abe2-482e-b362-a06b50ab0ee1", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525488, "uuid": "95e017dd-6a81-4851-990b-e35859c54d80", "value": "6144:YvrVNTD/xv3qS1pzvKLGejP1gMdJ+2BRpD6m+drXs6nZtkjt:YTVN3/p6yiyeJtBSm+drXDGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525488, "uuid": "1e84d7cc-937a-4542-9ca7-db4c1d1bb0c4", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525488, "uuid": "9cae083e-18ba-4df8-95e0-f95699a6440a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525488, "uuid": "e981fa45-203b-4bc9-b92d-5842e296671d", "value": "f1e724391f8704156479f8463cd4f7f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0875684c-d218-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680523618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523618, "uuid": "4d3b34f0-191a-440b-babf-373e2d554275", "comment": "Malware payload (Rhadamanthys)", "value": "c38c7a3bf7794e76ef04bc2d3fb7c8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523618, "uuid": "ff3eb2e8-4e02-443d-9f8e-55a445832306", "comment": "Malware payload (Rhadamanthys)", "value": "5ef8e0030564b34c5dc795e3875137b95dcd08d2866797a0a0d18569e9078b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523618, "uuid": "6173dc70-9404-4b26-acd0-f6beb15ce9e4", "comment": "Malware payload (Rhadamanthys)", "value": "b426325917fa390a56593556f0c9d127a209bcca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523618, "uuid": "38b3112c-0471-46e8-836c-4e956f1fc6bf", "comment": "Malware payload (Rhadamanthys)", "value": "acb48db518ecb9c16dd97f2ee65223dd59d2bfb5354e7f860b5ce8f39768143b1b64f1becb38cab5c454cca13361feaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523618, "uuid": "c87e4e2e-3344-4152-a860-9509309e81f6", "value": "T13D44E01077A1C872D91781315839F6E0B62AB8B297B1CACB77184B7F4D703C1AB7A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523618, "uuid": "42424436-42db-4fbb-ae23-98971fa1c5e5", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523618, "uuid": "57da3b91-4c20-46fc-9d05-210b47c58413", "value": "3072:hFVIAEHpE6QLiu1j8RmsHK01jHAHMUQhRBXC2VZO7FG5SlwVqM3vv3ms95vaz:hT0E6XCu71jHOpSNwwV7HmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523618, "uuid": "7a32e270-8361-4f1b-830c-60f9f31a7047", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523618, "uuid": "e60f1791-6c43-4ef4-a8b4-b92ee6a882b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523618, "uuid": "bda0eb4d-af45-454b-b3f2-a9a5ea564e2c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce10fabd-d224-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680529103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529103, "uuid": "61b32e81-a516-44be-a29b-87a141da6fd2", "comment": "Malware payload (AgentTesla)", "value": "f8fb9dbf412cbda6d97af028c62c11ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529103, "uuid": "56c019ee-0d1f-400f-b5ee-4e00bdd88156", "comment": "Malware payload (AgentTesla)", "value": "5f9df277772cffcfd8df579c4f8d1479979e35dd34f2d67fc68e935a6b3d3ab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529103, "uuid": "fe742d1e-31a8-456b-8599-c0f166c21f3e", "comment": "Malware payload (AgentTesla)", "value": "88b295686363efab1d68012e09e4dc3ce3e45c92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529103, "uuid": "2aadded9-23d3-4665-8c71-79e6d6d1a644", "comment": "Malware payload (AgentTesla)", "value": "b058ba7cbb47110ec95173191542e945352a36f74f9812f8d6f389e671b18e5f896ae1a406bb97e7c2e4059284921221", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529103, "uuid": "65e36b2e-1dc1-4021-9890-82aaef27d379", "value": "T1B415E0D1A6990DE4F42213FD88767841626ABFAA613BC91E00F731E65FB36432173D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529103, "uuid": "3526086c-3982-4741-81a1-cc89de89db4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529103, "uuid": "eb6920dc-83dd-4cf0-a28a-1956a9cdde83", "value": "12288:7EEmYMUnFW/Nut1Tm+L0EPtEhySCbA8habZcwqbcu0lu+vAw94jHXBOewSi07sIX:7EEUEtBZPY/6A8hemdLWUHXgerxYRqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680529103, "uuid": "abf21ace-c00c-4d00-9763-f8deae9b3b7c", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680529103, "uuid": "7e2ad7c7-3024-4816-be3e-0d2f3aff6f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529103, "uuid": "e97add44-9c90-49cb-a48f-a1a89342c428", "value": "5f9df277772cffcfd8df579c4f8d1479979e35dd34f2d67fc68e935a6b3d3ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16092185-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501307, "uuid": "16502900-11d3-4a1b-b942-eb6e910618b2", "comment": "Malware payload (GuLoader)", "value": "fe865f3a08a53a17e388e09352139854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501307, "uuid": "930274dd-6462-4da4-a028-7e6ea1c3f5b6", "comment": "Malware payload (GuLoader)", "value": "600149be9fe622619c543cab0c6768a553cfb2aa22c60b7265b61ef0970979f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501307, "uuid": "ce2bca05-627a-4445-8cb3-c2d3eb861bff", "comment": "Malware payload (GuLoader)", "value": "c39339ac2eb7b845c4b0151628fc8640a44f76f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501307, "uuid": "e104200b-7c06-4913-8b26-72948affbd8e", "comment": "Malware payload (GuLoader)", "value": "c9b62b48934f068c310f5df16fc36aa83103d2e3ec5180173ddb41fd932a091042bc586d25df72869f209ab4224491db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501307, "uuid": "efa9f4cd-50c1-4aaa-ac67-d12d76e19a0a", "value": "T1002401163690C4A7D2865A714DAB6D219FE2F8213195668733D06FAE7D33EE3D20F053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501307, "uuid": "f290cf20-82fb-4927-b87d-8755a558e635", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501307, "uuid": "27ad4436-4141-41b0-aa43-d43df93dc856", "value": "6144:zqjI1+M0sJTQ8bd81+1DEx7lAIWP555h1EJE1aUVHoU:uO+MRJi1GDwlW55n1EJOaUVHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501307, "uuid": "894102ab-8ac6-4074-95e8-1de57b4a3dd5", "value": 223819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501307, "uuid": "819b603d-510c-4ca7-aa42-5b09fff41b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501307, "uuid": "97b92060-ea97-4fc3-82b6-55378d33e7e4", "value": "INVOICE9765456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343c671d-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680524980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524980, "uuid": "e893335f-c866-433a-8f5f-6c4753e0a56e", "comment": "Malware payload (Gafgyt)", "value": "59933a4037476cdbd96323e9ecc7e1ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524980, "uuid": "b5eff5e7-2214-4749-b5a7-2a59141fadbd", "comment": "Malware payload (Gafgyt)", "value": "607cdd0d384bc16e70087a0cde1f27685981fdb3463610e718b378591b94f228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524980, "uuid": "0e5de1bc-86a8-4164-8b90-409ba556f2b6", "comment": "Malware payload (Gafgyt)", "value": "0ac06c2b7e371ac4d5881ab19a7ab7abe4120c01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524980, "uuid": "7bac3a82-f94d-4f7c-b970-63061d2dc200", "comment": "Malware payload (Gafgyt)", "value": "cd6b88455e4de55f4999a22c6864ac6d191c18d2da89d34b2029103f7855bd6f26c829fa2b86b00bf78f0cf648e22b5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524980, "uuid": "80889f08-70bc-40fb-8625-a7bcaa35f88f", "value": "T127E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524980, "uuid": "a79468d8-9388-4543-8d0f-cef563ef8ecb", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVhpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflXgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524980, "uuid": "f04efb37-c887-4a88-ba3e-969ad69ac66b", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524980, "uuid": "72ec2b4d-49f3-4d02-bb19-28aecf80ef9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524980, "uuid": "749403ac-6c0c-46ba-99db-0fda4cad50de", "value": "59933a4037476cdbd96323e9ecc7e1ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe66688-d1eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680504564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504564, "uuid": "29858f1c-b5df-4675-889c-99f4cc43a22a", "comment": "Malware payload", "value": "8e24ec34d70eb73d2b1bce1c5a686502", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504564, "uuid": "d55278ba-143c-43e2-a938-5c9c193ab045", "comment": "Malware payload", "value": "608e8ef045cfb9d6c6ab75b183b2e8036dc1d4d680f3c0278336e0ec31fe0dc2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504564, "uuid": "0f1cbdbe-89dc-4aee-ab76-7de820000e5f", "comment": "Malware payload", "value": "536a3ef2aadb8415cf3bb89e492820e16808a763", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504564, "uuid": "7aa391f4-ecae-4ded-943e-a74128478554", "comment": "Malware payload", "value": "5b8e2817b294f4d3531179d667486a5dd663f57fa1fa964390a8a7bdf4b59d5652ef5ad30cbfba96b526bc58d6bcbba8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504564, "uuid": "9a85d1fd-1a0b-4b47-acb6-c0744a6e49b7", "value": "T1B6928C15C021E4B4D79B6A3DA00D01F6724BC141A244EB8B6D99F2DF4F40AEF4A7B88E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504564, "uuid": "e598e094-22e6-4fa0-a08c-148feab5a962", "value": "384:VZS441tvHfaG/Txzmb17tQmp2RQEJVQr2Clvj5vgG6rwR:VZWv/d7xvmA7JejlLdgHrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680504564, "uuid": "f2f45577-b265-40e2-b5ca-ea1fbbc9f31e", "value": 20882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680504564, "uuid": "b01eda50-273e-4ab5-88e0-6526c35a0645", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504564, "uuid": "1208ad77-c3a2-469c-925b-84b6c95508cf", "value": "SAVE the DATE_2.9.23.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ff50e-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680522557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522557, "uuid": "e4803102-7d8f-44b1-9e7b-2d3f388f4577", "comment": "Malware payload (Amadey)", "value": "8cabb64229181e91e54d62b00f7a6584", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522557, "uuid": "e69151dd-e4d5-4844-acc8-e0f147cad359", "comment": "Malware payload (Amadey)", "value": "60a4732db8938cb53cda0f5fc04d409590dd7945ffd9b8aacd3f5f608f4569c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522557, "uuid": "25f28313-af4f-4155-857c-34bc5ab651f1", "comment": "Malware payload (Amadey)", "value": "bbe67f2284998dfd51485e4f2ba01d0bd16e02c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522557, "uuid": "9f6d3f8f-af64-4b76-a814-ccd8063a14f6", "comment": "Malware payload (Amadey)", "value": "9b7a78ac25d942ebcc8671b7a3c957fd9375beeac3c954b55d478f4318bdfd5d49392aa6f8a555a6241df13eabb4e9b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522557, "uuid": "05ea9426-5533-4e74-9de0-39b43f0fa773", "value": "T1B264AE4257E1A870E513C7318E2EC3F4661EFCA1AF297E9E2756BE3F09341A1D122716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522557, "uuid": "774acf4a-a18e-4deb-8709-31d7713a67c6", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522557, "uuid": "a37960aa-d8c0-4e1d-9dcb-459e61a40b47", "value": "6144:maz/Z5Jj7Im0MYIbM/10O17l1RJZtkjt:marZ5p7Im0MlbM/10yl1RJGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522557, "uuid": "0edb2357-e2d9-4e9c-a15e-d3b54329bda0", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522557, "uuid": "8f17205e-1251-4276-ab75-96fbb4cea088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522557, "uuid": "331e647e-76d0-46f0-bd2b-80550a337259", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e2d590-d24a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680545164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545164, "uuid": "164319e6-c419-4bd9-9358-cf8d8c5a1581", "comment": "Malware payload", "value": "45e43429ca88345aa0a7a20cf7189411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545164, "uuid": "5f4c068c-0e4e-4bd3-97c2-98a344fa94af", "comment": "Malware payload", "value": "630f2becb05a49664975e0561dd7f4a45690c3cc1c039816c5b1961caf0c2980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545164, "uuid": "2fabbfdb-78ea-4b2b-9223-8470854e0864", "comment": "Malware payload", "value": "72a25620f0f2722ab03c10ea759e54bd778b60b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545164, "uuid": "9647ca55-82c6-49b2-b255-4ca7f0ca0a86", "comment": "Malware payload", "value": "0559c8c223838e9be1dc8c1ca527428dd5ef55064b4beb2b63445604a292e7e0f0f44a3f832bdd02d1960170d2c03e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545164, "uuid": "0c425789-c19b-4cd9-95eb-abed7992f53f", "value": "T1E9A423197AE58036CA9A17711E7BC0B63AF645321A2B815A53B13B1C7DF3982F10FB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545164, "uuid": "b590cf8f-8ed1-40cc-a835-56136bb132de", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545164, "uuid": "63ed066d-2bbc-47fc-9b9c-1f83b585ace8", "value": "12288:vYSr32vyYcPldpAucBmtmChzxn2njaHos0t8JLFobTMWItO:vYSr37FPxQmtxVe2btF6eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545164, "uuid": "7777ede7-6af5-48d2-93e3-c123b8f16a0f", "value": 477270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545164, "uuid": "9139962b-071c-460a-816c-0f62aa8a86b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545164, "uuid": "12c92f99-795e-443f-b85b-bf8efb551a7d", "value": "EO030423.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ec4ae-d236-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680536731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536731, "uuid": "f57c8eb1-1a8d-40e0-a07d-b5a0d6d1c5cf", "comment": "Malware payload (AgentTesla)", "value": "ae0a201deba07a06837a7e74fb3e5bf7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536731, "uuid": "ca2183e8-6ecb-4d65-a156-63dfad8c0f4b", "comment": "Malware payload (AgentTesla)", "value": "6321fe13a2ca90b23de87cbe68764453d3d2b6009095c1a926cc61f83ef6a32f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536731, "uuid": "6181f8a6-1efd-4754-80dd-6bedccc07e8e", "comment": "Malware payload (AgentTesla)", "value": "03238c94e2107fde6aa3593aeb6297c6719bc7c3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680536731, "uuid": "71039b7c-b958-4c25-a5be-2aaf5d5fc2fa", "comment": "Malware payload (AgentTesla)", "value": "b7e006a886d8c4d0295b823f2d2f46caeb0243dc1b952cb5b35fc3f947955cd19cd73746fc2f24ba30a6ed4698cdc145", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536731, "uuid": "a7a64c01-1038-42df-88f8-93fd19cf5d85", "value": "T173C423BBDE090AF54440BE4B57A01FEA0A90FD90D65B1A51F3C8DAAD077718C5379B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536731, "uuid": "9edc6948-1ac3-4383-8fdc-a0441dbe1923", "value": "12288:eML7nCC3sLz8VgKFhYO7kPv+0mglDlUHBt4gNI4JCh8AaGUfJ+kDOkxdEL:ePL4VgHakPv+0XhlmBtjC4JSJ/UJxdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680536731, "uuid": "fd393e0d-cf23-404f-ad34-63a926a65a04", "value": 558504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680536731, "uuid": "9375a51b-47b6-457d-9165-cbf4abe4d4ed", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680536731, "uuid": "9ca2178b-3499-45e1-a3f1-8cbbb4f64543", "value": "Technical%0D%0A Datasheet.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca623a0-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680519518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519518, "uuid": "ce2a18c0-5bef-497b-8a43-a168beb48027", "comment": "Malware payload (AgentTesla)", "value": "5024700fd5f7e52bf567e82ebdb80e14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519518, "uuid": "5d71c184-afd4-41a6-bd50-ed7cf242c8ea", "comment": "Malware payload (AgentTesla)", "value": "639cd0b090f4459153355f5a090835a82451eb6028054ce030cf6366314fee20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519518, "uuid": "43df68ad-9598-4dc2-a9ed-9575257e967c", "comment": "Malware payload (AgentTesla)", "value": "e94620b0d5cbfb06e55a167f24ebd3df83f6d962", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519518, "uuid": "30c0cd1a-91c3-4452-9fc5-c434ba3640f6", "comment": "Malware payload (AgentTesla)", "value": "07d237556ccdb1c6df900825dbb37577ff519bb131953883f0e78013d0742abc5bca890e8d25cfadd05f649da309ba06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519518, "uuid": "9ceb80c0-48f8-4de5-82de-9674316fd0b3", "value": "T1376593B495FF45DAE00FC9A41AFCFCB805B672F3D8D20DA5036CA3045E2AE987E4554A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519518, "uuid": "d8627302-a3c1-4230-9c4f-84eaff90a576", "value": "12288:/eUclQtHUB7lceAvwDlidquEsc1Sa0Pyifu4XY5Z13VhpPlIX4cPMWgxeZwGmuTe:PquEsy0Pyifu4IlVhpP2MXeZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519518, "uuid": "4a352f13-101a-42ba-b8f6-784170efc466", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519518, "uuid": "a990d92e-7230-4604-a71b-0b0ff34a0400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519518, "uuid": "12386701-710b-454a-a4a2-6e6ff54dd470", "value": "639cd0b090f4459153355f5a090835a82451eb6028054ce030cf6366314fee20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e250dd82-d1ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680506374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506374, "uuid": "467eaaf9-08b7-4fb6-a0ba-97af97d4c5d6", "comment": "Malware payload (Formbook)", "value": "888481963e05449a34ec1a1cd5ced47c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506374, "uuid": "085b70d3-c8eb-426c-a81d-1c2de451bb2d", "comment": "Malware payload (Formbook)", "value": "63b9c63ea01eda5d85837c78e26d10282c4b2a4bb98685eeace7c06a3b313650", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506374, "uuid": "e824e6d3-4cb2-4b39-b66a-83591c81d8bf", "comment": "Malware payload (Formbook)", "value": "5d001988e2860c90377416d998d4e2b2c604dfb0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506374, "uuid": "4c43f0c5-b52c-49e9-a4be-f30fd4490ba3", "comment": "Malware payload (Formbook)", "value": "96a4620fae5d09f7a2270cabeb96f0ef29f6026d94920de21cdcda3f6878e4d177f28cb3f91eff9eeb24597ee784a7d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506374, "uuid": "f4b12e90-9ef3-4490-8661-7f342a4597f4", "value": "T1AB54232D22CBF0AFC739C1BAD2313FFDE9891CA5692D013195503A98A75E8CCDF49694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506374, "uuid": "41aafd04-921b-4844-80f4-05ab16a63a0f", "value": "6144:0AO86u0sqTDYQS4r+v/jvU4hqppoOXtYZBLnab0Hcb9J+35:bO8/0vT3Br+3js4hq7vXOXLaCcbaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680506374, "uuid": "31cd1e09-250c-4eb5-8866-e8c6474746fb", "value": 300348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680506374, "uuid": "5b0be088-5e15-4be0-9463-4f6bbcd20bce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506374, "uuid": "9d579052-56be-43d8-8656-6502fbc4f9e0", "value": "Nova narudzba u prilogu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02486e42-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526614, "uuid": "6999aa51-14aa-4f70-b3a8-22401f060ad9", "comment": "Malware payload (Gafgyt)", "value": "bacd5b23c9958b53d1b5ea2140c14a47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526614, "uuid": "5250caa1-aac7-4381-ac6b-cfb1e137f80a", "comment": "Malware payload (Gafgyt)", "value": "64ae102cc9e8f14ef375cd0855896913358efa9a32ee6b2bfb8da2e077cb6671", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526614, "uuid": "04bb3920-0260-43a5-a33e-f90f19e0eb99", "comment": "Malware payload (Gafgyt)", "value": "ac562c5c64c3fb3f19c315591c025e1394452111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526614, "uuid": "239dee94-a4c8-4393-b49a-057b5b088de5", "comment": "Malware payload (Gafgyt)", "value": "67cdbe6e406be37e7b6470e770e8a7118b6cde1184ddc704038c5f9e74419cddb9afbde6ac4af91be72c70fbc76bd403", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526614, "uuid": "3a66c401-5cf7-4099-aff5-d8390d53c4bc", "value": "T13AB328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526614, "uuid": "957e3055-2298-4035-9a68-13d1e3534f2b", "value": "3072:WD3l+XQzPeV91310pWudRKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCRypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526614, "uuid": "beef110d-c669-4299-af5a-8e80e65c8085", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526614, "uuid": "a3d1dee3-bc4d-46e3-b0e5-999f2df03d8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526614, "uuid": "f97fb419-7276-448e-bcf0-0faa0e485a87", "value": "bacd5b23c9958b53d1b5ea2140c14a47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b80c6b-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524559, "uuid": "a3b55522-42d7-4327-ad67-0044eb793322", "comment": "Malware payload (SnakeKeylogger)", "value": "f6cc57f1813610c23e0eee4ca1d5ce8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524559, "uuid": "6d2840dd-e251-4097-af40-91130cf599ab", "comment": "Malware payload (SnakeKeylogger)", "value": "64c6976cf3fc83477442098a4fae18139d3d9acc57289dd6820829ae3fc2d00a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524559, "uuid": "9ec7fa0e-a8ff-43a4-a76c-67bbd0741c4d", "comment": "Malware payload (SnakeKeylogger)", "value": "9c374bc6c467d589648495a8a0713fc057d82bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524559, "uuid": "daefe934-380a-41cb-a29d-fe23d7cfec02", "comment": "Malware payload (SnakeKeylogger)", "value": "52f688454dafe8f77588322b80727f1d2c4670677a40ad76865e7a6a4be123e244cf21620c3103125dbd91a49e24ae46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524559, "uuid": "452829d6-5175-49cf-bd28-9bcd9d15bbec", "value": "T1C154124D75A0C4A3F5A303316E7E8D7B8DF2582654E0EB8F23109A8B3D66642DA0F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524559, "uuid": "7ce456b7-4f96-436b-a598-cb011fd4da8e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524559, "uuid": "d766d9d0-0abf-4787-b085-5b2c0f0b2123", "value": "6144:/Ya6oudHOfjJZ9foFdwxEZRMF4pWsgpzKI:/Y2uBmQHwxEDMapWsiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524559, "uuid": "b657b853-1f14-4326-9ac5-6d9eba85b16e", "value": 287825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524559, "uuid": "8d66ec89-b2c1-4583-bb1e-4bfec1ae3721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524559, "uuid": "ceafa843-c025-4416-9227-0b16a45e4bf4", "value": "Rejected invoice 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba944ade-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680519622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519622, "uuid": "0670e653-7527-43b7-9c06-80ce20caf8d9", "comment": "Malware payload (AveMariaRAT)", "value": "e588266d7f1c8f4e397bae4cdcf2710d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519622, "uuid": "6f144f16-1e45-4e4f-9a20-bcff417aa663", "comment": "Malware payload (AveMariaRAT)", "value": "653acedbfd1cc43d370d69f63265a58ac180689929c376ffa72fa0d3410b4cca", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519622, "uuid": "d90403ec-ffc1-4d03-9830-5ccd89b2709f", "comment": "Malware payload (AveMariaRAT)", "value": "5e1a9233b25485885a61bb2dc5f897cbf761250a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519622, "uuid": "20d65788-8800-4ea7-902a-94f8aa9eaf2a", "comment": "Malware payload (AveMariaRAT)", "value": "9a570b39c33d17897cfbf6f54895ba1a7d756b33eec77c10693339819e31a34222830f83e15411ae1b4354121d71df5c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519622, "uuid": "561be28e-06de-40a1-a563-d818fcbf0969", "value": "T1E5E412043755A732CA2D07FB8053D3250B75A6AB2012E77D2CE758DBA932FA4C5C9D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519622, "uuid": "77ea3bdc-708d-40f0-b2c7-01457edc7fe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519622, "uuid": "02764132-4f9e-48bc-b933-62b7842c0d79", "value": "12288:R5CBWKdq1FbwwJLwr5xhReyeAhyTk4oIiYDfXtsPWrrnBeKFN+8tV9oJ:CfrpNle0yQgDXtaWrLBeKFNRt8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519622, "uuid": "64413887-4f69-4e6c-afdd-ad4c6c52ba26", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519622, "uuid": "72b8ef65-7ef1-41d3-9ad0-c8b6b315907a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519622, "uuid": "e2861e8e-95a4-4814-9f8f-713f05c2ce6b", "value": "Leintz PO-2023-04-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5148ebcb-d1e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680500117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500117, "uuid": "2f26f24b-4603-4fc7-a648-ae04ed68e1f1", "comment": "Malware payload (Stealc)", "value": "4439eb55cb8b8098074a4425d08dd4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500117, "uuid": "4d37341b-8b7c-4766-91ac-9cdc5d8974e4", "comment": "Malware payload (Stealc)", "value": "65bacee3cd5ffdee6e586718a23684f4e8f1e5672e08b5fd0aa6978fb48b8f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500117, "uuid": "00a57668-e187-480e-9414-79bf23fac3ce", "comment": "Malware payload (Stealc)", "value": "cb8521a4ec0efbd0db0d7e44da407778e22a1863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500117, "uuid": "88b3aaf4-33fe-418e-843f-61c1fd500c24", "comment": "Malware payload (Stealc)", "value": "020f2f7c2d7972bc411ddc81242809ba0ba178751b68a83e8e9ae307526cad77a1db6f116b3a133a2fa6b8fc09da0890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500117, "uuid": "50c9b38e-647f-4dad-9db7-e79ac75e7e50", "value": "T121D633DD49AF90F4DDC93470870BFE8A67F96D7609C0CC1CA9C26EC9AD52E71A022617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500117, "uuid": "24dfa4f7-3288-447b-b657-0bb5a08faae3", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500117, "uuid": "9bc2fbfb-bf50-4deb-be0e-be90466ff534", "value": "196608:Z9cTrBl+PoIR62/AC04vR8oV0GpgjrxgpM+GJTaHauue7/RX/fVX7m5+aYqkx:gTN0gIomAgbknxFWJue7/RX/tLm8a4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680500117, "uuid": "1366a1a2-890b-4f73-980b-2a8bb9ac6464", "value": 12991784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680500117, "uuid": "5da0c058-eeb2-4042-b501-db578f8855e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500117, "uuid": "c5f5ff01-b45d-4ee6-bb85-be3b0f9d4924", "value": "4439eb55cb8b8098074a4425d08dd4c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c3cf91-d23a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680538533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538533, "uuid": "d34a62f3-7073-4b81-86b5-30303ae943bd", "comment": "Malware payload (AgentTesla)", "value": "2f5926f45c8956afd55edd9828ac3862", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538533, "uuid": "7ee29811-4496-4321-8904-7f2f8143f0c1", "comment": "Malware payload (AgentTesla)", "value": "6672733a2c90db08dac50d0e31d5a2316940c3c1200c8c15ebf77450c9392199", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538533, "uuid": "56ee9109-19a8-4e3a-bf4d-db7330d69a76", "comment": "Malware payload (AgentTesla)", "value": "7f2ceda655e5a225cf34adcdd1f96c124233b001", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538533, "uuid": "063bd64b-454a-465d-b569-95459f515eb3", "comment": "Malware payload (AgentTesla)", "value": "2af19fc9d182caa5803de1bcc53e4e585ecf75a3c3a0f3ec5b28e3f6bfd294eac6b6e3c61ca67d7bf995f4ed47648d34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538533, "uuid": "ac02a45a-c789-4c6e-9a80-04749426cc03", "value": "T1F335021BE2808D0ED8424FB4BB97A9C8131B7E517E5A74872100B74F2EF3A65B587E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538533, "uuid": "0441da68-b965-482f-960f-be9b62815683", "value": "24576:7LKsu9Vsu9VZ+MXU2u9VO+MXUybMd4DooFG:7LKsuUux+MXPum+MXa2DvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680538533, "uuid": "150f5165-01e3-4b78-9819-c39edf9daa73", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680538533, "uuid": "f752f6ad-6a66-490f-8f2a-e9ea93224f0c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538533, "uuid": "06a33c53-f462-4419-812f-871c0379217b", "value": "product_List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16699dcb-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525359, "uuid": "83698fb8-ff30-483d-b872-4efae497c78e", "comment": "Malware payload", "value": "2e37ab17285eb1851995c85d30d8939e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525359, "uuid": "a9068fc8-d622-4b9c-a855-cebd134cdbd4", "comment": "Malware payload", "value": "667acaa3e0a3674d6e3d4ab97b2f766228728ee489217e7cc89253ed9a33c18f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525359, "uuid": "04f95fa4-5de0-4b78-957d-2e60fe30837e", "comment": "Malware payload", "value": "e1c56f99ee6aaeb6a64c23b64b695016656592b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525359, "uuid": "ddc8ca57-d0da-4d86-9a7f-bbddfd2d0f76", "comment": "Malware payload", "value": "72abb530a921d9755e8e71c403c3bae5f4499b03a5e42ed01b7e1d9c4326b5d8137d0bb228de92e5d77ef6240b83fba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525359, "uuid": "7a649ea2-12d6-40a4-8ec2-d5e29f939801", "value": "T11C36330126E16875D647A331EC0FCBB43B6E7C209C111BAF1B88F77E09782A6E577616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525359, "uuid": "008630e6-522a-482d-9b7d-29861ebb82c4", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525359, "uuid": "0f501c0b-64f3-4433-bcd4-5919c01cceb1", "value": "98304:hHVwRXmTQ5/K5isRcjubEjdIhd03cVf8/kg1gpP+Qt:cRXmM5/Kx+wqQ5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525359, "uuid": "73a8db4f-dab4-4bf0-a55c-4170d4d4b85d", "value": 4947968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525359, "uuid": "520450d1-666f-4b9b-9273-6640e77d3e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525359, "uuid": "ff84f2c9-6095-452a-94e7-bbb379859b20", "value": "2e37ab17285eb1851995c85d30d8939e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc4df63-d220-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680527093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527093, "uuid": "14e49946-ae4b-44cf-8ab4-bf355c369540", "comment": "Malware payload (AgentTesla)", "value": "98830e215ee0b2944e67772fa0ea3e9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527093, "uuid": "fa301ab6-c576-4c0b-9b56-e77e6bb3ec20", "comment": "Malware payload (AgentTesla)", "value": "66cfc79f6ab40d3fd5c394dd9e44f58dfa9ee7d2e2d105ac8ad6f181bbb5ebe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527093, "uuid": "336441e7-a633-485e-96c7-eb8ab325165d", "comment": "Malware payload (AgentTesla)", "value": "c3e10064de9528c55483f8cb1f8a50c5f9766240", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527093, "uuid": "3db2c612-47c2-49b0-99c5-4b9026a01680", "comment": "Malware payload (AgentTesla)", "value": "166ad040d49d17b5d281f5580d3ef039934126f98eb953abedb0f613c2bec23bb07158d3782cbfe0758d29653246ea56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527093, "uuid": "71681b7c-41b8-466d-94f5-79cfebdf2127", "value": "T1BF35C4AC366432EFC467CC72DEA81C64FBA0747B631B8607906F119D9A0D887DF151BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527093, "uuid": "4a320c0d-2bbb-4972-821e-6b69297f67c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527093, "uuid": "2977bdc1-9b59-4c9e-9d2f-22f8c95aa811", "value": "12288:3RIPtZxZKCDxjwjZ7/qQVV37QPBufaVTKA+yHXv+mAyywVzjZ3UcW+/xDrqllste:3RIPtZxZKitUxlOqa4O3v+mewVH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527093, "uuid": "96e38684-d5d2-42d5-8ab7-c7af7aaab12c", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527093, "uuid": "49677f1a-f001-47d4-9a0f-002ee4402684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527093, "uuid": "8942751f-82a2-435e-bed3-2958085ee9d0", "value": "NV-JRH250119115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3864cd-d1ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680505025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505025, "uuid": "d3651471-8922-495c-960f-30d6954ca18b", "comment": "Malware payload (AgentTesla)", "value": "d4bef4b07059e137cb445ad46607a039", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505025, "uuid": "548c0dbd-c09b-4882-9e79-1ea1ca929abb", "comment": "Malware payload (AgentTesla)", "value": "66f84a9485233c4126143d575a7d5d754721f963e71069a9456399c601af2ea8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505025, "uuid": "d8de58e3-f0f9-4c8e-b13b-323a4b5b3c1d", "comment": "Malware payload (AgentTesla)", "value": "f9b52054c5020f0a6bc30ad369a0dbf06c9e3c16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505025, "uuid": "46aca974-80fe-4ed6-b5b7-b4c1cd3652da", "comment": "Malware payload (AgentTesla)", "value": "1e917e8f97dcd9a789db59d979aa5d60db09fc938ac256ea411fecc9ba062a3cd9bf65f437a2d4797dc9045aba0c31be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505025, "uuid": "79873a59-d133-4552-8846-052337d0013f", "value": "T100D45B3C0ABD67A2E179DF74DE708110F3F1A41BB721D96D2DEE008D0656E425AA372E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505025, "uuid": "0c00725b-c193-4496-b0a4-e03bb942aff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505025, "uuid": "724a5f21-55e4-46de-9b64-fa352fd82a31", "value": "6144:nYlCTy6dfHrM0oyvqwVns5DnfuqpPhlpImWwhdGC7dAvTxxJn5I4h22cqnCBtVuv:nYlCTz/riyywVnmp5lBKC7Wjzg2cv0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680505025, "uuid": "7bbaa933-1269-4d99-83f0-66d283408318", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680505025, "uuid": "11261fdc-f056-40fe-9350-1d93cd1eb6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505025, "uuid": "08ac9364-b187-4587-87b5-e38e94ed69ab", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd532889-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526552, "uuid": "f6b3c28c-8d79-43af-af76-d5ba22ea419e", "comment": "Malware payload (Gafgyt)", "value": "1cab3056b1ba00e4e8712df4dcfb428d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526552, "uuid": "64909539-9576-425d-81a8-32ca1b60d935", "comment": "Malware payload (Gafgyt)", "value": "66fcb8a1fc59f038b1b9855a5bbdb7a141e2cb6271de366a7bc7799e9a164e88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526552, "uuid": "58ca26e3-2fd7-4eab-a324-f56cd96862c1", "comment": "Malware payload (Gafgyt)", "value": "2164f08cdfe0ab8bdbd56bf70704f8ef73627f29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526552, "uuid": "b313c220-4b93-49b9-bc4a-e26662bd0634", "comment": "Malware payload (Gafgyt)", "value": "c7445b3af5907e9dd25470196606befdc3334ff28b5a94c799bfff02c0d0fc0803c6166ecff0acd5877201d028db6929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526552, "uuid": "6f231dcc-6a75-446d-a1a3-260b1dccafd1", "value": "T1F2A34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526552, "uuid": "f0acca2c-4df7-4fc4-ba66-33d7fcc5653f", "value": "3072:YWCjQrLpnr85EdT9Oa8vqbVr7D/CEgmqAgcVyZIcBI:Yf5EdTbpr7DWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526552, "uuid": "3131a013-692d-4437-9e05-3edb652f1281", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526552, "uuid": "6fdb5d66-c9b2-4074-acb4-5343d7b9bc8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526552, "uuid": "cc486770-f436-4e26-a9e4-a60b98fbbcd1", "value": "1cab3056b1ba00e4e8712df4dcfb428d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dc61cb-d212-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680521033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521033, "uuid": "49b561d7-65d6-4ab4-b35e-3ee4a385e5da", "comment": "Malware payload (AgentTesla)", "value": "4fb4c8ababf72ddf5d1f0d062bab366b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521033, "uuid": "333b849a-ae72-4562-987c-4fcf6de73508", "comment": "Malware payload (AgentTesla)", "value": "67b636e506316c91b7dac8f11a003b70e68a981fbaef6bb44e640eb671d5bac9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521033, "uuid": "cc48d2a1-6960-46ea-8e5d-36216a13ad38", "comment": "Malware payload (AgentTesla)", "value": "87d9502a787ead76800eccecba7e50a8bb84876f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521033, "uuid": "3c634d06-c254-4080-ab01-747f79c8695a", "comment": "Malware payload (AgentTesla)", "value": "6fc1bfd805517ffd475a3f6356bb50d8b89c00f17042db25394850f96adcd1e08cc4e037061c5c508a1efd61a205eb3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521033, "uuid": "b7ae7600-c46a-4dc9-aa10-604306aac561", "value": "T1FE14B211F355D57AFA484739AA9282A71256BC73B91AC94731C7730F1B33FA19C32E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521033, "uuid": "bc6b0cd6-ad09-4c14-8ad4-2349607f412c", "value": "6144:OZ+RwPONXoRjDhIcp0fDlavx+W26nASzF0kNeR0J:cWkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521033, "uuid": "92d20f15-b29e-4ce5-8530-3c0c68174c1d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521033, "uuid": "dd4f3dc6-d4c0-41ec-b578-0081b0bc5781", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521033, "uuid": "1e537db6-0817-4467-af37-3a410b48306f", "value": "ABSXInvoiceX44XMondail.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35355103-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524552, "uuid": "e7daaaf4-7097-43f5-9922-e2c4a0abca31", "comment": "Malware payload (SnakeKeylogger)", "value": "b6680766630014655fa9c668f078ca03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524552, "uuid": "7a0f56bf-e464-4f2f-9b92-3eef73476179", "comment": "Malware payload (SnakeKeylogger)", "value": "6878e66635507e66a07e77bfce182941bb31354badbcee2cc1a013d29f4ccdce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524552, "uuid": "4a50c58b-c070-48c9-b9ae-57975fa69f6c", "comment": "Malware payload (SnakeKeylogger)", "value": "968b5efca650e7c9ae4915fce62f8775bbcd6d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524552, "uuid": "c20ae9be-22f3-4e93-9f67-c52372805a5d", "comment": "Malware payload (SnakeKeylogger)", "value": "c81e60b04dbc2d0b0374decd8e71620ebbbc2529dfc6d56ae46ea1dea7106e7efc57fadf99d62696b33633fe416993b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524552, "uuid": "72677937-7c56-4e1e-9b3b-13af262883ac", "value": "T173E42209301CE726CA2D8BF79412912417B8FA675553D7BE2CDE18EF9A12B08C985DCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524552, "uuid": "187ce69e-3dc6-4774-8e47-30bbb0e9a7c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524552, "uuid": "5ec1a960-b7bb-4ae0-8b5a-a3a2d352c429", "value": "12288:Z5CBWKdq1FbwwJLwrSJPkEhtb0cSJKCDhkBIA5u5tyA///SULId9Ww9:6frpblcFCDqm/Pz//Sv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524552, "uuid": "b534700a-c354-48fe-b25f-fe15cda23972", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524552, "uuid": "0deb2e5b-bb29-45ea-bc43-6924d600a7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524552, "uuid": "36a61772-e4de-41cc-82b2-473beb24e1ca", "value": "acJQXe9N285gkR0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2593f055-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524525, "uuid": "db823781-828d-491f-8162-ff40b13d3372", "comment": "Malware payload (SnakeKeylogger)", "value": "4f400244a6d367b60be5f3bb57d1a461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524525, "uuid": "0f8895c5-4667-47b1-a8c6-6fc1f62982f6", "comment": "Malware payload (SnakeKeylogger)", "value": "68d4adb3846e92a85cef8d51f130b2cb8631ce5e7395fc9cd18dfcffe40a5271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524525, "uuid": "91b23a3a-8803-4260-b087-7e345a9f5b8f", "comment": "Malware payload (SnakeKeylogger)", "value": "5d97772a918d8deb765e27728b46d1e342be3a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524525, "uuid": "a14e3bec-fcc7-431f-b9b1-02ea8ca13a1c", "comment": "Malware payload (SnakeKeylogger)", "value": "321609a0eb12b95222a54887c842a42eeb745a0e1a2df4a31b3f120d3a9e7399a507fc075d17e7126ae5e56b9c02b8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524525, "uuid": "74088a22-80fd-4050-b090-e6a18e00b300", "value": "T10BE412192A18FB16CE7E43FB9173510813F9BDA72443D7BD1CCA38D79832B988951A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524525, "uuid": "3ac51a83-1daf-4ecc-b5df-45a88a54234b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524525, "uuid": "ba545dba-7aee-4386-a41e-ad23f71ff648", "value": "12288:U5CBWKdq1FbwwJLwr6i8rJPnDTK1/u0IrzkJTDspbR6UNEb7:PfrpfiJfDWIMTzUGb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524525, "uuid": "c57503d4-39d8-4715-b1c9-45cf118b0212", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524525, "uuid": "c0e1bf92-c676-4d05-a6bc-60a014d3e2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524525, "uuid": "f9f31d41-5cf4-4f93-966b-a241b50aca82", "value": "Halkbank_Ekstre_20230403_080804_358439.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4e4838-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680522604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522604, "uuid": "ad25eb29-6730-4a29-9b71-ee21d8d55aa6", "comment": "Malware payload (Smoke Loader)", "value": "8ba74b6ce57fdae026b73382a6565781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522604, "uuid": "4b582206-7985-4c53-8cf8-6684cb30429b", "comment": "Malware payload (Smoke Loader)", "value": "690845ff6dd92317baf11489c8f794bcd939bdfaab8f94d9be14c67281c77d1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522604, "uuid": "b3c09ea5-8005-4cbe-8012-937b43ba8370", "comment": "Malware payload (Smoke Loader)", "value": "8ad386a61811b60f886789498739265e54e67c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522604, "uuid": "ab966b67-9cd0-48fb-900d-5cd64992461a", "comment": "Malware payload (Smoke Loader)", "value": "9d59c79bb24644db6616fe69fc4c19b1d5213ec366e56095fb8f754510b3cbf9a8c8cafc194b67242838a3aa2f3d5f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522604, "uuid": "874d115e-f06b-465b-b6ff-84bf66eee97b", "value": "T15D64AF4247E0A871E6134B318E1EC3F4261EBC61AF257E9E2B56BE3F09341B1D262717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522604, "uuid": "6b433ec9-2db7-43a4-ac33-77ea1c4604d1", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522604, "uuid": "37e04e84-3fbc-4839-96c9-0fab648420fe", "value": "3072:xvaadgILQPN49s/8DnCDRCjYOJZqU0n2GidpEzeYVidn6LzyUu4YPZtkjc86:x1HLQV49s2YZMpBiidGMZtkjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522604, "uuid": "fbf4c5ff-9c45-40a2-adf8-8298ab9af197", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522604, "uuid": "d3640cca-3049-48b7-bded-339679b8e8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522604, "uuid": "12de96c1-3780-4d9e-ae22-353809b1fe85", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8c2e97-d267-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680557659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557659, "uuid": "419a1f5c-5da6-4207-b06b-6d0e88d3a17f", "comment": "Malware payload", "value": "1387ace7a3531c3eac21aa936b7559d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557659, "uuid": "32c82cc5-c569-4980-b088-d9f383e7e39e", "comment": "Malware payload", "value": "691913ed859d51ff1d4283be16f3d2549d5aff7b7907a6707cac942c4f0e68fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557659, "uuid": "c27f37fe-544b-4b10-a59e-3894d2d5ec84", "comment": "Malware payload", "value": "cf157dbbe4d934137f844d1662b10b34a1ea2b78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557659, "uuid": "034fbc2f-15fe-441b-b16d-a72a06ccf21a", "comment": "Malware payload", "value": "83fdb4d4fbb8f8289272ca4def5e2f89d81b5e80ee5b15fc028ef6eb11c639840e19dc088749ec319383055d68f31bde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557659, "uuid": "ee1fd774-3aef-47a3-ae1e-4dc76cabbd58", "value": "T10DB423824CDED092CE2E07FD82D1912E67555F59DE62F6FB41A829913D73A0E81CE270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557659, "uuid": "420db86c-8b4d-48c8-81cf-6b3485903318", "value": "12288:Ere64jor+JlC6l8w28bQpP9zPQ5roiHn/uLIdlL1myy1GBL:EXaXC6l8wUgloIn/8yy1EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680557659, "uuid": "668f8f56-19ea-4455-9120-067b9760fbeb", "value": 524878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680557659, "uuid": "9aa84116-c49c-43d4-ad5c-94b284dfd4d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557659, "uuid": "80fdb97d-f06c-43a1-91cc-ee4c73db80a0", "value": "SecuriteInfo.com.Trojan.GenericKD.66221456.13556.6143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03782ccf-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525327, "uuid": "67aaba05-7baf-4706-aefe-880788c8b880", "comment": "Malware payload (Rhadamanthys)", "value": "ade7665c11d30e51fd2b7e76268f34b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525327, "uuid": "72ac1f96-52ba-4b97-bd29-b948b7ab4b75", "comment": "Malware payload (Rhadamanthys)", "value": "6990278ff9412940e5a4f1d8aa795959639b7c04ac28b0fa2450ca7e97fa567b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525327, "uuid": "81c0eee7-74c7-4870-84f1-9573cbbbfff1", "comment": "Malware payload (Rhadamanthys)", "value": "7d4e63422db986c43719dcff1a616e3f509285db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525327, "uuid": "a99380e1-2f8c-4570-9e2c-b45f2c8b5a79", "comment": "Malware payload (Rhadamanthys)", "value": "9dd1198ce17e93f7cf0b3e31f0ddb8901f61cd35f31cab41f60289d4383d9423701846efed21a9001fa74cd0d95b468c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525327, "uuid": "ca5bd87f-4d74-4312-9036-7b12f56187a3", "value": "T173649E0356E87870E63E57328F1EC2F4261EBC629E1A7B9B3679BE3F0970161D562305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525327, "uuid": "996421eb-2ce7-4af1-ba6b-0362b0bc6cae", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525327, "uuid": "6a697625-2ff0-4bf1-868e-beb7b880c256", "value": "6144:6FnWWLw9/7Yuz09nTyb5Xuz8HVbHQs6IQ:sHLo/7G9Ob5a8H5QCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525327, "uuid": "355690b4-9d3d-4401-99ad-f32d9e46e814", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525327, "uuid": "74c3a056-983d-43c5-ac8b-4668e35224e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525327, "uuid": "fce96a96-8e91-4479-99e3-443c6a48ff00", "value": "ade7665c11d30e51fd2b7e76268f34b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe04eae-d222-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680528220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528220, "uuid": "3d00b5d0-792d-4bb0-bc19-ad0cfc856934", "comment": "Malware payload (AgentTesla)", "value": "64bfaaa564258f1bf8b383111a3ff91f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528220, "uuid": "b8b751ba-6289-483e-924d-63b020154cba", "comment": "Malware payload (AgentTesla)", "value": "69be1fcdcbda03eb8aaef055ad93d4994962c944075bee87eb6f0878b07f3866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528220, "uuid": "75b30f3f-6294-4bbe-9c86-8633376aa78a", "comment": "Malware payload (AgentTesla)", "value": "f189b31fd31dfef3a2fb86aa49925ee86fe0ddd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528220, "uuid": "14fda46c-9a1d-4447-8fca-1310f25a4b62", "comment": "Malware payload (AgentTesla)", "value": "6ff62133df5b2a782bd8d431b0e74e26a6377b1eb22c8884a0480ad1fd87a43887eba8cf1baaf19404c78f961b2aad76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528220, "uuid": "f0e20aec-5c13-4dd4-9e34-bf2d911295d0", "value": "T138F402386BAB5639F93117FD56E422515B3E63B33B17C54D18B211CE0B63B034AD1A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528220, "uuid": "aeb7d7fe-9ac2-4382-9f42-8663e877fdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528220, "uuid": "3685c757-a91d-483e-a763-b927ea3576ee", "value": "12288:OqCmYMUnFW/NoHv3x2SqMZFoi7YUcdwLsQHgvm4AGkaoSV+QcUJ9y2KSFsjxbHDx:OqCUiHPYQoi7Y3vwgeP5dUryMIxbHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528220, "uuid": "af4cee3d-c330-45d0-90e9-4e0c54a39e57", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528220, "uuid": "82e74440-7e87-4fc4-a54e-09644c1d6c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528220, "uuid": "c0dfd3c1-cfeb-423a-b748-8ef9089b8c1e", "value": "69be1fcdcbda03eb8aaef055ad93d4994962c944075bee87eb6f0878b07f3866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964b1d2c-d269-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680558645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680558645, "uuid": "16cde18b-8b01-4538-a094-649517fa4341", "comment": "Malware payload (RedLineStealer)", "value": "b750cb33664f252aece4dfd504eaba29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680558645, "uuid": "9b5f08a1-a290-45f1-8080-971c0a6f8af2", "comment": "Malware payload (RedLineStealer)", "value": "69cb5ea4ae2956dc3a5ce92cee4c2c26a07b0a744ad2dbcea96783e420bef177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680558645, "uuid": "5be19e75-5351-4017-b9f0-550a3924b15b", "comment": "Malware payload (RedLineStealer)", "value": "ea616f0ede55e050e877453b80c0817451952df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680558645, "uuid": "9f5d7990-a372-44d2-9de1-ea3c2b3a9265", "comment": "Malware payload (RedLineStealer)", "value": "b73d808d00556d2e211d8401b36d6f2f146aa77f8f937973942b1cc866f344180448396d841de69a356be45c9e0163d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680558645, "uuid": "e09ecac6-ece9-49c8-8d5b-1a8c4a5f281d", "value": "T1A4463341BAD86971FB9A0F714A389334D86575300A62CB5F97C48A3ADEBC0C0A735F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680558645, "uuid": "1dfcbada-0789-4f50-88e9-a68418c7d668", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680558645, "uuid": "d8e8f06a-9e8e-4f8c-b5b3-6ab960bab439", "value": "98304:Jb+xd/Qn2WP2nnLEUpUlaSRDQq9C4o1srHbAySCBWygyvz1QTWwz1+KXq0Q1h1:Jcqn1PQEUYaSR0Gpo+jdVII1Q6wBnQ1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680558645, "uuid": "71d5abbc-ff84-4588-a856-86f296d87581", "value": 5396230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680558645, "uuid": "b451d395-c366-40b7-9b13-f31c4cf2dc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680558645, "uuid": "b3fc2efc-98e8-4ee7-acf2-a245bf82a2fb", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d171ba4-d1e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680499815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499815, "uuid": "c253adc9-6b5c-40b5-ab53-c085cb05f4e7", "comment": "Malware payload (Loki)", "value": "1c77d9b43c4770cf84c41a5c4a53f098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499815, "uuid": "b2fccdbe-22aa-494c-8c88-26718b05dcee", "comment": "Malware payload (Loki)", "value": "69efd675ee6737f614a8ea14f4b125b25c9b3d80ab901d2dd0024837e0e5ac29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499815, "uuid": "d3e8e3ab-be0e-489b-b4cf-081701d8f13c", "comment": "Malware payload (Loki)", "value": "4b4eaeb0eb6990e5af8d2ebdfdba6cf1ade07304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499815, "uuid": "dff60a5f-1790-449e-b2f9-dceb82783840", "comment": "Malware payload (Loki)", "value": "57c8ee21f6602b756a53b113fef1eb09a6e7bc316a2de78f06bab95f2fafc3492ea8418a1c45fb7acff337eb6e668ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499815, "uuid": "3a03edbc-4738-44de-909d-d3f48fecc4fc", "value": "T11BC4128D3A5C5A2BC71E46FFA072910943B99935E916C3DA0CC57CBE1AF3B984406EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499815, "uuid": "5da5aaf6-5eaf-41bd-8d47-7d4934bfb0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499815, "uuid": "62f20142-c16a-4169-851c-e971c23de22c", "value": "12288:u3tzLwrgXK87/s33htGMZr3zso/xf4l+rvslA:VUXK8DsHhtGE3zn/xNvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680499815, "uuid": "aa3e41d7-759a-4286-bbad-88a5cfe1c0b4", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680499815, "uuid": "887ecd5d-6d6a-43b2-96c2-b8474ca666a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499815, "uuid": "61e18681-0805-44ac-99e6-d709875d8c56", "value": "Mintech-PI-31032023PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a11b7b-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680512307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512307, "uuid": "0b7ef722-b38e-46da-a65c-4741d59b7afa", "comment": "Malware payload", "value": "6d3902cbac7caa83f2fb1b27c320983e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512307, "uuid": "469fea0d-2fad-4cf8-95a7-fda784942b07", "comment": "Malware payload", "value": "6a12ff043aebb7db997838de6791aa257eb40b357502143ed13b4dd9796f9e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512307, "uuid": "5abdf79e-0299-4c7e-a159-ed53dc90c7f3", "comment": "Malware payload", "value": "8aa95774aea3f0f17b845db688b2891b0eb1af78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512307, "uuid": "632808e7-ec75-4f9c-a3ae-256b7ae377fb", "comment": "Malware payload", "value": "f43ef40eff1db1fb868745cda6966145c47ec3efa450796803c33de51ccf408b287fe8e41350ce5fdd8ca548c50341cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512307, "uuid": "c66fecff-25b5-43d4-b89e-6465250b522f", "value": "T1DD563384621048FCE8A6913EC993C415EAF134258795D5CB87B8E6B21F33BE06F3AF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512307, "uuid": "06c5225f-2ea3-4e64-afbe-fd4d48233c83", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512307, "uuid": "b61cf941-db42-404b-b0df-d48039842e01", "value": "98304:pln68wcqmbxaQBNBU5ytgMwzu+Zkh/tLiclDXc3/Zpjx0bU0XxQHbLY3E:p40xbAQveItwq+ZkiKDIjx0vXxQ7L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512307, "uuid": "23923ad4-ba10-43ce-8c41-99cdb2a6d7fd", "value": 6032108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512307, "uuid": "96f74262-4641-4ec2-9362-8c12b2914299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512307, "uuid": "5d784c59-b7f0-4169-9724-c6d1c7023d2a", "value": "6d3902cbac7caa83f2fb1b27c320983e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c1cc9e-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496127, "uuid": "204706ac-4722-4f2f-beb8-9b945ba6692d", "comment": "Malware payload", "value": "55657e3d9b9e463f90c8a3cac929a6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496127, "uuid": "c75860c1-a4a1-4a5a-b6ec-b4f286a75b8c", "comment": "Malware payload", "value": "6ac9091b658a4918bbe6184293148ead2a1a3d3260598bf12bc7232919dcfb9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496127, "uuid": "78188f29-3710-4736-b9e7-81bc9d0ab857", "comment": "Malware payload", "value": "4297acab0088e47b18b09c4f41391611b1c63e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496127, "uuid": "9ce465f9-f5cb-46a8-8334-09a5d6c89f5f", "comment": "Malware payload", "value": "2a79b190bd8545ac288fa97922d89274f9dfc668a61d255f8319fdd0229fe9591ca5cabbf1c72811f8a1c39de7e6907e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496127, "uuid": "70a1aebb-f6ed-448d-a35c-ac98d03c859f", "value": "T11E457C46B1B317FDC1813D322CBAA2369D6C80454BA4B6D77047DDACD7E31A32A36636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496127, "uuid": "2984a783-ca4a-4cea-9f49-9b6d280870b6", "value": "12288:e9lG5Mr9wKEtasEgR0k2DhwUIPZwgIPZw:eIUwRtpEgRGDdIPZwgIPZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496127, "uuid": "49e0f474-d40b-49bc-969e-cb6d415f4e06", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496127, "uuid": "8bdce31b-62b6-4596-862f-3343d7620393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496127, "uuid": "363ed952-6c77-4460-8838-34021c9a011f", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.9648.20680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a827091c-d1eb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680504558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504558, "uuid": "fcf0872b-2da4-4f40-aa36-0fc213d9f2c4", "comment": "Malware payload", "value": "29b2265629d3e134d9d7459c10e067e0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504558, "uuid": "1f83b96f-9a21-4f59-8c0e-19be7ebfd38a", "comment": "Malware payload", "value": "6c091d9d222107124047972d3de6eb918dcf3c750063b7a69b0f85571927d876", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504558, "uuid": "b58c962e-b69a-48fd-9cb3-41c61b452bf2", "comment": "Malware payload", "value": "8e8a4481e9f9fe53e5bc578d60d755bb8d0b70e7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680504558, "uuid": "e62f9c67-7629-418c-93dd-a903304122a5", "comment": "Malware payload", "value": "b390ffa650c2127e81894868bd3a78b46b16a6d2e45df4686c48e194e7b76bfa13277e93f8b5cd0aeaff355d4f9c7b38", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504558, "uuid": "72296b31-4ef0-4d6e-9c89-453eb4ef26b4", "value": "T136429E7ED6004826C732C87CC58C06D1E69AA2B2DE7185AF75A1F7DC264A6DB238F15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504558, "uuid": "70af4fac-1d3a-4962-b5f8-1e428fa92063", "value": "192:KLRgwVmFb3U7FZ5ZRqbvBDQLfREaO0kzYrqNJSxLHDxsvVXKKwEvnPJCo:KxQV3sFZ3RSa5oJSZNsvhPwEAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680504558, "uuid": "553297ca-b0a8-4202-a47b-cf9130f408bd", "value": 12988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680504558, "uuid": "06c20b45-b300-4b06-972f-4d0daef34c1a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680504558, "uuid": "f335a415-41cb-412f-872d-4a37374a75d2", "value": "Adressliste Semis 2023.02.04.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29f3da4-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680522212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522212, "uuid": "c3e23523-652c-4f1c-8310-9e076304a266", "comment": "Malware payload (Stop)", "value": "9bea7dcc6dce7063d4a7d7fbdc531fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522212, "uuid": "04ff44ec-7ddc-4900-b387-d58397e7b46e", "comment": "Malware payload (Stop)", "value": "6c8f66b5a6ee419614e8094b3b6d5435c2049cdc07c987ea84191b3f903ece79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522212, "uuid": "167464ab-cf81-49f0-ab51-c71d0a9c372d", "comment": "Malware payload (Stop)", "value": "65fb1fe567fc20f04844c80510ab14729f975919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522212, "uuid": "3fe9ddd2-e103-4216-b4a6-f3030a2a4518", "comment": "Malware payload (Stop)", "value": "41f8fd50f3ea1732f64f02f9261ace0ae18b40272ecea50cf8b2997ddc24b749dad78fcda01cb17c240840b521bd01de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522212, "uuid": "7d75b12d-44e0-41e2-9852-0f6d938ee951", "value": "T1D8E4122076D2C4BAEB13A4717029C6A4573AF8F59BAACDC73744077E4F611C0A97E3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522212, "uuid": "9e233880-bd16-408b-86d1-8bd9a83f566e", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522212, "uuid": "904b7bf1-c290-402b-bf35-c07e5cbb09cb", "value": "12288:MiFWAMaWPYJwU9pHmWIeYHrdttZtjaikYeMndkhQyix8EuBj7q8GCJD4cyc+AWvg:MMsPYq6IR5B0P74dkhSncv5GC5Ac/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522212, "uuid": "2eb17d18-8b7b-4a7d-b3c9-dca1852fa859", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522212, "uuid": "637035b7-e4c2-4c81-92a9-bc77044da101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522212, "uuid": "224bd474-489f-4b4e-9915-3d75e2ebbd43", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a59fef6-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680525822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525822, "uuid": "3a53c8f2-d226-4710-a463-3ef4baddf2e1", "comment": "Malware payload (Socelars)", "value": "a3647dbbef07ca7b40b24c407a2cd159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525822, "uuid": "2dcac332-ebc8-47b3-a506-4f398072f00a", "comment": "Malware payload (Socelars)", "value": "6da5779d2324327b3fbb4e0773a1470d99afbd1138cdd5dc34fa92456e243823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525822, "uuid": "d88e099e-ebd4-4b1d-8f60-2b5ff4f87e3d", "comment": "Malware payload (Socelars)", "value": "c361cc386cb33df008adebad32f1e60d079d8f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525822, "uuid": "2498954c-7215-495d-b179-7e2c5bf41122", "comment": "Malware payload (Socelars)", "value": "20d3d74a470a466aadf4acb1e9125c317876456649b4dc3beb7b140e1c77a1696331a86d164d1cdf1752584bd2b5be99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525822, "uuid": "4ea928d6-3618-4016-8714-69d89378dd8e", "value": "T16C658D21F7C26032E8E310B745FF5ABE9D3C6A114708A4D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525822, "uuid": "48aa15b3-1271-4fd0-be83-29761e19444b", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525822, "uuid": "d5676c1f-1cfb-4c25-b629-63dbae36d021", "value": "24576:mGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRjE5hwSQ:1pEUIvU0N9jkpjweXt77A5iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525822, "uuid": "20afcfb9-80be-4bef-8665-04c4739f04ec", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525822, "uuid": "c22f690f-f902-4b1a-9d13-f225a57fadc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525822, "uuid": "6caf7ea1-8e78-41fc-b147-746525ee8c26", "value": "a3647dbbef07ca7b40b24c407a2cd159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd0f5e1-d20a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680517855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517855, "uuid": "37a97a68-681b-4978-8004-4f438bce7f78", "comment": "Malware payload (AsyncRAT)", "value": "21bd14d1ae50cd458f5dea6fd6c939a1", "object_relation": "md5", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517855, "uuid": "f3c1b5e4-d01e-441b-bd5c-442933e7efc4", "comment": "Malware payload (AsyncRAT)", "value": "6dedc7da4dacf1e6bec9ca8b120343dfea5a46df41ca454f37284b163211ff78", "object_relation": "sha256", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517855, "uuid": "b8cb4701-8a6f-4a00-91d8-e7856bf206e4", "comment": "Malware payload (AsyncRAT)", "value": "0c910ac92897ecfd3194362b01d2b7f4ca696b54", "object_relation": "sha1", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680517855, "uuid": "ac5d4fef-fc2a-4137-8471-54f0106156b1", "comment": "Malware payload (AsyncRAT)", "value": "372580b940e55bfc26bdd87fd1b4d1aa9633eb3280f0b8e4d8f814ef27db0d176d7639d544cf84fa5ea69fe0813446e4", "object_relation": "sha3-384", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517855, "uuid": "d50a9534-4ada-4156-8895-a345c96b0dea", "value": "T1C6E0724C04A7CCA788D630D3E0B691F28A0FF048A80C0670A688CC8C0852BB41A8E38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517855, "uuid": "8bef3906-2b66-4858-ae70-92b40d27920e", "value": "6:Ze/xxfoZAuaHfOKQLh8clznZ8v+gtLPdNd06Bnm9xIzQows+hPRLVWP:k/8+5iG+G9L1f06BnaO7+hPRAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680517855, "uuid": "53129e73-88fb-4de6-a70b-e854fc9260b8", "value": 308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680517855, "uuid": "810c5ee7-1396-491b-9362-14a1cc85dc57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680517855, "uuid": "755bf322-af2c-4c83-a580-bb8b582ac965", "value": "Screenshot.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bef802c-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680501531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501531, "uuid": "2e2211ec-fb35-443a-ad80-b73c194532c2", "comment": "Malware payload (SnakeKeylogger)", "value": "5c570a200a84f71006a992714a2d0a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501531, "uuid": "45cca3af-f8d7-4721-aa7d-2f18c3bb323b", "comment": "Malware payload (SnakeKeylogger)", "value": "6e034d943ad1d3f87fe22c3ba4fe32d83415f7ed67bd4c63835318ee0e4f843e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501531, "uuid": "7b6031af-f520-4e32-bbb0-09ecd0c66d64", "comment": "Malware payload (SnakeKeylogger)", "value": "b731a637fb9fc5004fa0e00fe892f2619f6320f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501531, "uuid": "f551fb84-7972-410f-810e-daf68f867e6c", "comment": "Malware payload (SnakeKeylogger)", "value": "ac254056b3e37016b814a09d87219d611197dc544e1e8e8ed0029cf6a7c62ab2061b11a906a62230b9fd53d69cdc0f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501531, "uuid": "05741a0a-01c1-4b11-8f27-cd23d26e9cad", "value": "T155541284A694D093F9B70E7619F25937AEFBE8007498834B17119E987F23981ED1CF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501531, "uuid": "0b51ee21-f129-4b91-add0-1163a907cd0c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501531, "uuid": "b680714c-44aa-43f8-a63e-2510211a346f", "value": "6144:PYa6r1+4Xhy2FKTSpP5VKCOZyAasOrpTsgMHIXE7cCHk:PYxE4XtETSB5VIyaOVAHIX6cCHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501531, "uuid": "5eb0ecd8-214d-4779-9caf-721116b32648", "value": 288878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501531, "uuid": "69ec3f89-00a6-44f6-885b-6870a5cb81d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501531, "uuid": "24ac7e12-68b4-4f40-bf7d-049d30488fd7", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dde2f6-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680503105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503105, "uuid": "d3f679d2-bf05-44d4-9972-8e9dbd641090", "comment": "Malware payload (Mirai)", "value": "39e47e99dca6c7dbf81673c533ed559b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503105, "uuid": "70caa514-457a-4760-a352-0f3fdf51d9bd", "comment": "Malware payload (Mirai)", "value": "6e31f65649f526802c50a7fd0b51a30a6e913e7bdeb7b0e6cf56859f9a309c8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503105, "uuid": "7333d3ce-981b-423b-b303-251969967c6b", "comment": "Malware payload (Mirai)", "value": "57eca7bef9d171558f8128d298c0040eb8b8439e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503105, "uuid": "9b89ee8c-a4f2-4bf8-88dd-54c8c65ae625", "comment": "Malware payload (Mirai)", "value": "09abcb09c95beba8421b865c58933dd15b8c49fd261d621a69e9eeadb59c92bbd96398d227cfc3566ca4dbfe61180c37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503105, "uuid": "21648988-1857-407f-b091-80db40c4526d", "value": "T1E2F2E17EEAB8BEDEC6DD4D3F648D12B2BE05B0C452EE4E814B154CC8265A511F0C61E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503105, "uuid": "bc9982a2-2424-4a88-b3c1-0b2c7546ced6", "value": "768:XKFW687K9UWut0GRdOFPg6TJPerB/XUlY8CLGaiYDrp1/FJstGTtWJ:aoru9UWvodOFP5JP45XeaiGtJsgT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503105, "uuid": "516b3a9c-41e3-4ba7-bb9c-d9742b2c5717", "value": 34576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503105, "uuid": "284b0969-c395-40ad-ad75-58dbedde34d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503105, "uuid": "2e0d7d9a-b5f8-498a-b893-21d23bfa1d10", "value": "39e47e99dca6c7dbf81673c533ed559b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171d8c3e-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680526649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526649, "uuid": "68a41dfa-7e18-468b-9ead-fb264114ac12", "comment": "Malware payload (RemcosRAT)", "value": "3d87e610c1e0855bac84e1a66632afd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526649, "uuid": "da369ebb-cdcc-4a8a-8359-3a1c29c2bc8a", "comment": "Malware payload (RemcosRAT)", "value": "6f156a6c661f4b68eb1be00e5a1be53fb80f05af516ef4dcdd7d3e937a1db580", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526649, "uuid": "312add73-7022-42af-8817-15b5a9f58614", "comment": "Malware payload (RemcosRAT)", "value": "998433cdb154c12a50aac7fd3f174bb2da931496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526649, "uuid": "52c9c361-38a9-4549-9bb3-37c923897090", "comment": "Malware payload (RemcosRAT)", "value": "252ceb065c4992feaa91f0b2c7ff653b470512ef6ebe0249ec32dcd483e2e64c8d38149993507ce17ea7aa38d829668e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526649, "uuid": "f5cd11ab-fe57-4422-b23c-571843576126", "value": "T11C2512256BAB4229F03257BE94B435D5476AA3F35703C98E04F221CD9B63703A9D1B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526649, "uuid": "4fc6c48a-f27d-4897-b28f-35243319884f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526649, "uuid": "55b1ae98-5904-46f0-99dd-907b383e36f1", "value": "24576:fkkU1nC/RckNg7iDLB/a18rYgaJvw4HTGFmF:fk3C/RckuODL1EgaZwCTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526649, "uuid": "49906071-1179-4b41-896b-08e4481b525e", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526649, "uuid": "9e55de65-b9f2-488f-8229-2ffbd8e51209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526649, "uuid": "87778ea6-1c4a-473e-9409-10d312c65219", "value": "6f156a6c661f4b68eb1be00e5a1be53fb80f05af516ef4dcdd7d3e937a1db580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2411858-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526560, "uuid": "a302972b-bab8-4d35-8c1f-9b430ad3ba65", "comment": "Malware payload (Gafgyt)", "value": "d91e5810a8e680cccf8aa62f16f92109", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526560, "uuid": "530fffc3-3af4-4fa1-ad9a-31626bb662ea", "comment": "Malware payload (Gafgyt)", "value": "70151c030adecea9a03b3ad1147b2f0a8e2995a5a7b4a8ba8e28ff8480a85324", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526560, "uuid": "1d5e1b9b-bf98-4db7-8691-5c67d0474777", "comment": "Malware payload (Gafgyt)", "value": "f9714dc317aab63a86bbc5a7433bcbe7f757a4c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526560, "uuid": "1b1d23f9-be98-48d6-bd7c-8b12fc6ee7d2", "comment": "Malware payload (Gafgyt)", "value": "8ac9579e3fe14258b701079740e80068c17a41d3e5b802628a0163f0d125bc40535f0528ef786d8105576ea65e9df0ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526560, "uuid": "69d29862-1927-4a61-9f47-90a6eb0839b6", "value": "T18DC30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526560, "uuid": "1fa3b24e-be25-4844-b99b-69b59f2a8721", "value": "3072:hQrFRNfuLrGhEPOD0zg3gNlmBoHQuQekQnYW:IFzuaEGQzg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526560, "uuid": "e46978b6-f6ee-4730-bab0-30763f521dc9", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526560, "uuid": "6211bcc6-c3f0-4d93-bde7-3f217f07f4dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526560, "uuid": "a9a7e233-ba09-4b81-9b6b-7f2007eb54da", "value": "d91e5810a8e680cccf8aa62f16f92109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbd1f06-d26d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680560214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560214, "uuid": "4e365f75-eada-4f1c-aa49-3a96ee7b621b", "comment": "Malware payload", "value": "2bc43809a78b0a3cba5178a7945184bb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560214, "uuid": "ddf141c1-853a-4c57-83cc-f1a3cab48d40", "comment": "Malware payload", "value": "70ec0f477777580c4ae2c92d05cab059ca0b86660cf5fe9d96c8ea6f6a743557", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560214, "uuid": "15283da4-1389-4268-9afa-f0c63e27d30e", "comment": "Malware payload", "value": "ef3ac70ba45413a54f1f113cdc0f0a12c8d107f5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560214, "uuid": "ae088ba7-04df-4bcf-b3db-f857ce145dd3", "comment": "Malware payload", "value": "4bcc824d127dd5141f615f136e4cd0d6656a80e015dd023b6b0c4db0b5534ebdb91392e3ceb44448a08445dde9ed6662", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560214, "uuid": "e099214f-c476-46b5-a59f-525a0bd88085", "value": "T192747E8235ED180C72F169438F57FB5E0737A6FE94B86E29A8CC894DAFDE66044127D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560214, "uuid": "d82fcf77-83fc-428a-8e93-57aed277d7ea", "value": "1536:j89r/aDcWJwG0mtvR/Eg5y6Fl6ktr+MMmBaMszsbe:KtNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680560214, "uuid": "cc24f723-3428-428b-85eb-4ee6090d9772", "value": 355212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680560214, "uuid": "102ba8c9-0924-4836-a2b5-09ee104b8523", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560214, "uuid": "6bc2451c-9288-41c3-89ad-d8c503838751", "value": "NT0078-500093.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56021677-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680533626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533626, "uuid": "755ed7b1-694c-434c-abed-4b66e277afa8", "comment": "Malware payload (Mirai)", "value": "5f510bb1a00b528f4f77e131a1fbe77e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533626, "uuid": "be84be33-ded3-4928-9f3d-136ca2a48b01", "comment": "Malware payload (Mirai)", "value": "713134e20ca739f8694d662ca26ae85a0acc90bd6dd290917bd2606cbb1d81d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533626, "uuid": "0a56a372-105c-4c31-b41d-163d25501998", "comment": "Malware payload (Mirai)", "value": "020645314f011f02e96ed0782eef97e7ac5ccfe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533626, "uuid": "8f262ce6-0c8c-4098-b02c-8113a615a336", "comment": "Malware payload (Mirai)", "value": "7aa85f510e9d4e3b075184fc3acb87433c61dda302065c6c4cf33ec121342d1c6b4eb4ab50e8974cb504ba6073b2aab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533626, "uuid": "07842ef6-6dea-425e-beb1-31dc6fd112b0", "value": "T1E3B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533626, "uuid": "88147417-873a-4196-8345-949704f1f4f0", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1W/LWy:c9sSyzz36YaWWgg1Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533626, "uuid": "7d327c35-45cd-457b-bf1a-45aa3574ab63", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533626, "uuid": "d38c54ab-8011-4f64-aab8-a4e173f05007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533626, "uuid": "94468e5f-6557-4604-8dc4-cfd593921558", "value": "5f510bb1a00b528f4f77e131a1fbe77e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0740171e-d26d-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680560123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560123, "uuid": "abd8b7c8-b64c-48f4-9e47-9a8cf3e93d11", "comment": "Malware payload (njrat)", "value": "025bd33a6ced68b65c773adcb74e9b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560123, "uuid": "48af9cbc-4342-42af-9d8d-82d5bf49347c", "comment": "Malware payload (njrat)", "value": "724ad06a9914ce390285c690973f4160db8438280e03e343918a3bc6dcaaa035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560123, "uuid": "e68be1b4-bc93-4daf-86d8-9980ae67020d", "comment": "Malware payload (njrat)", "value": "f7e25d55ea4a7bceb8959398dba176fdda7b5f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680560123, "uuid": "5ed137b7-5701-4d46-b6cf-323abe42987e", "comment": "Malware payload (njrat)", "value": "2f0b95867764bbc71e55bf1068842ad0fe014c9783eb072d32295cda3f6dedc620cef091c69b708108c0c3e177d9d645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560123, "uuid": "78c0fc5b-e4ce-4bc7-ab71-c41fdd94a328", "value": "T178A3383429EA502AF073EFB95FD479E6DA2FF7333B06645A1051038A4B23E81DD9153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560123, "uuid": "5413dc45-ffdf-4b7d-816a-c0e751c84baf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560123, "uuid": "1ed2aade-5ff9-45a5-80d4-adbdadc81730", "value": "1536:Ju9h8pR8yqX3amW2iwRCsfRneBaROZsvn/ga6BYLP1YTBeUIRc5IP1foubKb0i:Juj8fTM0kxeBCqYz1iBeUIm5I1fGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680560123, "uuid": "87dc27fe-6775-4adf-bca9-2d86594d3136", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680560123, "uuid": "2db98618-fc34-4256-9ae4-d9d85712cc33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680560123, "uuid": "654d0049-18a4-40cc-a491-921db16f3bab", "value": "025bd33a6ced68b65c773adcb74e9b4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d7e6e6-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525576, "uuid": "7c8378fc-4033-41c5-a452-7eed7792f59e", "comment": "Malware payload (Mirai)", "value": "bb6b8b6bb4841dd7bf34525a976b8b51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525576, "uuid": "90e55c53-6db0-49b0-88fd-2f597dac2305", "comment": "Malware payload (Mirai)", "value": "728813446c491303f81996b03dd90bfc2742a890c6ac657c7877b8dd38659c73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525576, "uuid": "061ed90d-d7a9-4351-82b6-ba795db0eda8", "comment": "Malware payload (Mirai)", "value": "2d7360fa0b43faf7d7d1b681a4c271d2b7324aeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525576, "uuid": "30aa79ca-c699-4c33-a17c-addca6812422", "comment": "Malware payload (Mirai)", "value": "e8cba54a58fdace074d9aa00da47236e0b4363853cbdcbddcb03e752e88fee74f21bb5f69eefe2cdd80b0955728f8e81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525576, "uuid": "a7f8bb66-87c2-4361-85d7-af206d96f9e6", "value": "T1F9C2D0E07726FE31C520AC3DE52A4D8A3A51063C91FF353764258D398EC265A67F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525576, "uuid": "5bffe093-9464-4f9f-a8e6-e796535bdf97", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwrI9q3UELuO:oKy4qfqoeJdXWgxLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525576, "uuid": "f60ea3ca-bc1a-4057-8322-969bdf9effb1", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525576, "uuid": "799bfc45-25d0-4629-b517-246f4bb8406f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525576, "uuid": "2a30baf6-afd5-4e56-a1f0-836c335e8b46", "value": "bb6b8b6bb4841dd7bf34525a976b8b51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1d5af3-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680524993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524993, "uuid": "1e5528cb-c9c3-4abd-a6ed-72dc8b5b6be6", "comment": "Malware payload (AgentTesla)", "value": "849e4575b962f3ba05ec2a74e1f1bfd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524993, "uuid": "a44b0e04-0a78-494d-9129-1044834e3a06", "comment": "Malware payload (AgentTesla)", "value": "73dd519acd12d0f745ae97a43ace2880516ef4f2682f8f5970be98418fb3cbe2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524993, "uuid": "283464b7-a57d-43f6-9b13-2bc6e76530e8", "comment": "Malware payload (AgentTesla)", "value": "622379e35ecdcac678bf01912a5165f7394adce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524993, "uuid": "0d95860e-8e1a-41f9-8fe5-6e92d35378ff", "comment": "Malware payload (AgentTesla)", "value": "cde94b4a74963507fc20896caaaceb497984955300d05e30c9c89db322abb62a85f238e6027f967ce688dbb6d5994129", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524993, "uuid": "5df098df-3075-48df-97cb-feb7fe071669", "value": "T19D24121E3A957C09CB59AF30844648445F31E295B982C6D37E8EC6D14F8E3CA3B517EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524993, "uuid": "60df5d42-b0c3-4556-854f-d81005e70504", "value": "6144:rvFSnrnkU2HYBkiXgznK86Fg0cr14K7nDhETsn4:mrnkr0khJ6FkrCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524993, "uuid": "c348dc0e-659f-4245-9d05-3c98faa550f7", "value": 215624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524993, "uuid": "e9a4289b-659e-4b56-ab1d-2f9611395ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524993, "uuid": "49fe7594-51a2-4aad-9657-4c5e7febfe53", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1538786d-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496151, "uuid": "3fe94017-6680-482f-8220-8daaf6b94bb0", "comment": "Malware payload", "value": "1eadce34e260c6e97b180c7079bd7563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496151, "uuid": "8feebd6f-b591-4589-a1c2-fd5ea70d76d1", "comment": "Malware payload", "value": "73e54c80f96ef43db0a68f97813ec05ecd472561cce39f465e61e8554e393f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496151, "uuid": "a9649fd5-66c7-4d0b-bfc4-ffee23e83c62", "comment": "Malware payload", "value": "5f02e0f7362965b3bc59075b13a66a40577cceb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496151, "uuid": "c5b5b7a1-40f1-4411-8c75-461a0ba9dc09", "comment": "Malware payload", "value": "e81819326be1d49f450486220333ebb1321033c299f09749e3c62ea58f81c3845eea4d3c96fd89c2232753dd3a0d69cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496151, "uuid": "0dc41662-d850-4ff3-b340-0a7d3d373539", "value": "T1A5C45B127A0426B1C6544D31B8ABC54836296C35D9C12E87358EF318FBF33C76ADE66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496151, "uuid": "cd356b1b-2b81-4c1a-87d6-693f6a8e157b", "value": "6144:npOrTweiQ9eKboTNvSge6KEQZpOrTweiQ9eKboTNvSge:npOrTweQ6okPZpOrTweQ6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496151, "uuid": "7e347be7-2249-4d15-923e-ced1b391cccc", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496151, "uuid": "a21a414f-7d69-4e03-8f26-18293df5a3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496151, "uuid": "bd232541-c5db-4465-b302-c9ca4baa7cd2", "value": "SecuriteInfo.com.W32.Tibs.M.gen.Eldorado.2642.27846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65745f39-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545678, "uuid": "e40eee37-240a-4f5a-b3b2-2b2c2f139f7a", "comment": "Malware payload (Mirai)", "value": "31f7db845503a9dc7ae36c9900ed67c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545678, "uuid": "ec7e0dd3-1867-46aa-a739-00b6b6426385", "comment": "Malware payload (Mirai)", "value": "7567ddaf46f016cbec371c71c9d4dd6a66ac20203ac5e8583b171161258e1b8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545678, "uuid": "6c26e925-a51d-4ab9-994f-c29bd7044cc0", "comment": "Malware payload (Mirai)", "value": "b39bf95d7fc1e1001d74feaf529106f552a21503", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545678, "uuid": "2f5f5724-37a1-4492-b110-68e0e0c4effe", "comment": "Malware payload (Mirai)", "value": "f496d61c7e73ce5f5de9ad1188f7046596c25504d3035eaf9796d3c655515b4ec20c2896bd15f24ab681f61943bad5dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545678, "uuid": "99a9a57f-8c3c-4dfd-8529-cf194a0e948c", "value": "T187633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545678, "uuid": "15bfd0aa-3c37-4fa7-8a46-79c210e28b07", "value": "1536:lGRaTYmol/hGIAs4PNvAEQoGm75123tSt5l:lya7hJfGmVDLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545678, "uuid": "21d7712d-125c-473c-b037-688746000317", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545678, "uuid": "ca97d6e7-d658-41fe-b8cd-0bbfe4cd9808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545678, "uuid": "d7400e2e-fcaf-4861-ac58-0a54fba48235", "value": "31f7db845503a9dc7ae36c9900ed67c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82ff1d2-d1f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680509417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680509417, "uuid": "fc07e0fe-fd1b-4bc1-bba8-a1e69fa1d84b", "comment": "Malware payload (Formbook)", "value": "ede5c49c13b2d0eac256cd6a194dd9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680509417, "uuid": "99f48c2e-7ed7-43a4-beba-02ac37344da8", "comment": "Malware payload (Formbook)", "value": "757ecedd9789cb6d77831f2e2c0fc312b05d9ad3e0f6d5c46e3d9c26ce325bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680509417, "uuid": "dd298b3f-4e2f-4d1e-90b7-1aed939f624a", "comment": "Malware payload (Formbook)", "value": "373932559e984cfba02735f227dc9d06da15dc6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680509417, "uuid": "45a4f160-a9f2-4042-88f9-d4fb39676df7", "comment": "Malware payload (Formbook)", "value": "e0ae34924a8afe0ded7c2b4f60c3c09d8c84e1f9e340159e135fe51250dc9c94c5eb8967ea485b549318e7f261664f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680509417, "uuid": "ecec97ed-97db-4576-821b-5f5b691433c5", "value": "T1D4A423E622280D33D8B210B3695239295BE7DA310015B09F9F927E1FB5B33D1A55B3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680509417, "uuid": "a1077da2-31e2-4bb0-96b8-32ad9cca3ccf", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680509417, "uuid": "f8415dd8-2d87-41f7-939f-196523607dc7", "value": "12288:g4rwzs9GEGRga0ci3iplvgps30O7Gq8PXaTbvjf7+:7wo9GxphipIV7NUXwbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680509417, "uuid": "7e8220b8-8301-4ed7-b0ab-5a5a3d37f412", "value": 456336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680509417, "uuid": "1adb8b29-b0d4-4759-b813-e13c067a5886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680509417, "uuid": "14ccb35b-a916-484d-8c96-34248fabade4", "value": "Invoice no. IN23000614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0a664f-d1c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680487786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487786, "uuid": "aa78d09a-f3e3-403f-9297-0d9c903dea02", "comment": "Malware payload (zgRAT)", "value": "868398533736a48ccf3008a8eb4ddc49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487786, "uuid": "400f43c2-9372-4acc-b32e-10b102f5623f", "comment": "Malware payload (zgRAT)", "value": "75f725acd4a91140b6b212981973f125d13d55cb2966f93a7b744b3eaf528d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487786, "uuid": "bfe0ddaf-614e-4034-b4cf-ac195b49c315", "comment": "Malware payload (zgRAT)", "value": "50d33a0e5b6f5b539288f40b2cab13748d2ef709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487786, "uuid": "1dc71328-e8dc-4cfd-8bf1-191bee337555", "comment": "Malware payload (zgRAT)", "value": "9b1a1f8ead0de202de6a17c5e7800f6bde57787deeedf7e757922ea0e67fd6b744c8d4f0e7be7c6a942cd00048feb1cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487786, "uuid": "a153cd75-ff21-453c-842d-db12c5b35a7c", "value": "T1BA356A0B72B2AD67D71D473DC1D9C91443B89C04AE92E72BB8D41FE3788339B9D0A592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487786, "uuid": "a7caca46-7478-4f56-90cb-9a3944373559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487786, "uuid": "12a5b139-850f-4ef4-9469-7c682777aedb", "value": "12288:mGqyH3zPrnj/bXT8eh27JGKz5CeUaQHGox3cY+ccXSOon8IPB9NveJPbB70rgQxk:GGKebkXSOyjB9pebmrbw46X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680487786, "uuid": "4c0ac8ed-ba57-455c-b22d-413c8534dd39", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680487786, "uuid": "b17d6b24-f1c4-4894-9f52-8c84ecbea335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487786, "uuid": "d49857b3-7a02-46fb-9d4b-eb4c19ec89f4", "value": "868398533736a48ccf3008a8eb4ddc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbddcf51-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1680525744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525744, "uuid": "c696f3e4-275a-4565-973b-0a0d926145a5", "comment": "Malware payload (Nitol)", "value": "bab175dc5e6f60ed88d28a16e872b5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525744, "uuid": "eb0dc58e-4358-44a4-8988-265498089b1b", "comment": "Malware payload (Nitol)", "value": "764d264bd20b81e4a61fdb22308ef4a834dbe10c3c0e4412ea0c8d60f3ecc7f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525744, "uuid": "85f59db4-714d-4d92-9725-ef42c68f44ec", "comment": "Malware payload (Nitol)", "value": "69dd68a96c9f6689d34d14edff9821ebdb8c054f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525744, "uuid": "2bcf3173-a2a8-48d8-984f-40e8c752db62", "comment": "Malware payload (Nitol)", "value": "865947f007637f181a859e31b48499b352675863857a52a6f7b6130de439f8b5e9958c0c0352c1de45c6cbba459bc5b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525744, "uuid": "38d7e5bf-af54-4841-84a3-c81e781f9ae1", "value": "T12D4523921FA45462D792BA70DE96EB0A7C3CB48011508957E3AAC63FCC6EFD63064737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525744, "uuid": "745176f8-ff3e-43fd-ad81-629e7294cf54", "value": "2298d52a04c68d24a4da1ec2067eb4d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525744, "uuid": "5a6b9dcc-7e0a-448b-a563-e307b138d0dc", "value": "12288:I7e2YFXqFzkKMRV1X35r3YOcpritdTy8VFQ25mQrQHPBlO7Fo:znVqrGV1X3VPe+TQ2jrWJc7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525744, "uuid": "8ed9d584-9ac6-4eb4-8880-f8e13ecc5198", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525744, "uuid": "df7d118f-65da-45a3-8fd5-0199b1d9a585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525744, "uuid": "e1b3438d-e9b4-4f26-9236-9a5f7b42dfbe", "value": "bab175dc5e6f60ed88d28a16e872b5c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516abd0d-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525458, "uuid": "e6b4604a-ea10-4c71-9ac5-007e6aed6454", "comment": "Malware payload (Rhadamanthys)", "value": "994b7845b6dfba0b9d10e51a09c8ac4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525458, "uuid": "355f951e-6815-4797-a92d-534bf8dbc7d8", "comment": "Malware payload (Rhadamanthys)", "value": "765b882161573c24edb49aa1718371bdfcafe31d25aba65cd26f9b4ca07c029f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525458, "uuid": "ddd11054-81a3-49b9-924d-0994cff38483", "comment": "Malware payload (Rhadamanthys)", "value": "4f2fc4f012d71ffe763e532b7eeb57834cd86df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525458, "uuid": "c37292c5-289b-45cd-9458-632d00ad3478", "comment": "Malware payload (Rhadamanthys)", "value": "c2393881f68514e4fab83a0d1b5f5d570a042bbdffd3f67600760a1876689a84d7aef7b0b4f17b405407173e36f0f884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525458, "uuid": "bfcb3cf0-142b-4942-8298-8fef062db5d6", "value": "T19564D04227E16831E52347328E1EC3F4271EBC62AD657F9E2755BE7F0E341A2D12271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525458, "uuid": "c252cb7a-f4e1-47f1-91ee-bca07c9f959d", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525458, "uuid": "97a60697-3827-4d42-a098-ca7160f2f374", "value": "6144:cZ16h25a6juvK3VvjljnkVLlrUBYfcZtkjt:cT6w5piK3VvjR1Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525458, "uuid": "96f8b6fb-9685-49f3-85ae-7793706a959f", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525458, "uuid": "b290c1e5-fa13-4399-a293-4ca8e067746d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525458, "uuid": "23eeabb8-c361-4e7e-a05d-a8a4542cfabd", "value": "994b7845b6dfba0b9d10e51a09c8ac4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99606cdc-d1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680501956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501956, "uuid": "75c28dab-ae6b-4b86-b2ee-8db82fcd8836", "comment": "Malware payload (Mirai)", "value": "190e75cb5a3d93a290d638fbcf245f5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501956, "uuid": "11847bd9-1959-48d4-b78b-ef613240b402", "comment": "Malware payload (Mirai)", "value": "765f7af91f99e8331551e628b32bedc186e533a787d3acea41f9d97d76f00711", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501956, "uuid": "c626f7c5-2ac3-4f5d-8798-1e3d30492518", "comment": "Malware payload (Mirai)", "value": "2b3e88afd5f138c12b5ed371661e0e8f84e1fcbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501956, "uuid": "1d1a7724-788e-4db2-bb58-724c5361c052", "comment": "Malware payload (Mirai)", "value": "d895c7e9ec9583e24e96cb534bbb3eb84eeeb81936b93794e3640da4052581a641bba4112d9c73b43108bae16aff016e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501956, "uuid": "d1a3d1f2-ec2a-4832-87f8-ec3ede82a05b", "value": "T110730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501956, "uuid": "033fc670-45cf-44bc-a993-9deef8330ba8", "value": "1536:2ln25xPBXk1wnnkL7+KE007sndEya6t0bIeiNNfsvHTGcV5GYIWL3:7xpXCMkM/8za4NfsvHqcVERG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501956, "uuid": "5bc04438-57bc-497d-9dd8-118e2540b186", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501956, "uuid": "ef2eafe2-3b8d-428d-a7b7-0d4cfd3564b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501956, "uuid": "af25a286-e60a-40a2-97b6-1b4873f92048", "value": "190e75cb5a3d93a290d638fbcf245f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca254f6-d239-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680538013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538013, "uuid": "0aaca7bc-6c53-4cdc-ac95-23c96132d111", "comment": "Malware payload (njrat)", "value": "f123c77a2c4d94054654e8b928dcf409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538013, "uuid": "602599cc-478d-4c83-b28e-4804dfd7f060", "comment": "Malware payload (njrat)", "value": "777ec13daa1b36c424f7223d3d63b35db202fc3bb025add45f5816b655f2f568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538013, "uuid": "54f04e42-1308-491e-b837-606f8bedba6e", "comment": "Malware payload (njrat)", "value": "781e45a641e86321587a0639f7710706ac6f779b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680538013, "uuid": "6c63b791-2baf-45b1-95c4-77284ab6cc68", "comment": "Malware payload (njrat)", "value": "9e03fe93dbbc86b28dee1e3f9fc0233371a2b7f44341015c1d5ab31e1702d4f78caff608d91a066d26a6d2a30366e6fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538013, "uuid": "0a409659-1fbf-42de-acd2-c152e2b22f9b", "value": "T16BC229593FA08176C2EF6BB406B2DB2102B2E10B5A27DB5F4CD844FA5B777C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538013, "uuid": "ca0ebbbd-19eb-4e42-b49b-fc813b52cabd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538013, "uuid": "ae7f87d5-b607-4000-b017-95e98b5c2aaa", "value": "384:fLd6haZIVi/dMkt1c0DkteYHzKYe/4Y2OzRLTm3yilqr63tbStVvG99:Tw0IVi/dMc1kTBe/4sEEVvG99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680538013, "uuid": "1a1a6f74-af23-4b5a-8891-0b6868e86161", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680538013, "uuid": "330d403d-d715-4354-9e5c-7eeaead5090e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680538013, "uuid": "41443cbc-6d51-4488-8fa8-7013f9f8e318", "value": "bLgd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259680ad-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501333, "uuid": "a6e63cc2-a098-4483-87f4-754be0300c55", "comment": "Malware payload (AgentTesla)", "value": "8219dd1ee25fb7be4d34e677d5fc3c83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501333, "uuid": "c39e4e7e-a1f0-4393-b88f-f734c42b1867", "comment": "Malware payload (AgentTesla)", "value": "77e992be1452e98850fd4c486ac9011559a9f42553fff1075f33bf2d80314a09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501333, "uuid": "1a99f7ac-9700-4c6d-8a9c-5e4862cc9465", "comment": "Malware payload (AgentTesla)", "value": "bca7ba7d05b2b82b9261a3b1e970180242d61868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501333, "uuid": "b7f88150-f90a-4fbd-8f3b-ee7a44f2b2e5", "comment": "Malware payload (AgentTesla)", "value": "d4b6076df85acf7ebccd2fa019515857034da5e5041727ae76919cc1254b9df2f2b9bb123d552a246618067ece97e55a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501333, "uuid": "5447ae0b-d951-450b-b713-0bd60cdd2d0a", "value": "T1FB24011623D8DD4EDD2ACDB279E88D197F72B146A961C3D36284901D0F4A3833BD86F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501333, "uuid": "e67b0d13-6b42-4a55-949a-b30a348d6856", "value": "6144:9fi+cTfTZE7rwisnvagMewwjv4OKCJezI:9fqfTZE7rwdnvagMewwLUCWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501333, "uuid": "a593db9a-32ed-4b10-b456-918e95954e0b", "value": 218856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501333, "uuid": "7ebb8a75-b2d1-46d1-9ffa-7992ce239a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501333, "uuid": "e18cc10f-31ab-4ea8-bcb8-68ff36b92901", "value": "YPT23_1503_7_Swift_Mesaji_20230331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588f84c5-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680532342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532342, "uuid": "0d3b2a8e-5cfc-431a-9b58-5e6c4229674c", "comment": "Malware payload (AgentTesla)", "value": "f4a6d37fefe83f89c2f6b1f253bb9c2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532342, "uuid": "75f63ce2-b35c-470c-a1cf-9d431df40355", "comment": "Malware payload (AgentTesla)", "value": "788e583861d0022304a8013dcf66be0e312402d6154f5a7788f1d67518583c7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532342, "uuid": "a8426da8-47d4-484d-976f-a7824d82231a", "comment": "Malware payload (AgentTesla)", "value": "58ac04dfcc1f0bbf7c41181102f9371a67cda336", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532342, "uuid": "c30fa4ab-93ba-42ad-add1-20d010d7e0ad", "comment": "Malware payload (AgentTesla)", "value": "60cb62551ccbdffdcbde99aefbe8e069e0eee468f7ed21fe58d68cd508a9c85cfdb9b611477918b43559df1a3e22baf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532342, "uuid": "a7c323a6-12b1-4d11-8884-3efe06a18cd2", "value": "T16CE48D748AEEBFBDF839A83BC2A4B74152A8EB642003C51A7E95495DF814CD51F09373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532342, "uuid": "2fc53141-c6f6-4e35-8f41-b85dbb399daf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532342, "uuid": "92a01a9d-5b5c-4170-a355-193608efb3f1", "value": "12288:q6okzy/q4JM4Q2lQfzwcIDNEkxtdBo0hoay47DKWMH29yoNSDA:Sku/6gQMc6uqhrqW/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532342, "uuid": "b48cd3b5-e277-4417-8a4c-9639ec35a6e5", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532342, "uuid": "c4abb6ff-54c3-42f5-a1dd-2c8ef108cc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532342, "uuid": "10e9c64f-a669-4752-a809-8a0b1132ed78", "value": "DOOR-MET_23045112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a01059-d247-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680544197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544197, "uuid": "0119e8c2-a761-4456-8416-5f8b8d7d2d4b", "comment": "Malware payload", "value": "728d76278440ee64793484dc1a9a1b5f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544197, "uuid": "5715d34b-f39e-467c-a208-92b6a3bdee7b", "comment": "Malware payload", "value": "78dbc749e8f5652b92a3e26b683417d0ff941ab1945718ec5994490c75c6b946", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544197, "uuid": "51ed5e6e-00e7-483b-ae64-c349704dd375", "comment": "Malware payload", "value": "301a236e13d9406e9395002d37f491c85669e630", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544197, "uuid": "6aca5f3c-e7cc-426a-be8f-4148f419c8f2", "comment": "Malware payload", "value": "d3081e4ece5961b765512cc402dee15d1d4f504f0925e7da3416f0de2dc591ae0e42f9fbac767a46b82ad8249af45dd2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544197, "uuid": "b011a563-71d8-4f07-9d3c-e98e46868308", "value": "T12903D028E54C9099C7B281FCE47720D7F66E0641B3AA84265E57F6CC4B10EDE0BB9EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544197, "uuid": "72b5cd2f-e759-4375-9448-4239ee10f8a2", "value": "768:T0YQszrv7LUPYS4RrR2Ha4ZUiWNif1lPLA1o:T0Y73TAf4lR2Hh2GPLAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544197, "uuid": "7cc76b65-76df-4600-a859-b2c1bb2c741a", "value": 39452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544197, "uuid": "77c987ef-869d-4de0-a992-7d5ba77597cb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544197, "uuid": "85e8f2ac-ad83-4cc2-8815-2d005efb920f", "value": "23_TCV_greffiers 100% et 50% CDF (sept23) bis.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ec8618-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496159, "uuid": "ed2b7a27-5739-41c5-abdf-a6de8050d43b", "comment": "Malware payload", "value": "8ed2b4033f492acbe0acb3087134a1a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496159, "uuid": "a7fce233-061c-4578-bbdd-fa790d52c970", "comment": "Malware payload", "value": "794f8a04906763755f517afe792b3ab59e056620b16c02c6d0f0328f9efedad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496159, "uuid": "7a7547eb-e2eb-46cb-8cf6-f07e075c9316", "comment": "Malware payload", "value": "1d775049dae96b795d1417ce2b548800262a0419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496159, "uuid": "a7cf2a28-e0cc-4fae-8241-e431441de40f", "comment": "Malware payload", "value": "c7659f62f9facbac7b8878f81106ff282f9a5d30b8d397fed7f40afa28309fb20b66394e7f77f9d157c734592aae050e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496159, "uuid": "66559e29-9ca7-4ccd-8d29-7a65781cb134", "value": "T1A3E4AF467DE2B0E5D73861B01C6B773B1E2685A80B15CFD35154FF28ED23293AA3B11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496159, "uuid": "5cb1717c-650a-467e-9d05-851aa5715630", "value": "12288:SRkYwXwT6Du4+kHdKQVot1gc+QiGKFVk:2Tqu4HK2ot1gpQiGKFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496159, "uuid": "559203cc-f870-4cb0-9619-7de7ff2df9a8", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496159, "uuid": "b09ceb7f-b2ed-4daf-ace7-501f763215cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496159, "uuid": "b5b8bad1-f57a-4735-adcc-4130284db555", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.17044.6774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3422f1b-d1ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680505973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505973, "uuid": "b77bedc5-3cb5-48db-85f9-51279f8d6aa0", "comment": "Malware payload (RemcosRAT)", "value": "93fb43c4d348003fc397d0db3d8eb6a3", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505973, "uuid": "e226027d-f39d-435e-95ea-917672a10f38", "comment": "Malware payload (RemcosRAT)", "value": "79899b5baebf1bfcd986c947d01094890a7f67d8ed9900aae173f9af20fdda49", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505973, "uuid": "9ad90f03-e8de-4c2e-bd57-262111280839", "comment": "Malware payload (RemcosRAT)", "value": "7f1fa05dcf24ceb6c259ef0bf1d9e6542e59b954", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505973, "uuid": "a8f14007-bd0e-4736-9114-fa0379425038", "comment": "Malware payload (RemcosRAT)", "value": "9a0f094550b4c85460b8504e814151a1cc0b5664129d445fe1697466fd5975d41fdd4d138fe4d7fae0e33d3b5890f80f", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505973, "uuid": "12307355-9039-4479-ae4d-de06263d0b87", "value": "T1011523C6CC7742FBE348564A19AF189C62A2CA7BEF4CC77901D5373879B971A25E081C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505973, "uuid": "8f6259bc-abbd-4aa0-acb3-231fe4056739", "value": "24576:OoiK/2Au+xOz7Kk6vZRPXpj7l93MmYXcsQA5PFpr1:OoiI21+xOzbgZRx3l93Mzc/EPFpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680505973, "uuid": "fdd1427c-5219-48cd-8c37-96d32ca3d2b1", "value": 877950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680505973, "uuid": "4e3b56ed-c983-4e6b-b8b7-7f63957e50dc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505973, "uuid": "134752ff-260c-4712-b5b5-3a5b45ccd997", "value": "Shipping Documents PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46bad83-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502512, "uuid": "357627e0-c004-4b28-9141-4702f1fc7085", "comment": "Malware payload (Mirai)", "value": "9bb68dca99397de1123620361bad9993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502512, "uuid": "25d747b2-39f4-41b1-880d-4bcea7c2b15a", "comment": "Malware payload (Mirai)", "value": "79c929fe90b7ff34b530b1b80fa2000803f2306859a5657457e783222053667f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502512, "uuid": "093d1994-0942-4d9f-97d3-dbeb2123c4d4", "comment": "Malware payload (Mirai)", "value": "923eb620af86480f721c7d1e9f698175c2e7d223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502512, "uuid": "5c4de92c-6bab-4344-b6fb-2cc1a920a8c6", "comment": "Malware payload (Mirai)", "value": "88c7905c3159a06e4e52ffb17035c77302b881a88c6fd6e138f603e0190b817a8e9c0bb707871e60cf4aa30b94b20d5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502512, "uuid": "b8a56383-8a42-43d2-8e8d-545fe743b9c9", "value": "T10C83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502512, "uuid": "83c68a8d-80cb-4c6f-923e-b6159efc20e4", "value": "1536:iVLyu95KZDkj752dCexuV/8UZlDwfkJ4MYfW6:iVLyMgEFezxu5VD1ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502512, "uuid": "f3dc812f-c58b-4e6d-a064-096652493b99", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502512, "uuid": "370f284a-3168-47dd-8631-7ff9c7717e3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502512, "uuid": "496a4f68-1076-4aeb-8dfb-5312c3c8658c", "value": "9bb68dca99397de1123620361bad9993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d9b110-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680525403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525403, "uuid": "130d87fa-afe4-4232-aabc-d1a9cb27960b", "comment": "Malware payload (Smoke Loader)", "value": "213c474f2a42549bc70a10aac8a8692a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525403, "uuid": "0c7e07bb-785a-47c9-9ac0-a1afd6420bd6", "comment": "Malware payload (Smoke Loader)", "value": "7a07dcc4ffcebbc11c2120d8fe342565e0dcbb11d76bbf43b1f0c7f04ee8fe91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525403, "uuid": "96db31b2-3be2-4c3b-b072-7bc843d78141", "comment": "Malware payload (Smoke Loader)", "value": "3e1bbb5396fe2d17c12844d9718211c198711fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525403, "uuid": "5b146be7-e99b-43bd-801e-57e530e9a392", "comment": "Malware payload (Smoke Loader)", "value": "dbc312228210eed11f7abd7794dd6d0c518002f219afd1a011ac194c546d1ada09db8401edb0ad854054dcec8aaeefc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525403, "uuid": "1eba4582-53dc-424a-a206-e0b510a3e03c", "value": "T1ACB43B3C0ABD27A2E179DF74DA708020F3F1A41BB721D96D2DEE009D0656E425AA373D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525403, "uuid": "8b3b2967-6a87-447b-8857-6949be17e005", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525403, "uuid": "1e548baf-012a-41a7-904d-154bde4b0d4b", "value": "6144:MYlCTy6dtXaFryFPnr1mZo/Fg0JvRdtIAVcIYuNxDMNhQVPv+7meyvqwVX:MYlCTztXyrq5rNgKFxVcOxDJPGyywVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525403, "uuid": "58afa807-d5d8-4072-a3f6-d3456145b8fb", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525403, "uuid": "ceccf25e-fbfe-4c0d-b72d-c583e3d0bc45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525403, "uuid": "0ff15064-8e7e-4171-ad97-9883e6ec705b", "value": "213c474f2a42549bc70a10aac8a8692a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45b30d5-d244-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680542831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680542831, "uuid": "51ea538a-60b4-4a33-bbca-3982c152e04d", "comment": "Malware payload", "value": "a101e76e11e09489a252d98d462f7107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680542831, "uuid": "f8b39f58-0ceb-4657-9c81-6193ba413f9a", "comment": "Malware payload", "value": "7a1d341d6b0799a5d121cd7f241e3045dcf112dad8dd4f5e22e8399b7b7f6ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680542831, "uuid": "f4d18c38-2e20-4481-b599-c8a0388a11aa", "comment": "Malware payload", "value": "76b1edd340fc00daa1cc6a841b13259fbbf65db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680542831, "uuid": "387ee9c4-ec51-470b-85ac-8365c22436b9", "comment": "Malware payload", "value": "6c8adfb806b7f8301ef720d84f80a1172e576d94e55d84fec34bb87689e7fc9862d1a611e7e92f3322c5498caf96300a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680542831, "uuid": "214f984f-6ad9-468b-86ed-92d53a77148c", "value": "T179B37D1175D1C572D97619324930DAB15E2EF9300FA09E9B2388167E9F312C1DB2AFBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680542831, "uuid": "1de6ef78-6e5c-49f0-b4dc-53874883f9cf", "value": "619c89b124cdf4bef9f5d6383c3bda1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680542831, "uuid": "4b0f4582-1d5f-462b-8be6-328f49dabf6f", "value": "3072:GUZEoi2ALwUycpPQ0mRYEo/DR53SU42e3KjAYgyPA/1NcsaCfj:GUHZRc1BdE04c1AGCfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680542831, "uuid": "0e73649c-c6ac-42fa-8d8e-2751fcbba6bc", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680542831, "uuid": "f98df4fd-108e-4b6c-8f78-fb9dfa6e5971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680542831, "uuid": "826a1d6b-e432-43c4-a398-25e028d2d9a8", "value": "SecuriteInfo.com.Variant.Fragtor.246784.32291.18962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ef4a30-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525630, "uuid": "8c8500e3-6a5a-4ea3-bef7-ea83fd6d8dfd", "comment": "Malware payload (Gafgyt)", "value": "2db86de4d9b76e3aeccef6acf3e8a04c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525630, "uuid": "7ff025f8-6fae-4ffb-94a3-e6fa9d9cfc4b", "comment": "Malware payload (Gafgyt)", "value": "7b3ce4769a9b35ceec88712abadeadc98c078de3cdfa7c8f26a5ba4df74ce590", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525630, "uuid": "776b0095-5790-4446-bd2c-72abba12274a", "comment": "Malware payload (Gafgyt)", "value": "3f3592b5b57aaaade6947df2582eb8a4890e2be5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525630, "uuid": "a5c91bfb-ac0c-42b3-9421-489bf7f13455", "comment": "Malware payload (Gafgyt)", "value": "95592e13ea412846f67e176a5b6663cc4e0133b7490a24251339b381b2c2b2323f8fac425f1bbacdde571b4e4bc6fad8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525630, "uuid": "10d26dba-60f2-4413-8d37-a9e65164b954", "value": "T15BC3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525630, "uuid": "8790ac8d-d266-458b-a4ce-63c08d267d47", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtA5Rdc0sfm7ypwYujl3IdnuW:ZP0DNPAI5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525630, "uuid": "8e3b198c-b9aa-4f43-afd6-443b6e133ac5", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525630, "uuid": "5a5660c3-4e19-4086-9902-740f162eb62f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525630, "uuid": "1532bb80-e0eb-4b52-b116-eecfaabc0e65", "value": "2db86de4d9b76e3aeccef6acf3e8a04c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf7de24-d258-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680551380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551380, "uuid": "0d3e27df-c65d-4221-a982-c89d60b6e0c5", "comment": "Malware payload", "value": "21b5f386aa5887fcb3c78a656b97b798", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551380, "uuid": "28ad026c-e856-45cd-a5f7-33bbbb6ebe5c", "comment": "Malware payload", "value": "7b9e7d3ee54043936744752d70f11a328ad058ca3d7fd508f351912186d46251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551380, "uuid": "da6799c7-aa82-42de-b642-ad2764265cb8", "comment": "Malware payload", "value": "f345fb3a60add11514cda39e364c702f2134003f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551380, "uuid": "064f5356-b027-4186-89f1-1a7d4cf33717", "comment": "Malware payload", "value": "1852fa3f1b374e9d020164b4940a6aa76b74e0c7d9ef7f6de741db55777fa3d2c31c7ae5381dc80d02cf07ec5a615bca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551380, "uuid": "d41dcd0f-4a4a-44be-946a-01f74d8a856e", "value": "T1A5A32777A9618B77C0C66A7129EA5C300F12A8D3DB4F2B59213CA6F4064F5DEB80EF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551380, "uuid": "3c4d35bb-41fc-4001-bb19-2384e4c34265", "value": "1536:3QCPoVySUsXK7kXLIAUhY1tKeimvGE8CXihcmk0VqfE5Ifz+6:g4SU5KLlU1eZ8UiSmk0VqfYIfz+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551380, "uuid": "249de843-0b43-45b7-bd7f-cde0c778ab5b", "value": 98467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551380, "uuid": "b1181e23-86cc-4151-a53f-b8e503e309df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551380, "uuid": "4a339ba4-b963-48e4-abc8-5a4d7c2bb26c", "value": "21b5f386aa5887fcb3c78a656b97b798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e04cbb-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501331, "uuid": "e5f36dcc-760e-431a-b870-653670927466", "comment": "Malware payload (GuLoader)", "value": "c4361895fb2eb9fdc0248a110771660e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501331, "uuid": "2267ccb2-bc30-4437-b695-14c7cb2ffba7", "comment": "Malware payload (GuLoader)", "value": "7bbec697f119cfe105a602196217959e123f529f03b50650bed1787d965457f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501331, "uuid": "55c4101e-b418-41b9-a7d0-3c940f382141", "comment": "Malware payload (GuLoader)", "value": "8d297d0cfd7de49ddcb4bcd7f7a037024ebfc31a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501331, "uuid": "46bff1ce-8324-4444-ae46-fa95293696b3", "comment": "Malware payload (GuLoader)", "value": "d3267e8cacafc76897a07214cfbae1337d7ae519ae3d2b001d3488644b443b78cff0fdde5aad66768131e5245fc1b558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501331, "uuid": "2910e1f9-2155-48cd-8585-249993a869ca", "value": "T1E674022A2D944CA6CF7E07F2443F1E5158E39D2107A2A58F1798BFE879B630257279C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501331, "uuid": "2fc21c7e-9773-45c7-b36b-8bd3a42332b3", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501331, "uuid": "89cb50e8-e32c-419b-9f50-408b233e9603", "value": "6144:DPXlu0E/EEEjvhYcWtJ9WaFY6I6KcH+C1r7VNHnfde/kH5UyZ+yRNR1TpQN+Tiok:g/EEypYcWETpcH+UVNHfdFZHxF9yNIiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501331, "uuid": "2b62ef9b-60ba-4750-86c0-aa763d7bf21b", "value": 364824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501331, "uuid": "bf362d51-156e-4a0f-929e-f0e36e838eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501331, "uuid": "3077dced-c963-4d97-afe5-6c5ed4d0120e", "value": "Whizzingly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fa3ba1-d1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680487484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487484, "uuid": "728897cd-d975-422d-a63b-96fa2f2ad658", "comment": "Malware payload", "value": "9c73a2a719fae2c131ebcc8b74a916d5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487484, "uuid": "b328cdb0-1862-4a11-b12e-fd2103b54557", "comment": "Malware payload", "value": "7bdd2fbd0ee1ef1ae88db3bd540aa3fd4bfd3d091aedfb4b60a2aa330e88af2e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487484, "uuid": "0a7fe681-4692-4f54-9df2-cfe96cce1638", "comment": "Malware payload", "value": "e23551ac104e600f83ea1d95614605d565ab0ba9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487484, "uuid": "4ef60d4c-0be5-479d-bcf7-1f12a3a9aaf4", "comment": "Malware payload", "value": "9c49a12f06296c8d4d550a41d5ff4d015e6c080857ce4833b1c3596f9ea5090aa32e66cb5ef321f1afe8c1d63015207c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487484, "uuid": "57c050f1-4a5b-4724-b2f7-c37c92cecfb8", "value": "T1DA073392F7E9BD2FCC7391334BBA063626425D568702D7176825736C68FBAC88E44BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487484, "uuid": "57357e18-5c7f-421f-853a-6d35e03eacb8", "value": "393216:F95+GEg4/zvpdmt5yMGRo17nBYVqslAKa6SQFdW:3JOzvpdmt5ERojOqslvhSOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680487484, "uuid": "99441286-d794-4ed6-b09d-e3ddd98ce41e", "value": 17343749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680487484, "uuid": "d6c15352-e793-42e8-80dd-d707d488db79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487484, "uuid": "82904ae2-c8e5-4595-9552-eaf82df2e725", "value": "kurulum.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e573479-d24a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680545156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545156, "uuid": "641f4bc4-c3a4-4a92-80e8-a2f398ddb59f", "comment": "Malware payload", "value": "e712177f150077fe3e5929e0316e4753", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545156, "uuid": "ea463fa0-ace0-489f-83aa-798b8c60de99", "comment": "Malware payload", "value": "7bf7fa20bcd5a1ecba65cc7e79085565fcbb04189b8b380994051bf75be0528d", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545156, "uuid": "248f224b-54dc-4a52-b4ad-74ab69b1932b", "comment": "Malware payload", "value": "31dca96966373cfe976236848a18582364d25f4b", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545156, "uuid": "825eb35e-866b-4349-a72c-5bb2dbb3da3f", "comment": "Malware payload", "value": "f0d6b3edecf0ab296be666e1b716efbf3fcedaa99c8d4b25d15a32f7ff36be271af414fb9767ed4f1e8a4d9c982ad914", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545156, "uuid": "9e215711-f50c-4386-922b-a970434f568d", "value": "T1CFA4236846CFF493722E08B3D64C9EEF514E1664BEFA6528E2E147DBC4E60B7D906070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545156, "uuid": "d5a97e88-7cae-40af-84e7-51ccd3b93e6b", "value": "12288:JXyE+KZqtKxcvrYZ9WAd+2v6kDTw+K55Qt7a:dtqUxaYWAd+2v6YE5Qt7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545156, "uuid": "8effc388-1760-4fc9-96d5-c6419808b6c4", "value": 461798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545156, "uuid": "9207faa6-4d9e-4ea6-954b-2c8b885d6079", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545156, "uuid": "ecd0fba6-17ff-46d7-9899-ed77afc184e1", "value": "EO030423.pdf.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172c1ee5-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680501308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501308, "uuid": "484eaccd-178f-42d8-803f-d5e09be123b7", "comment": "Malware payload", "value": "712611875c5b9f1b843ceedf45d8cbf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501308, "uuid": "d379a0dc-690c-48de-ae93-5c372a74e900", "comment": "Malware payload", "value": "7bfc10ac90dfb4eb9931eef474b92321dd0e52dbba1004a3a5bd0a64d2eb0b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501308, "uuid": "f4d854e0-3b15-448f-8c65-54e16b71a006", "comment": "Malware payload", "value": "2d4159532602f70525ecbab556945157377f92ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501308, "uuid": "95207a4a-0654-4f74-a306-ebc7fad41c8e", "comment": "Malware payload", "value": "fecea4880e79fef034051a6caa387fd767c7a713a87abbbf16987d13a7fc44d309591d60a6dc168be8bee233b61af462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501308, "uuid": "d5860a1b-8fe9-4f34-95c5-2e6403851f2e", "value": "T1DEB4C7805FF94A17F4FD2776B4310A989AB9F856E9E7E30F030129D98D56BD848433A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501308, "uuid": "ebe6472d-ab89-4977-81da-8128f68e17a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501308, "uuid": "dff11ff2-de90-4a66-a17c-782733bcf71c", "value": "12288:eF9IUk+EKHQtZc1Z2Pxz8z5Yh7ZTyQCmHR:eFOU4P4Kxz8VYh7ZTyPmHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501308, "uuid": "57d8a82c-c9e0-462b-96d3-7941760ff38d", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501308, "uuid": "6dc97dd3-48f6-4c69-a8df-40d085199992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501308, "uuid": "0d73d7e5-969e-43eb-b239-71d023d56387", "value": "N\u00ba de pedido HCFT-001-23_____________________________________________________________________________________________________________________________________________________________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce28a782-d24e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680547142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680547142, "uuid": "21d9805b-e153-4f6d-b645-2290abe0db73", "comment": "Malware payload", "value": "1f84a3f0ec0f9ca9d1c24edfbe15aaa6", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680547142, "uuid": "637d3782-4589-490f-a4ff-6c6acaadccdd", "comment": "Malware payload", "value": "7c3c213d947880e07549f76aba38f2338cd40b665855fa3aa11a2540bc0218b3", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680547142, "uuid": "217cf7b4-d40f-4472-9cd1-3d587924c3cf", "comment": "Malware payload", "value": "c97a04bb5212e249ff303caa3a60761508dceaef", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680547142, "uuid": "cfd42c82-ef2e-4ad2-bec1-dbcf6ab7d018", "comment": "Malware payload", "value": "3b25be94f01ffb6a95dd4339aead9c788a17453aa64bb2fb4bbe03222812d30f48d7e590422d723f068654ace047f0c3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680547142, "uuid": "95b74128-8351-4d9d-929f-a4160d0756c3", "value": "T172C4461E99AFCDC2CD6579B4418EA70A3E790100975FBCCB5B9AE0F20337790E227956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680547142, "uuid": "76df6f2c-58c2-4a19-ac7c-90a6da05a318", "value": "3072:m2P2jkeiIUGNsziIqV8UYm6uK6F7g0Zz+2vThfk3H7qwZKNU:1ejkMUGNsOI8Ym6QJZz+2rhfkLLZCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680547142, "uuid": "1f9e22d2-b609-4d6d-9aab-4824d728290c", "value": 544753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680547142, "uuid": "ba2eb14c-6b63-4731-b86c-88742cff38e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680547142, "uuid": "3bb087b2-6a52-403f-ad0b-021cf896cd63", "value": "Allsoftware.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065c204d-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680525762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525762, "uuid": "d586d2db-17c4-4eb2-b4d4-98903b3ad3cd", "comment": "Malware payload (Socelars)", "value": "b1141f0d6b9533f0da157c291ecdb182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525762, "uuid": "a2299b6b-df60-438b-aa1d-facc5328bf18", "comment": "Malware payload (Socelars)", "value": "7d19ffbaaeb9cb5e046062746efcf246596ebd5c6bdb658e266d3c532d19c9a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525762, "uuid": "dfe94f47-0313-4fea-a74a-3ed74440d214", "comment": "Malware payload (Socelars)", "value": "9cd8bfe22d06fa45d733c4a05080e235e69d19a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525762, "uuid": "43672750-6334-4ef9-b8da-293bc369d409", "comment": "Malware payload (Socelars)", "value": "05a58873fd1ae7a73702e43f83adb87c373258e33207553dcfe171b25a1c5903aebf211fef3b901bd23338edf1f0ed87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525762, "uuid": "2164fd26-2f82-47e9-8840-359320a23ec1", "value": "T127658D21F7C26032E9E310B745FF5ABE8D3C6A114708A4D7D3C81C999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525762, "uuid": "1f26db03-96fa-4dd7-af0e-32d40d7606b1", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525762, "uuid": "be2857b4-a9d4-4320-9752-3fc190233621", "value": "24576:3GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRbv5hwSQ:mpEUIvU0N9jkpjweXt77L5SF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525762, "uuid": "cbd0ecc6-2fc9-4ef6-850c-d456c33ded1c", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525762, "uuid": "b48c4c3e-b61f-4555-ade1-fce32cf283d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525762, "uuid": "4f1b60ce-fa2e-4d26-8882-f97a3ca75550", "value": "b1141f0d6b9533f0da157c291ecdb182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23605d32-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501329, "uuid": "53b30e47-ac41-4599-a7e8-40e417ae6af0", "comment": "Malware payload (GuLoader)", "value": "42e3d53df2c7808d587cdeed7e9e7b43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501329, "uuid": "80072eb8-ee98-4bae-8aed-25d499627288", "comment": "Malware payload (GuLoader)", "value": "7d7f1da84c6b99fdfc3b82aaf85ae8e8c28ee4e2efc0d412222de49f7ac15949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501329, "uuid": "b2269df2-02ea-4468-9581-dc9b346aa731", "comment": "Malware payload (GuLoader)", "value": "41069f8049617a65fd15965882dad5a187e23150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501329, "uuid": "5791047b-7a7d-4608-8edf-07ea52afed4c", "comment": "Malware payload (GuLoader)", "value": "687059ac02e1fea2ca1da1f7d647c1ce2ec3f60fce1b55096603fa8c82bb367b574b1b0c2717aa901318e94610362e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501329, "uuid": "bf917bf0-2b14-4371-a0a3-ac3a03c5f2bb", "value": "T1F6D405D0F440D55ADF421F7D8826CC3262E66C278AB0798E62CD7E9B777B3422932457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501329, "uuid": "78328914-0728-43a5-b7c4-db319b17313e", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501329, "uuid": "bc3226d8-a64d-49fe-b223-c45c48777c30", "value": "6144:dqjI8+58yUPAQVrbps4iCvx1LQ8+z6G0kKLcJNNxjlru:0N+9UPA4SS08+mG0kK4JNPj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501329, "uuid": "5d421bd7-1b31-4d9b-8262-c0da78665595", "value": 649263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501329, "uuid": "97f6c6d8-6fff-4ae9-a755-98fbffb7e254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501329, "uuid": "c160b677-e44b-4f82-9739-d50603f04c56", "value": "TTE0009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ef28a9-d213-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680521541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521541, "uuid": "dfc95a55-3be1-49ce-a19c-0b5436b4be42", "comment": "Malware payload (AgentTesla)", "value": "772f41b5b21ec9fb68b8b3805839fb54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521541, "uuid": "f4a8ed8c-c189-425b-8007-7e51e40a40d1", "comment": "Malware payload (AgentTesla)", "value": "7e5aeae4b1308c9ae003470343717c1dba150f56448d2730d30509eb81ade747", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521541, "uuid": "a930dcdb-b1ca-4af6-a6f5-6491671f8813", "comment": "Malware payload (AgentTesla)", "value": "254f0a4a206195e51ede84b125aa2eb896adcfa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521541, "uuid": "6ad4a733-22b1-4501-b962-171f6ca9f5ba", "comment": "Malware payload (AgentTesla)", "value": "afbb47c97c788507215736f0387bf49cf408f41d54d535ff798bc05d6a254f6f8f2e1c93afc737942a270e67fb7f004f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521541, "uuid": "a4f301d1-4b69-4794-b8b2-fa9d9bc4241b", "value": "T16325D0AD365174DFC81BFD7AC8541C64A620A467830BE357A4C316A96E8DBDBCF042E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521541, "uuid": "5eacae8b-752a-41a1-89f2-e5ac3d55cb23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521541, "uuid": "616c65dd-7830-44b5-b366-bef5fa878765", "value": "24576:xdMU5fPXiSz0mJTdKBetEHCqu2bBkAbqafC5ZaWyo+gZRf0:xdMUVpFj8U+2BaK5oWybgZRf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521541, "uuid": "22e025de-a71d-4659-b70f-33d596fe2c6a", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521541, "uuid": "9e1bc067-bd76-44e0-a6da-5461e0645192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521541, "uuid": "96524aee-e85c-474f-ac1a-29594c447ecb", "value": "7e5aeae4b1308c9ae003470343717c1dba150f56448d2730d30509eb81ade747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18a9957-d249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680544973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544973, "uuid": "229eacb1-5c49-43f2-951d-05c596a7fff1", "comment": "Malware payload (Vidar)", "value": "58f16cc21973f83ce13d2b4271d39b42", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544973, "uuid": "965b660c-7ece-434e-872b-ff19a9a2f285", "comment": "Malware payload (Vidar)", "value": "7ed279a6de558b31e93b310ca21564c42431fea11bb55794f8c28126dc1fe1fd", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544973, "uuid": "bb7a9af6-ec19-4452-bd19-c378b9b843a4", "comment": "Malware payload (Vidar)", "value": "a78a0c627e1d469cb5404a41f07c2d3a38840bad", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544973, "uuid": "8634729e-a3c0-47c5-a8e4-a3c477b8d323", "comment": "Malware payload (Vidar)", "value": "06dc1e6ed9811cae188f19379251a8a2fcf4843fde0617b981f7359de297d00a29e3ac41045f8a453ab7bb78b70bd6c3", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544973, "uuid": "d6d29baf-8bb7-4009-93fc-1195b353acab", "value": "T11B45021171C1D430E9B21A3109B0EBF55A7DF8304F74AD9FB7891A7A5E702D0AB29D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544973, "uuid": "d66766aa-1833-4bbd-8592-f84f196a4c35", "value": "4016f2b03c0f5699dd2622a67d892424", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544973, "uuid": "f602a64d-12b6-491b-a320-5b6450e900e2", "value": "12288:gF3xilhpL6Igw0Ev5tKvhurIfqiJaXpEt8labCis:oxSrL6Iz0+wTJaXpEhCis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544973, "uuid": "c52b0b62-d085-4111-8233-542a070f4d26", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544973, "uuid": "a53fe385-7062-4e43-88ca-3776c2d1b491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544973, "uuid": "473945d7-ec0b-4f01-8873-230c18c9abd7", "value": "58f16cc21973f83ce13d2b4271d39b42.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa1e8d5-d1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1680488330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488330, "uuid": "98ab4c16-c9d7-452b-9fcb-298b15925ec1", "comment": "Malware payload (GurcuStealer)", "value": "cb1ca4cee1049ab33d16bf76eb56a24f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488330, "uuid": "ba87bc1a-4322-4a61-b3f3-a4ada9a4bdad", "comment": "Malware payload (GurcuStealer)", "value": "7ed84f4ee83c12983f65f42732e5ccaf0cce0e3c8ef1630705c0eb0a01f8f289", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488330, "uuid": "bbc63f59-7550-4408-b345-3abb1749897c", "comment": "Malware payload (GurcuStealer)", "value": "d6428b37c91abff5fd75864cb8b501bd1a4e43c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488330, "uuid": "0842a9b3-9459-47c4-8863-8d26dc241858", "comment": "Malware payload (GurcuStealer)", "value": "c9a59b57a040b82042716eb27e7cf619cd4c3ac084f23502df42755fa2ca516f636791a21b7e2d320b5b7f99f0c9c2c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488330, "uuid": "29c4669e-76a4-4306-8b5f-34320d89571e", "value": "T14483B475E188ADE5D15616BBCC31F705152BF707962E4B0939BAB04E18B22C730ABE4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488330, "uuid": "eef349ce-af5b-400f-99d4-dc99e5015e09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488330, "uuid": "4ddadf72-dbd0-4f84-a330-65db3218be23", "value": "768:sctHoXRBEL97xCQBBbPUPF30Jbtj/UMA/s9naW+9SLdU:sciXRBq9bbPUKbtgMEs9a3SLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680488330, "uuid": "c43b7a3f-6180-4267-af23-31ae59615f41", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680488330, "uuid": "8fce4834-5aa0-4af9-a9a4-af8379c65085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488330, "uuid": "38401c5e-08f3-43b5-9431-1713f85a6a77", "value": "cb1ca4cee1049ab33d16bf76eb56a24f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93adc680-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680528576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528576, "uuid": "07334afa-1061-42ea-8cc5-2bc5792c8431", "comment": "Malware payload (AgentTesla)", "value": "e989d8b7a204ce0cbdf046579d9183fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528576, "uuid": "27d86a59-f419-4975-a99d-28c5a1cfc4c2", "comment": "Malware payload (AgentTesla)", "value": "7fd38ca9ad6cdf8922f5a1b64a3a181bbebb4c4c5d46cc1138b3c6fa203272ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528576, "uuid": "48ff7314-5c6a-4a1f-aa63-71c90b7fdbf2", "comment": "Malware payload (AgentTesla)", "value": "3fd6de36c7dae5924d3a6965ce7eac88f36bbeb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528576, "uuid": "1af5d9df-fb10-4bc6-b783-e8a963251092", "comment": "Malware payload (AgentTesla)", "value": "02cf04c5947822847f80fbe51e34478b32fe6f002f528afb33975fe97083c38f10cde3bdad4b1e0e5553932bc16f710a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528576, "uuid": "ecae8617-c10a-4699-8544-5a9d7266adb4", "value": "T1F6F401312BAA5176F63597BE95A422D95B6DB3B22703D94D18F211CE0B63B034EC063F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528576, "uuid": "9bebe58b-b7e9-4069-b9c1-ef0d0ac9d80a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528576, "uuid": "3d62b9ae-abec-4855-bac9-e10d1eff3d4d", "value": "12288:g29mYMUnFW/NNXm3yVHA19LRCXZ+sTc1j6wT4v4kOzT/IA/If5KVNq2TzhLox+y5:g29UHXm3ydIkZDcYwTkOPIA/IfYWqzhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528576, "uuid": "1e4275cb-eb9f-4d4a-8adb-0ff1ef6d2240", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528576, "uuid": "188972e6-62cd-4cf1-94ac-e3fa54b8b2f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528576, "uuid": "bc3f1ff1-0604-48d0-9bc9-012cc5869d51", "value": "7fd38ca9ad6cdf8922f5a1b64a3a181bbebb4c4c5d46cc1138b3c6fa203272ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c0bf7d-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680503133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503133, "uuid": "f6a329dc-e7eb-460d-8177-20adee354d9b", "comment": "Malware payload (Mirai)", "value": "e4bc063e014f7ad223130df390bed5cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503133, "uuid": "a53c7636-88e1-4eea-a2f0-6c293536a69e", "comment": "Malware payload (Mirai)", "value": "7fde90a2647b1a739bfd4916b36b8b2c306d8a33c206bafabb668c2dacce429a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503133, "uuid": "7017f6c7-258a-4d2f-8d63-2cf88f312a32", "comment": "Malware payload (Mirai)", "value": "5dba73b48f0e66309f863052f8661967ca3323f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503133, "uuid": "265b6460-be19-4c18-8148-d02b61d21b8b", "comment": "Malware payload (Mirai)", "value": "ca668f807d8bf9d4142871a6c82cbca4bd002102586b3b74b43f7822885b479f3fe47419acb1173e761cbe695510f37b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503133, "uuid": "4278c7ba-0b14-4d51-83d5-221366fd22e3", "value": "T1CDE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503133, "uuid": "7dabd543-351a-4218-8ceb-5e60be13d954", "value": "3072:CJLce3pC5mR7naLHbz4N9GUJURIJ1FREXkkTM/9oIMY:CJLceVnaLHbz4NMUJdHREXkYM/9LMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503133, "uuid": "d2b5e1af-82c0-4316-a3e7-ee01c155f17f", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503133, "uuid": "1de03ee3-16f8-4ef5-a3b0-49227ebe0c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503133, "uuid": "1628d5e0-0cec-410a-a837-570071b45f77", "value": "e4bc063e014f7ad223130df390bed5cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a6a44c-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525490, "uuid": "5a6c0a1a-17fb-4e32-9c47-84e28e96693a", "comment": "Malware payload (Rhadamanthys)", "value": "acbdc0f4ad2f0267f4106b69f80a7c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525490, "uuid": "efff17ec-caf2-45e3-888d-9fb8932f8cc3", "comment": "Malware payload (Rhadamanthys)", "value": "803b332a3ed7caf147a77cff7d11322e1cd559d595761169e4328d42b257c8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525490, "uuid": "92d1ed2c-8e6d-4dd6-bb8e-4c9b0174fade", "comment": "Malware payload (Rhadamanthys)", "value": "6767f113e244feb4572441716cd842d06ce2fd6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525490, "uuid": "6f57818d-dc44-4d0b-8dd9-1f0e4a82ba18", "comment": "Malware payload (Rhadamanthys)", "value": "1c5e9f7e817ece45015bbecc421af3a48d91c26d4398b6b56b4a18c1d3f0ea40ce9abab28bc3b9687ec1bb1ee8e6153d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525490, "uuid": "7c8f1b1c-6d65-49ab-9a90-e817d9994a5a", "value": "T12764CF4267E06871F21246314F2FC3F42A2EBC65AD157F9F2745BE7F0A342A1D226726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525490, "uuid": "abba3b5a-fd26-4726-ab1a-4ab05d432bc8", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525490, "uuid": "c5645067-103d-4fa6-84ad-efce2ff385c7", "value": "3072:everG29k7xKgz0zznFdHnyQvc4rFXiUdnHiOWZz1J8liGNIp2ML+E7MMAM4TxPZt:RLkVz01FBXZHJWBfruM3Z4BZtkjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525490, "uuid": "4ad9e54c-a5c8-4d25-9479-256bdca40128", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525490, "uuid": "f4327310-ed3e-47d1-ac1b-eaa7bc1f34d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525490, "uuid": "941750ae-b1d5-4f50-b19f-06f569e3b5aa", "value": "acbdc0f4ad2f0267f4106b69f80a7c85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3e0f64-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680523248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523248, "uuid": "06ac7d77-6e3b-47c5-8809-a9112569a09a", "comment": "Malware payload (Smoke Loader)", "value": "42f6aaefeac44c8b22daf43afbf9f01a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523248, "uuid": "6ecdad28-978a-4d95-a6cd-d263d680fae2", "comment": "Malware payload (Smoke Loader)", "value": "809e43da5cfbc96d3ad542bc1d6bb5d11b45e8d7dfc9bba26ccfd4f8ba1028cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523248, "uuid": "6cca819e-fc90-4266-8829-4d04c2c38a13", "comment": "Malware payload (Smoke Loader)", "value": "a6b51cbcbd8f04ecb4aa6f77059f7217eddc01c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523248, "uuid": "efbb066b-bf1c-4f8d-b202-f11093e24c70", "comment": "Malware payload (Smoke Loader)", "value": "d39cb8b46b28aca931b8d5c09f771fc3e9a644c73d731eff4c808ebf37080ab61b21991321f3b441bb9d81ef5b90b456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523248, "uuid": "17b971b1-c0c5-44de-beaf-f03dd1407905", "value": "T1C664AE4257E1A871E51357318F2EC3F42A1EFCA1AF257E9E2B45BA3F09341A1D222717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523248, "uuid": "3e4abefe-092c-4dfb-958f-6282a599f56e", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523248, "uuid": "ee25ea55-ef79-45ab-b6af-674c778a4441", "value": "6144:vJHDAcvoL9aGhIhNHrrWvi/r1oMZtkjt:hjAOoLurWviD1oMGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523248, "uuid": "7846a9f9-2ed4-4b4b-b12f-39d53aa7f6ec", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523248, "uuid": "abef9d1e-e429-42f2-b354-e21e05c3946c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523248, "uuid": "f62bdf51-92cd-43e9-91aa-b66b80daf123", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f86669-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496149, "uuid": "2c0294f4-9fee-411a-b76d-6fc4852bc32f", "comment": "Malware payload", "value": "8cefc6cdf527a017b94d33524cd009b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496149, "uuid": "dbf81c3b-386b-4dcd-8051-ca56438d7a70", "comment": "Malware payload", "value": "81f1c62f3b1b90bde478f1528257dc46740ed6f2d6a8172f223ef49030869138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496149, "uuid": "f3c8313d-c1c7-4c42-9294-6fd542e16c48", "comment": "Malware payload", "value": "db23e9d65fa553cb9dd8bfedeed68d0e436ceabd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496149, "uuid": "31342478-349f-4999-bc3b-23fb9e3d9ad8", "comment": "Malware payload", "value": "afadc25f951eadd786e89f85c2f3b19658def50cc13cf404dacbf44b834febe0c9a1ebcd80995e3c2983e6a035ebb7c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496149, "uuid": "f776d099-56b2-48b0-bf96-388c4501f4d0", "value": "T109A36B532BC1C062F7B70AB0562776229EFFE9306278D91FA4A17A0E68F4160DD71F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496149, "uuid": "a5565884-4808-4d10-92cb-cd43441b5f05", "value": "768:jDLkgwC0fUzSsJEbLcdG0AT9I4DZqS+AEuszxLT/WlJkFplLtV3PdfezDTqCl13r:1vvvAT9I4DgpAZszxwqFplb12zDO9FF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496149, "uuid": "b0657415-fcc8-48e8-90f3-8e2d0cde8c10", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496149, "uuid": "0d563366-89ac-49bc-bf3b-5ed168aadc74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496149, "uuid": "f85aa7b3-a8c3-4794-af1f-9df66070fd17", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.719.8091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e32cffb-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680532325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532325, "uuid": "38057278-1779-41ce-8256-4c7ba96dc179", "comment": "Malware payload (AgentTesla)", "value": "3d822b4323d99c9485748119b53ebff8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532325, "uuid": "37004cbd-7017-473d-9f7e-b414dbc220c7", "comment": "Malware payload (AgentTesla)", "value": "82211de23461b7060737032b0ab788d6cbf5e2486bda7bf9f2c1c7d846ef9234", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532325, "uuid": "fbbd5960-0ccb-4aa2-b05c-4f92cad44117", "comment": "Malware payload (AgentTesla)", "value": "c8c0af75f5f0f788252cb90679c34e109fd22238", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532325, "uuid": "4879f4d8-f5e0-4c3d-ba05-cb27ee91dd11", "comment": "Malware payload (AgentTesla)", "value": "c70ea105a1d6f47bc8afe2563417503b8cb2bdb9318569fbf8aa10a3bfc9c2da72490258b13276961ccbfd3b14c2452c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532325, "uuid": "de715a32-ca82-4980-885f-4acc482c2a36", "value": "T171F423293A985333CF39837BA0A3929413FBA96A5022D3BD6CD94CE76C33F544551D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532325, "uuid": "c907ee42-3523-4b65-a25c-2ddc91314c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532325, "uuid": "859f3556-5b6c-49b0-b002-bdd77e6e896c", "value": "12288:j5CBWKdq1FbwwJLwr/+nQZPhWqUjh1kCFBwSgmnqzTrQCEOBa7TYzhqB6/fMN5IJ:Mfrp7+UWJN1PqhmnDCEOBsUzhc6n25ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532325, "uuid": "a8677bbc-9e17-4382-9215-a0afe3b21ac0", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532325, "uuid": "f5492cd0-4428-45b3-98ce-ed2e6d748294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532325, "uuid": "f5e309b3-32de-48b6-889e-2f846331959b", "value": "Advanced Payment - Ref_001299384596OBR11522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041792af-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496123, "uuid": "03a9e81a-96e2-4cea-a298-2a7e3f1f5e0b", "comment": "Malware payload", "value": "6c10a46698930a85ed29c92cdf5fc51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496123, "uuid": "d14d7d24-0414-4fd9-ba8c-6c3bdf8e3a2c", "comment": "Malware payload", "value": "823449d7fb24903e12095545bb801692706684d77c91ad50009a09a8b9dfc5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496123, "uuid": "64ef6a25-51ce-465c-bef5-d5b245b0d912", "comment": "Malware payload", "value": "fe17061b58376247ff1812ebd343766765eaed2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496123, "uuid": "d9503573-9d51-48d7-937e-48d2ba44c305", "comment": "Malware payload", "value": "6735e9d3705917916e266a2ac7739fcdb56de2c2c738ea7cf617e0feb7ce73dec3cf7bd7d60896ff12b6439d6cd54076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496123, "uuid": "f58cbcf4-de1b-4c85-90c6-f557d1a29af7", "value": "T11EA35A0367C58543EEEB0AB157336221AEBFE9306334D8178C916B0E68F17949D61FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496123, "uuid": "96996fe9-f4f1-4272-a3ba-798399d73342", "value": "768:gA1aMPStqYLcecUCmHllGnsvGcZkgesS2yfrNdgvc1BWlk2mE9ec+ST5Fsth2nK5:NQLccXFlzxesS2yfrgv5ec+oA8KaaFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496123, "uuid": "913bf544-a035-4848-862c-ed42b5922105", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496123, "uuid": "d82110aa-55cd-4178-af4d-88e26a0b1719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496123, "uuid": "209f8625-cec0-48b3-a0ad-c839d28a1b56", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.5889.20673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f9e045-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525365, "uuid": "cd8d5ac8-3f85-479e-8e1a-cc74a61f4397", "comment": "Malware payload", "value": "ee73d6df09b4d861169646bfa2bbc1b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525365, "uuid": "586ddc7f-0c34-4f96-9402-9f14ee014ea9", "comment": "Malware payload", "value": "82b775fc10011af9c5441f9af3c4660bf08840b267c3419afbae896017fa856e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525365, "uuid": "25fd61b4-8d95-48f8-92fc-4d884d5945eb", "comment": "Malware payload", "value": "12d8ac68a6aca16877e7a25d7c5ef72c4eca4ff9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525365, "uuid": "ea5da8c8-b03e-4dba-b633-d752ee345bcc", "comment": "Malware payload", "value": "8bb444023780813fbc2740278fcf5e31f8f60cba1f17da100ab878070c4f8ad5d7b02054c8f549e01dfd9fc0dc4de166", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525365, "uuid": "e5725f1d-e4a2-4ebe-ad7c-4140de2f4668", "value": "T1C706C7E630C697DDC816D63F8B13ED7F988F70364526D8E39168E2325D2AC843A57E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525365, "uuid": "856c8c35-26a9-4d9c-8142-3f1bb2c12e0a", "value": "49152:A0GhswM3c2GGWw5xrNgYYuRTYkWEAKcwwRiG6h:shXQcR++vHR6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525365, "uuid": "c8885bbe-5a1c-4e52-bba5-489a8171c362", "value": 3864497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525365, "uuid": "30d82ef9-2083-4ba1-a455-00db08a2f2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525365, "uuid": "be9a2611-9d23-43b3-a0b8-8450dac7d44d", "value": "ee73d6df09b4d861169646bfa2bbc1b4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed67290-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680501321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501321, "uuid": "e5c0375d-a255-41de-abe9-9f22a2e47ce1", "comment": "Malware payload (SnakeKeylogger)", "value": "8c2901b1e53788859728dcfe886cc528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501321, "uuid": "2aab5b97-58b7-40c2-abd7-f82bef8774ad", "comment": "Malware payload (SnakeKeylogger)", "value": "834d3766d37ca1f8d06ee6b9cea529fb9c40794bcc58e1f4bec403f920865878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501321, "uuid": "924bf518-5a78-4df2-b887-4f3b63801904", "comment": "Malware payload (SnakeKeylogger)", "value": "464f215d85c0924e8541dec813adfd9fad81590b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501321, "uuid": "98122ca7-07a7-49d5-a819-d0f9f75c0c58", "comment": "Malware payload (SnakeKeylogger)", "value": "c66099367a39befe2a15f33107d488e4477eeedc6b852c59284facc6f610d8cee67f125919850a54be7e160b688a4bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501321, "uuid": "86b891f7-3353-4ef4-be3a-4d61dd4542d1", "value": "T163E4011037DDDA19D83397BA51D1D2B02332CCEAA562CB670FC9BDCBB2D974A2520197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501321, "uuid": "79fd9462-8d55-48e5-856a-b70eb72a586c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501321, "uuid": "c9c21c16-d35e-4c0d-a8a8-f2f3ff01b189", "value": "12288:xxYqHsYCPxQelMizlF+OIgJUjWkqaGG+y3EFKfhAPyyztJeimOMt+:xxYqHsYyQQzlFF7rc3EFPzeimX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501321, "uuid": "46af1f26-2299-4555-a1be-ec84fcc31ddb", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501321, "uuid": "768a45c0-b128-4659-9b20-2195a9447196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501321, "uuid": "0ac201b4-3f25-46c9-aad4-5cd1f92e2157", "value": "Quotation price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e11db07-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496139, "uuid": "b941a4ba-4a78-45ce-aa2d-ba14d1fba4e2", "comment": "Malware payload", "value": "9176f80e07113dbb7f6428f6f00b7dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496139, "uuid": "d1b99bed-0349-4c7e-a20f-1afad564c928", "comment": "Malware payload", "value": "83a06e3a3c432081b2c41c4f0b3a913a36a1c42e72f0d28026852d7aed0c569e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496139, "uuid": "17741117-e385-4d6f-9dd3-4c70afd1e222", "comment": "Malware payload", "value": "3486e55ce9debeb1c805a6f9df63780645cb2bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496139, "uuid": "e92696fd-45f8-4f84-b9b0-e407b8047db1", "comment": "Malware payload", "value": "be4ae85e17374da58a97ca3179fbaf5a798d0f644e2632970d83bad948e37567d6378f79a9b71345e82ec7cd05cd0a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496139, "uuid": "8bed7772-61b7-483d-aa96-a5c7f22cdd94", "value": "T1FC748C117BC4D47AC1A311325F53976AA3BABD629E3987873BD03B0DAE30192DE38745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496139, "uuid": "22447153-b119-403b-82cd-d89cd4f05fac", "value": "6144:LqS7it3yueY5D+0p25HE1FP45RWyUGoMYbVhMFpfMUwFKNSV3:mS7it1H2ODUR1RRY5iQDGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496139, "uuid": "8da8de3d-8e45-4a10-8d40-0621f4798090", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496139, "uuid": "401903a0-6a9a-4da8-b46e-6cf485021f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496139, "uuid": "d28c40de-f652-4aab-9e0a-a0143b19d9ec", "value": "SecuriteInfo.com.W32.PossibleThreat.21754.7498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd670d0-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545642, "uuid": "3bf54665-5bee-4788-abf1-ad4c72c0070a", "comment": "Malware payload (Mirai)", "value": "ccc64f840bc8400f2f0733673b4d8bef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545642, "uuid": "96b6a37d-4a50-47cf-ae16-149bc270a374", "comment": "Malware payload (Mirai)", "value": "83a76d906afd8d19a7e424afa910b1b77ceaa96bf5a86564d4bf2130d79c0ceb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545642, "uuid": "989b1e92-f6ac-4bd9-b996-1293b8a7beda", "comment": "Malware payload (Mirai)", "value": "a9f3effd2eafe3e32cec9f64f76e6626cb0b3f0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545642, "uuid": "d319d181-c139-4cd7-a34d-861dd12d5eed", "comment": "Malware payload (Mirai)", "value": "8817934bbd6e12b4315157056a74cad2db4a21238eadfab9e48455d6401211eec47e15bccc2b28a8bb5f49900ffd7ff8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545642, "uuid": "addc24e4-6b60-4804-965d-3d597231710f", "value": "T104438C37E96E1E74C04641B074748EB56F23B5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545642, "uuid": "decb7370-3848-46e5-82eb-6b3c5c6e5090", "value": "1536:Vaa0brW/Od9hlCR3KaeKYXwKEpPDCMC2+WB:Vv0brWGd9X5aRYypPDL+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545642, "uuid": "8a7e3b7f-57e7-421d-b7df-ccb51dd91032", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545642, "uuid": "bd0b4cc9-d678-4fcc-8b63-dadbdb0e4fa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545642, "uuid": "780d0353-b4a4-4622-b8bb-0b1d836ee466", "value": "ccc64f840bc8400f2f0733673b4d8bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22354656-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680533539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533539, "uuid": "9b680f1c-9825-42e8-a4ba-52e350b2e710", "comment": "Malware payload", "value": "fef4db15628901ad22b981f17d451873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533539, "uuid": "4a25bab7-a4fd-487e-b821-14c78f10dd11", "comment": "Malware payload", "value": "83b7aad0f58f9217b9c56679c7617c974561dbc6ece110fb4930155fae4acd19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533539, "uuid": "e9de855e-4f04-4cff-83a4-4266e90277c2", "comment": "Malware payload", "value": "b1b90500e3252ebabba2e2167a79f0cb89d43845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533539, "uuid": "0541ef99-47dc-4594-b9e4-322aa63323be", "comment": "Malware payload", "value": "d9fa424086d29ed9e80eb187381a3148f3ceb354e37826988a50936eec76984cbaf4dad850ce132832289eb71c2d5ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533539, "uuid": "71bfdd69-a1ec-4c38-b802-55f0d73b0e39", "value": "T1A4841292F7E15839D072CEB01C90DA62483B79655DBCA50877ECAC8F9F3B681835A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533539, "uuid": "e2c103d1-2f10-4ae3-a319-210fd21263fa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533539, "uuid": "56bea7b3-f651-48b3-b411-70e9d603f196", "value": "6144:x/QiQXCUJm+ksmpk3U9jW1U4P9bgDOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoj:pQi3Us6m6URA3PhgDlL//plmW9bTXeVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533539, "uuid": "f3390b13-c20e-4f96-aca5-d672667e007b", "value": 390019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533539, "uuid": "0880850b-e9c3-4b0d-b317-7677f9a9b93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533539, "uuid": "b46dc67f-6972-4562-a8fd-9c1f05d61e6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6c640e-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525824, "uuid": "8df30131-b443-4cc2-8cdc-32dbade76292", "comment": "Malware payload (AgentTesla)", "value": "df99e5fc145c2a6b08e6107e00bf759a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525824, "uuid": "19ef956b-1f11-4bb0-b34c-01d2c2592fc7", "comment": "Malware payload (AgentTesla)", "value": "84049d0a55fbeae800952079704c26fba374fab217b0b26b944a0d98ac66fab4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525824, "uuid": "21fd380c-4648-447c-8919-b40dce7331ec", "comment": "Malware payload (AgentTesla)", "value": "7f4f9af387f7bfc019d5c027b6ac77b9a08f7f76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525824, "uuid": "f548ce95-77c5-46d3-8192-ade3c631e123", "comment": "Malware payload (AgentTesla)", "value": "d8a1662b7a1e63cc3c09ff4ace3ad80a68467d14f11f1cfd0929fa2f494074618053b984952bfa82b9e4cc0b4b6964da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525824, "uuid": "74de90ec-78f0-45aa-b0ca-d9d32344bbfd", "value": "T11AF423183515B722CE3C47FA50A3A71A0BB7E9932883D7BD4CCA1DE66937F44C941A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525824, "uuid": "f5547f82-f1ca-48f4-af94-36157e5eb624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525824, "uuid": "5fd54a21-e9f9-40af-b9ac-057362800143", "value": "12288:+5CBWKdq1FbwwJLwrxZvIOaDnjQ1RDfmazxwI+wVzsFKIWz71hk5DgxEX8:hfrpX/InQIYqQzmWVW5Dg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525824, "uuid": "b683149c-df48-4382-835b-7a4b5da6c314", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525824, "uuid": "ebbfa270-1a60-4260-ae3f-f4dab4bdaead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525824, "uuid": "92a92670-935d-495e-b02a-e48d5dbf0b62", "value": "df99e5fc145c2a6b08e6107e00bf759a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0c812a-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526659, "uuid": "56a1b7cf-e3f1-40fc-b25e-df2423cb844a", "comment": "Malware payload (Gafgyt)", "value": "70c00c60ea6f0d3ddf1e10cdd202d78e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526659, "uuid": "ea36f875-c5fb-49cd-9e75-44b26f6211b5", "comment": "Malware payload (Gafgyt)", "value": "84085ef55f07b55da66498ba03d0a69de6f8a3e091aecea7be4c66fa29268afa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526659, "uuid": "296c2ffe-a0af-485b-b84f-b6e3db660500", "comment": "Malware payload (Gafgyt)", "value": "40f46448c6f8190cc0b9d23dd7492c4e9dc06e56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526659, "uuid": "5d3fae8d-8e48-4829-ad86-3d621769f66d", "comment": "Malware payload (Gafgyt)", "value": "dd5ec991498f38a8b195f4159703e0144b3b705779d1f92544ffa1e15fde07986d96432573d4058685010dc65c680f3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526659, "uuid": "bc1303a1-d579-426f-a47e-387c8436f4f7", "value": "T1DE933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526659, "uuid": "8f95c459-7463-4200-906a-01d2d6539c82", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2empGMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8r7eLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526659, "uuid": "fbf8c571-5954-4ea5-b8a9-d4aa878797e7", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526659, "uuid": "3fee58ad-c99c-4d6a-80a3-13604e216ff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526659, "uuid": "f1072ff4-a5d0-43c5-b2fb-447ef1810bd6", "value": "70c00c60ea6f0d3ddf1e10cdd202d78e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403a6cf8-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524570, "uuid": "9e885209-d2ed-4ac7-bcb9-04b30a683bce", "comment": "Malware payload (SnakeKeylogger)", "value": "14a04a051034dc2b722c0a3ce5bac9f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524570, "uuid": "cc4152ed-7ba6-4c6f-8317-6889d598fb0b", "comment": "Malware payload (SnakeKeylogger)", "value": "84cc129521b39e0182631b253637efda5e6305b8c484ab76f3a4184e81bbd812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524570, "uuid": "da32e35a-0601-4c05-9268-c5e270319ad4", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac5822f53c40924dc702bc724d171d898daa06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524570, "uuid": "e4a99338-2b74-4f67-baaa-606324abe04c", "comment": "Malware payload (SnakeKeylogger)", "value": "9170d56efba8a4ed687bc11ccd1bd49e93425712488a7685f83a7e8c1fb26d6de5465c8f480a28e0d9b47730da23fd2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524570, "uuid": "5cd468dd-c4f4-4418-b513-2bba11beb282", "value": "T1C205122EFB14A721C3A987F416948944D2BC79E51796EE04AD8D31CB02FFB60CD47A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524570, "uuid": "9e0f48fa-b9d4-40e3-a3c6-657aef7aaf9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524570, "uuid": "e1bedd39-ab77-4698-b9d0-07e0ff02c88e", "value": "24576:x8yDBu0U5lBBTLzhvuNnbgFtuC29SbSv:ZBuPn/zhuutuC29S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524570, "uuid": "a01fed58-1e0a-4eac-85b8-018d709874b2", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524570, "uuid": "424281f5-4d27-4f97-9271-cc4ccc9e05c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524570, "uuid": "3267cc56-af7f-4933-9c03-cddadb039d45", "value": "14a04a051034dc2b722c0a3ce5bac9f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa9fe59-d20b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680518046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518046, "uuid": "0ed4551e-441d-4332-b46e-7d6f2f3450ef", "comment": "Malware payload (AsyncRAT)", "value": "ca38aaf8ede575784e240b6f2ea5c948", "object_relation": "md5", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518046, "uuid": "196eebe8-0b39-4c02-b967-113f9b0b032f", "comment": "Malware payload (AsyncRAT)", "value": "8501de3d3e0cb356f11439fc0425a60e8aefd8c24ed7015fffff4334d63e962b", "object_relation": "sha256", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518046, "uuid": "8a677f82-0105-4fe2-ba31-f249917b42b3", "comment": "Malware payload (AsyncRAT)", "value": "77aac617067526993329f6dcb76446f62b658f06", "object_relation": "sha1", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518046, "uuid": "e786bce3-30ca-415d-8fb8-cdd8b883b4af", "comment": "Malware payload (AsyncRAT)", "value": "e310d629caaaf4292f47115ab1f304851d417ae05809235fe46bfad0618ffc9fd2d4c6ba920f52c3b9d6be6819244824", "object_relation": "sha3-384", "Tag": [ { "name": "185-81-157-209", "colour": "#3F0CAF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518046, "uuid": "9f28d687-26b6-4912-8af2-229c10c6be08", "value": "T1FF2400646C66C99AFE8DCB45B068FB93E03131A365C80B32136BB104D6E9FA5BF4D14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518046, "uuid": "a8fd4b16-4986-4027-82f0-26a5f00191fc", "value": "3072:QTPTwLhFrOBsc4VsTKkcU/DNv9O9dDp5+NYuK5sj315j3Apx:kwLKpKkcUbNv9OPpYNYuKq315j3Apx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680518046, "uuid": "7bd37cfd-ae63-4375-8fb4-d3d3045b9044", "value": 224027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680518046, "uuid": "895811c8-d465-47f7-aebc-54521f4c6f37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518046, "uuid": "4251d604-41e3-4170-914b-a86c86165804", "value": "Microsoft.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc1edc5-d1fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680512728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512728, "uuid": "8367b73e-3ec4-49f8-b00a-16593d248b95", "comment": "Malware payload (GuLoader)", "value": "d7bb9f4381a205a3602506e87ea11e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512728, "uuid": "5f4eacc9-d428-47a6-a051-7e32588f9457", "comment": "Malware payload (GuLoader)", "value": "852a409d12623a45b48954ba63888c81a7ac3a4c36550eb8a0aac1307f542ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512728, "uuid": "7122d090-4b8d-41ed-9359-15aee7710d02", "comment": "Malware payload (GuLoader)", "value": "3ffb8b762e6cb60247e7380b3c55779af1bdb04f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512728, "uuid": "9e6e222b-ea8e-4dfd-82ca-2fae1126546f", "comment": "Malware payload (GuLoader)", "value": "47555acfa944d62f793ef45f0b4ef9032cfc56273aa26af4fcd11485bf82774cfe7abdd79fdebafa9e8b9e468bae4551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512728, "uuid": "617174d3-8e4c-4dba-bfdb-9af18cd36b3e", "value": "T1E7A423C262688E27F6B331732CE67A2547F3CE255451418F5BC12A4FB9732D1A22B2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512728, "uuid": "fdfa2443-f682-4726-a869-c620efb839f3", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512728, "uuid": "dd41ab84-e6d9-4af5-a2dd-6deed4f18e5d", "value": "12288:P4rQNPvtoUTH339UZiplvgps30O7Gq8PXaTbvjf7Zi:eu39H9kIV7NUXwbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512728, "uuid": "50a58574-bd74-4d0f-87b5-6f0207bfa5d5", "value": 453824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512728, "uuid": "d227499d-3896-45de-8037-58330ca9c10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512728, "uuid": "73d53dde-35ee-4668-ba4d-4e39d1143d84", "value": "receipt (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98a0b9a-d1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680488320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488320, "uuid": "37e6fe18-ff82-45fd-a25b-b967e35498cd", "comment": "Malware payload (RedLineStealer)", "value": "2ac0ff27c872b8b784d31027f05d44cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488320, "uuid": "09acdf01-457b-4eeb-b202-23232931dd19", "comment": "Malware payload (RedLineStealer)", "value": "854868444936c104865264145a8f00147741a523d666fe7e503324ca1adbb4d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488320, "uuid": "ba6fc4dc-8b2b-4002-8988-5258b8b9dda2", "comment": "Malware payload (RedLineStealer)", "value": "e8fa3f7dfd40bfc23935fc5ea4566c76b69f506b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488320, "uuid": "718ffedd-e879-42c0-aad8-3a6d826b758a", "comment": "Malware payload (RedLineStealer)", "value": "ee5cda37a6687a32cce81679020a3d95065d455d21567d235ec8c4443c38e17e52197610f963886a32263776010b8d64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488320, "uuid": "e8d5623e-5b2f-497d-add9-3604261190fc", "value": "T17D150BD779B79993CA2C0235E4D5CC365AA8CD9C6683E73F25B41BE23013385AAC17D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488320, "uuid": "bfad1918-2f3e-4322-9bd8-eec225d40cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488320, "uuid": "c9512730-163e-4613-9a74-da7fdef9f678", "value": "12288:lpMIQ1ZFhNpVxd5lvhZUiCTa1iHbqKpvlMyMtip8+CjLDAHQEOh24s2:lEhWqKsyMPDIQEOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680488320, "uuid": "81f41b8b-3db3-4462-b6c5-eddb7122bff5", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680488320, "uuid": "6420b865-d38f-4559-80ca-6f7986468578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488320, "uuid": "bb3a53e0-98b6-42ef-a0b2-b40c3f662fb0", "value": "2ac0ff27c872b8b784d31027f05d44cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18ec94d-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526586, "uuid": "ec06fed2-b4f9-4e1a-85c1-92b9c7a7871f", "comment": "Malware payload (Gafgyt)", "value": "e07aae3187fc14c2c2e2d8fc35828f5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526586, "uuid": "2d79b607-3344-4a2a-8357-f5abc25f90df", "comment": "Malware payload (Gafgyt)", "value": "861c8e84ac366991b7f4b4bf0fc6b941c74a7939dc8fb2f3bb768bb5a0ff063e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526586, "uuid": "e24623b4-84b2-4c2b-8447-2e70fd6a8cae", "comment": "Malware payload (Gafgyt)", "value": "dd77353db432fb13ce4443451ff2c316c06078f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526586, "uuid": "1310aaeb-7bf5-467a-956a-798d92893df2", "comment": "Malware payload (Gafgyt)", "value": "6f8fd918134d9e9bcf2a2f2997d2e8ce01c727c6c14a1e78017f78ab79fa502ded67a883d722df4ade00d4a0aee6f1ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526586, "uuid": "df4d9ab8-4c9b-4e8b-9d4a-4c49838af628", "value": "T19FB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526586, "uuid": "f0ba34b8-cf01-4a54-ac17-446b856cc3c5", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCrB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mjw0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526586, "uuid": "a69ced08-706c-4b22-8087-b769d26524ce", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526586, "uuid": "cbe2a102-6900-4bb0-ac16-bad99ef49c6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526586, "uuid": "3cbc28d9-f395-4545-ba02-71db4f28d4df", "value": "e07aae3187fc14c2c2e2d8fc35828f5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4a67a0-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680522663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522663, "uuid": "7c73e64e-e0ad-47ac-9c28-2d224fbe6b73", "comment": "Malware payload (RedLineStealer)", "value": "2b32279b4b3c878f77df05d85399d4d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522663, "uuid": "3110daeb-12b3-490a-a8be-76167b65d5e1", "comment": "Malware payload (RedLineStealer)", "value": "8679d980324946ca935c97d8fe0634f2ee769697c34bf3b3d8f68aa3f5785144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522663, "uuid": "be2cac0f-3bf6-414e-bfee-fb4196dcd7e8", "comment": "Malware payload (RedLineStealer)", "value": "919743b3f212d81c36e279baaa71b4554094ae23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522663, "uuid": "932691d0-969b-4ed6-bde8-af04da6f2b20", "comment": "Malware payload (RedLineStealer)", "value": "b2a5bfba77c61ebfbbcb17240d4f6a2f57c09e2808f2687c25ac75b01abe7c0407ccc3deb7e0263e5b4a0b22b1c7dc11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522663, "uuid": "b6b40bb9-4d1b-45d8-9440-c4b1d515f58d", "value": "T1D7E4129663E09172E8F56BB068FA03D30A31FC515974873B3746AD1E5CB26C0A97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522663, "uuid": "73b2bda4-5f98-4a16-9b60-247322a26454", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522663, "uuid": "ca76de71-c926-48b8-b982-b4a0d226476d", "value": "12288:zMr6y90JUkrWRuKm304a2aV/GIy5weZBCqA2Rhm2qnz8GyGNpjFbj:dymRKRuKma2Q/9y5bCqAwm2qnQGLpBbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522663, "uuid": "5193f429-ab61-45de-afc1-a195165a7e90", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522663, "uuid": "c5faeba0-976f-4dc5-8bb4-82cfdba1ff20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522663, "uuid": "88d7c9ca-f1b0-42ea-8fad-12f44bff2144", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081a25dc-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496129, "uuid": "b1432b3c-e1d7-46de-91a3-865af382c421", "comment": "Malware payload", "value": "8511f104795db9684070c37f75b6cbcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496129, "uuid": "a48dad2b-27a4-4cd1-ae1f-1f1e0bb3ef58", "comment": "Malware payload", "value": "869830bc824202f554fb00c566c0b42b1260cd4a0551c7294d99d3b2178f4f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496129, "uuid": "38dbdc2e-7140-436b-81f8-5821c6b27186", "comment": "Malware payload", "value": "513a87da3a27d51d65670f12776e9afb28958151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496129, "uuid": "97b779ba-619a-4f14-9a44-c3f687d12cc2", "comment": "Malware payload", "value": "0ce89205a501108dd734ad0876131db62c75e9de252aaf3476597b22c87b04de1af211942d79cc6924928af90f9f0d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496129, "uuid": "8779b046-ab7a-40e1-8077-8daa8f321c3c", "value": "T1B164027826A8C6B6C06D0C31C4378AF42A147C9BC5661E0FAAB6FF5E3877291F504C9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496129, "uuid": "faec9018-974b-4714-85c5-bfa18c1064f0", "value": "7412403a696af7734366d6d759654a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496129, "uuid": "9c6aceb3-b06c-412b-9ea0-64a210478362", "value": "6144:6RMhKavxHzcyzbNVZPV1HyM+8dPMBYruy13X9WinFaXg8BBr+Be:6RgKavhzcyfNxptPj913XjMTBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496129, "uuid": "98d87ae9-73ff-4a92-beee-0f32b4ac5696", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496129, "uuid": "b4af9e87-bd06-4758-8eff-194ee1afb300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496129, "uuid": "c4da0f59-ec2b-4747-8d9f-1294806675b0", "value": "SecuriteInfo.com.Trojan.Win32.FlyStudio.AA.16786.17521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8113399-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526543, "uuid": "93e11f51-2d2a-4b25-af61-fe8a9ff64341", "comment": "Malware payload (Gafgyt)", "value": "5a49883ec0d51b62832cb1c18dabd04b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526543, "uuid": "834638f6-25ea-4233-bbc9-e250e63fe066", "comment": "Malware payload (Gafgyt)", "value": "88cd5fad23ac85b168288cbfe70f6267fb1a9db78a322b5eafe0bf7c769b178d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526543, "uuid": "b6969ea3-ecf2-4653-904f-85eac587f608", "comment": "Malware payload (Gafgyt)", "value": "2977b946fcfc2200a7305bab50460473e55195f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526543, "uuid": "ec8e195a-f20f-465a-abcd-0fd7b5b9088f", "comment": "Malware payload (Gafgyt)", "value": "b30dadfa1000e29c053ab2d24018eb71b6eb548d2862af3d1da39d65e72fa4b2614498120ae59792a33e53806d9d6202", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526543, "uuid": "6a04494b-fa53-424f-acbe-08da3d550e52", "value": "T146B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526543, "uuid": "b8c2a7ea-b6b3-4de9-9f1a-39b0a4e325be", "value": "3072:WD3l+XQzPeV91310pWudgKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCgypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526543, "uuid": "b636d06b-ef7a-4bdd-9715-c5dadaedc30c", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526543, "uuid": "c310655e-8299-4c80-9793-4a79d6fba73c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526543, "uuid": "78963925-3214-4086-a7c4-26ff384f09c4", "value": "5a49883ec0d51b62832cb1c18dabd04b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e81628-d231-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680534507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534507, "uuid": "130ee38c-8af8-496b-80a9-069cfb1024dd", "comment": "Malware payload (Mirai)", "value": "e3f348cbd009c59617e83eca9d80e19d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534507, "uuid": "d9dd8dda-2b38-4dd9-bbfd-bcf5219e3ca2", "comment": "Malware payload (Mirai)", "value": "88edfa4e691949a347e5db4fc570e0ec99235ea2058dc292d9a444b19e07175c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534507, "uuid": "7af31811-d883-4df4-8a8c-44cbfe837c2b", "comment": "Malware payload (Mirai)", "value": "9cea60a3e4ea2c4fe59034de0a0f6e9ff8fab112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680534507, "uuid": "7b312a4b-9f81-479b-a3ad-6a464142c5cb", "comment": "Malware payload (Mirai)", "value": "58872ec5ae0316fae9064511ee3ee0e243bf3a157d489ee00309cff1b4095cd68dc7fd14267c8d6fbc77203a697c9429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680534507, "uuid": "4a337ac9-a5db-48b6-9986-d4d196c59940", "value": "T18BA2E12172632E65E3EC1C3CC96A8357FD671BFC80F532B66D412520C94D24A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680534507, "uuid": "1e7e97b5-77bc-4f86-aaba-8606f9be1b73", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjpJhymdGUop5hW:vvQn4j+ZO5fKAlx9Js3UozQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680534507, "uuid": "0d3f8ac0-bae7-4b2a-9821-ae59e72926b4", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680534507, "uuid": "fd5a329a-b32f-4fcf-84d8-74fa1ea52a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680534507, "uuid": "50c06a5b-cb58-4993-aa49-9f2910b60137", "value": "e3f348cbd009c59617e83eca9d80e19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efafa24-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501295, "uuid": "776c67a4-2067-43ca-a00a-d33174f7e7e9", "comment": "Malware payload (AgentTesla)", "value": "2d1b7ae625fc27c4a7dd90333be85783", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501295, "uuid": "47f5375a-2bc6-4394-b5cc-56e5c03aaff4", "comment": "Malware payload (AgentTesla)", "value": "89b26887cf47af7365dfd7fb75252fb86badd55bdc8d87829efd7f63803d1029", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501295, "uuid": "e042cc4f-b808-4392-9a13-3aadc53af6d8", "comment": "Malware payload (AgentTesla)", "value": "bd3a4984c6f9c8d692bed48ca504057fc06e1f31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501295, "uuid": "487f26ef-15c9-454c-acd3-fd726ecec8c9", "comment": "Malware payload (AgentTesla)", "value": "a3e7f9f4d3c84806127991070190fddac7ef40499557f9454174ef128e6ae30cad1702fd85e78dd8b47a6c4cb51d3c8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501295, "uuid": "d6ed46cf-2572-41e7-965e-f5cff57335d2", "value": "T1C0A42359E2C1976BE92F3F307AE654F683F1E9067960E50E0DE8F8489436BC4E5203D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501295, "uuid": "9a452c13-a176-407a-afdd-905d478f0b1f", "value": "12288:OuVozphT+QcwZgDRVsq5Luy3izuxwbuEoTrT9Fo:OuVoFhT+TwZRYLueizu33RFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501295, "uuid": "5c3ce240-0bed-40d9-a8f4-09db26c173c9", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501295, "uuid": "0ae1e20f-e7c5-45c7-bdef-74ada3ea8612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501295, "uuid": "2bb1ad09-f442-4c6a-bb20-ff785323ab7a", "value": "Bank Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b5c8c4-d220-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680527416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527416, "uuid": "1988f928-641d-4357-8268-3002558dc077", "comment": "Malware payload", "value": "71f828098d51e8a44ab6401752d525af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527416, "uuid": "532425c8-ec6e-4426-b52e-596580788461", "comment": "Malware payload", "value": "89ef151ba9f1439e06ac9655c47342de1fcf370c75f3a4d5b1184346c47a1bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527416, "uuid": "b34d1f9c-0d2d-4e7d-933a-6f665c4651a1", "comment": "Malware payload", "value": "98ea1a1b529400a6b6b77131a09e6645f64983c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527416, "uuid": "d625be5c-db96-41d9-ad49-709fcec7e9bf", "comment": "Malware payload", "value": "0e56145e6966911acfc1fae1041e36f8000e2d4bb43d678ddc6649cd6362c122d96c2276683da902e3914b9bd91eaf3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527416, "uuid": "d31e81aa-fef9-4764-a1da-b8723970f001", "value": "T1EFC4F1246BAB1739F53657BD91D426919B2D77F23B07C84D18B112CA0B67B039AC0B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527416, "uuid": "c751b533-cd3e-45a3-84a6-a444e298f56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527416, "uuid": "14ea3690-2ec3-4584-ab08-363e0509199f", "value": "12288:FPNmYMUnFW/NdbQmSuurBSmPSc6fvvNtAFVW/ktUTH:FPNUjVSu4tz6nvNtXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527416, "uuid": "ff468241-b6df-4447-a8d4-10487f9bedc8", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527416, "uuid": "80503907-3af3-48ef-8358-95b7efce146a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527416, "uuid": "5194ff84-edd3-485e-a2f3-ea3ad1f89e91", "value": "89ef151ba9f1439e06ac9655c47342de1fcf370c75f3a4d5b1184346c47a1bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93a066a-d1ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680505983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505983, "uuid": "b036b071-d833-433b-8d97-35f9845ba2c8", "comment": "Malware payload (RemcosRAT)", "value": "4788db864dbc6fc210575f437f37bf02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505983, "uuid": "589aa597-b21f-4bcb-b7a8-46fa05c6e7d3", "comment": "Malware payload (RemcosRAT)", "value": "8aad378acd6bb2912809751007cc762facf7eefcc867b5fd8ace1e1728329c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505983, "uuid": "59c4b707-afa2-4dbb-82e0-a282e8857166", "comment": "Malware payload (RemcosRAT)", "value": "177132e62ecf79da98e5e320aa04e156f6acffd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505983, "uuid": "5d45acf8-c771-43db-942f-2fd0a96ae25b", "comment": "Malware payload (RemcosRAT)", "value": "5df050317cf9361cdfbade955c684982ab471c4edf052a2e753c42ceacb832996c099ad685ff1f0ac21db6b0deea2b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505983, "uuid": "a71395fa-ec03-4d0b-bb26-3bdc2a952f7b", "value": "T194152259316A9A6BCE7D0BFF95210506477EA932B626D7CA2CC838ED1BD7740C401BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505983, "uuid": "409f41b0-4d76-463a-b0be-cb87be5b176f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505983, "uuid": "8dcb0ed2-f28c-4c0a-9de0-edc2c4f7aa48", "value": "24576:vqt2jWnm5bZVLablxrbz2mAkW0MhioaeCq:vs2jSm5bPOrn2VwkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680505983, "uuid": "ee5fc8d1-b188-4ede-8461-0f694bce50a9", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680505983, "uuid": "2a64ce9f-6498-482c-88d6-56c96bcd76d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505983, "uuid": "c816e832-7672-4fcc-8fb7-1e45706b5ff2", "value": "Shipping Documents PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bd3b3c-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525549, "uuid": "bad5233b-8dd9-48d1-8648-36221e823677", "comment": "Malware payload (Mirai)", "value": "ad7b92ae4863cc0006443b5e44381fad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525549, "uuid": "79de6e81-2116-434d-9ea6-b4503d50e43e", "comment": "Malware payload (Mirai)", "value": "8ad58fb3ef0c76f48922d246bcabc078ab0380a98715801c29723f93cf70e4b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525549, "uuid": "423fe989-b38a-4214-b8dc-1b5bc46babb0", "comment": "Malware payload (Mirai)", "value": "e72115968b6f2f67c54c698c173dc458528ce93e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525549, "uuid": "c6490fbf-698d-4de7-9621-26a0707755ba", "comment": "Malware payload (Mirai)", "value": "83bdf5968d5df5a01436a99590d2e5debaf77ea3b97e0fd1989341f47b5db6d5fb5430bad299a2c00d3ce2cfd677fa5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525549, "uuid": "27ce8849-1d77-4d3e-ba03-3b16d93f9f3f", "value": "T1D133FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525549, "uuid": "812fb2de-25d1-4224-b1fe-9fd7d1eed809", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGD:r/hqaJMcjeqK806MHdMfQXoHuCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525549, "uuid": "fefe4286-5331-4c9d-83b1-e43cf6ad5238", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525549, "uuid": "1f9a26f7-d12d-41c6-b8f3-5104af4ca2a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525549, "uuid": "002efa9a-d22e-4cfb-ac56-f78ac9cd2947", "value": "ad7b92ae4863cc0006443b5e44381fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25288ad6-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532256, "uuid": "bd0a4b9b-255d-49e4-8865-46e899dca5d2", "comment": "Malware payload", "value": "61e47559924ea22caa33480a69cd3e2a", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532256, "uuid": "95c6fd04-49c3-4763-9b27-1d39b4491613", "comment": "Malware payload", "value": "8b5c47d81091836987c47760eed856554c4a9bfd99ccb0985f560d245ae3bd2c", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532256, "uuid": "f6e01fe5-e1be-457b-9b8d-b1880feb649c", "comment": "Malware payload", "value": "90e8c078297b4b91a0d89b70099304e79bd94949", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532256, "uuid": "a09a5a4f-6177-44d5-9be3-6a244482e2e9", "comment": "Malware payload", "value": "6568952846b73f3dd31cb3ed52500d994fd3807e7f3fdec3f43930232644fe3c81bf20c5cf65f943820faeb0ed81bd98", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532256, "uuid": "20fa3b32-e11e-4621-a5d0-0e3e3e48447e", "value": "T11445C0C49BACCA9FE69F3276E0D58981D6B5C585BBD3EF0B085125E23F2BF846500187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532256, "uuid": "45285f02-91c2-4800-b130-cbca35ae1301", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532256, "uuid": "26129334-779a-40d9-8188-6fc19028820e", "value": "24576:xfiEn8u2QZS4zefooEjt2xaYN66X0thlvDhdaa3:xfi+2Qs4zefoPjt2xJN66XQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532256, "uuid": "b1f86b5d-3621-4a11-b19a-3ff79066eb3f", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532256, "uuid": "65f12642-1dd8-463f-b403-4f3f45f5dfa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532256, "uuid": "7a6fd408-f662-480d-ae1e-262bb9cf2064", "value": "5139d258d2b48a755ef65b8426385c08d88b5ee7888b869c00d1c216263322da.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d2b545-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525378, "uuid": "eb3ab742-2e97-40f8-b7fc-1855c9936af8", "comment": "Malware payload (Rhadamanthys)", "value": "19c251a15441b89406bd810981e899e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525378, "uuid": "3118ddc4-e6c5-460b-b690-61f1f46d4ad2", "comment": "Malware payload (Rhadamanthys)", "value": "8c6ec65dc37f6a3bce309c19a5f1842e501fb136336e6a4d4c2d8bac680ad4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525378, "uuid": "4c583841-001c-417b-95ed-4b15772b3661", "comment": "Malware payload (Rhadamanthys)", "value": "420146f8d3cea71dc6b4f074ac130eee7b9e29c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525378, "uuid": "81abbeec-cf9f-4225-a38e-e2a05101baa3", "comment": "Malware payload (Rhadamanthys)", "value": "e6a00fddb51aeb22f0c5ec0cfa7434be0fd451ccf9ef76ad921ab1bd2100a71628209ea2ffed893f0d6d7d9e6ab69067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525378, "uuid": "ddc497fb-c817-4d22-a190-ad601622a338", "value": "T1CF64C04267E0A870E51257318E1FC3F5662FBC61AD25BF9E2B45BEBF09341A1C222317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525378, "uuid": "120cf3c8-dcfb-402e-b5e2-6c5567786896", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525378, "uuid": "ba358c1a-3af7-42bd-9854-710b662d3c20", "value": "6144:CH1OX1kUJ22+moWobLYJ/v8/6dQZG8JGsscTHZtkjt:CVOXiUnoLYJXInG8ksjzGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525378, "uuid": "ab250af2-4b08-47dd-9bd8-9f51c9b4720b", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525378, "uuid": "293105ae-9f61-4c72-9e67-5e77d7dfb69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525378, "uuid": "59725dfe-6d6f-409d-b5ed-e92c4eaa8690", "value": "19c251a15441b89406bd810981e899e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f06928-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525033, "uuid": "7319d5d9-fcd2-4147-ba41-38985b6abf32", "comment": "Malware payload (AgentTesla)", "value": "d6a0f266af6256e651fb1d305d63813f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525033, "uuid": "f0f36baf-63d0-4d01-a809-b92f2b861bd5", "comment": "Malware payload (AgentTesla)", "value": "8d91eebd02da6d1dbfbbdc7dcc38fb60728f8385b502c8429b6e21803e75b116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525033, "uuid": "8547081e-f91c-487f-baa8-04cd73cbe7cf", "comment": "Malware payload (AgentTesla)", "value": "29ca9d8f85a8eaf252c05416caa671f9c1a3e316", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525033, "uuid": "1c7f0d2e-8492-475a-91ce-b868cd7726f0", "comment": "Malware payload (AgentTesla)", "value": "6f249e5159a423409bb534177966ae60cb7a6e42bb3f2ff282d9740f00de74173f616b077c007e3368e846807a87a6e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525033, "uuid": "0eee401f-5885-44d3-9c52-54d831fb08a8", "value": "T10FF423253518BF3ACE3A07FB8153672803F5A91BA523E3BD1CD754EA6832B698543C47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525033, "uuid": "07557eb8-7cf0-471d-979f-03d351dd6d5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525033, "uuid": "b1848bc4-9b56-403c-be58-d34e7fd96c9f", "value": "12288:W5CBWKdq1FbwwJLwrMljbtrppmZyOzl/mZBIMzxm+kCO5Jc20rfb1FRqttaqua:JfrpsjUBZOLISxmeSq/3RUtju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525033, "uuid": "53735c08-5c9a-439a-9400-e61859bf1594", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525033, "uuid": "17b1a66b-c576-48c0-9196-d288a33253a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525033, "uuid": "5ac8552e-4331-4cf9-96ae-d60a8ab8392b", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131 (8).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b401dd4c-d258-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680551393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551393, "uuid": "6be5f2e2-872c-42f4-a34c-ba081d583731", "comment": "Malware payload", "value": "98430990ab9bb00895d4c32756892491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551393, "uuid": "4b4ecd9f-8089-4a94-9f24-e43f0e7155e5", "comment": "Malware payload", "value": "8d98fd823a1e94ab202a53a8b3b7f93a0a0abe4e5f870c87c2a6346a418f7c36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551393, "uuid": "3424f9e0-a631-4abf-9de6-ac497105a7c7", "comment": "Malware payload", "value": "8b6b3d4294812d70c962b5b34972bccbfde26b0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551393, "uuid": "bb650987-bbfd-4d4f-9071-8d2aaf73700f", "comment": "Malware payload", "value": "70eaba395a3295a67b9875cd65315e3b52ee838fc646a1055276b349a9c1eaa4c550b6733da4f1c7efc06fbb54b5aa06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551393, "uuid": "ec94324f-e110-44d1-b9fd-19caffef75df", "value": "T119A3E8B2F401DF66F48A967608D34A246E70BBE3CA532626633735F69E721D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551393, "uuid": "568622db-9586-449f-b244-38ed67057ba1", "value": "3072:BvcZJtVKnD1b0ywGuSxSQKDvFmuxVqDy78fzte:BvcZJtVKyywQolrFmuxVqDy78fzte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551393, "uuid": "67709487-5370-4d14-aca6-b78887958b52", "value": 107417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551393, "uuid": "acf1ffd2-77b8-4e13-973f-0877e984af2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551393, "uuid": "cb312769-2ebc-48ce-96ed-e4327f02d73d", "value": "98430990ab9bb00895d4c32756892491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60a13dc-d1c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680487804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487804, "uuid": "13014875-4f01-4bf2-b966-bf0426e79faa", "comment": "Malware payload (RedLineStealer)", "value": "cf3ab9ffe93224da75e1bf3eae94f47c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487804, "uuid": "2b74673c-68b1-4207-90e2-d9122430b840", "comment": "Malware payload (RedLineStealer)", "value": "8df68b244c802d435d93690793a8447a5cafef7d996b91f432c71504f1929b27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487804, "uuid": "99a7d450-6c6d-4ed9-acb1-cfb1d967f061", "comment": "Malware payload (RedLineStealer)", "value": "636e35dbfd26028c3d203f353df3d1fe1e250cd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487804, "uuid": "739cd53d-ff88-4e8b-b24e-bd2c10afd51e", "comment": "Malware payload (RedLineStealer)", "value": "e86d7bd3df291bd453b662f750a6638ffa9e87d638e01292eb404b61811561f6b29b6e0c3d63c47a9315e267202f023d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487804, "uuid": "2bba7772-1e6b-4c74-a587-ac7761a4084b", "value": "T159C41203F7D86062E9B5277038F602D31F36BEA18978926F2655951E28B26D4E47333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487804, "uuid": "ae1a1416-95a1-4067-b786-191907009317", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487804, "uuid": "fb826e75-b300-40d9-a559-3cbc0eb8269b", "value": "12288:RMr8y90SxsB9MlWCBZMNnkjIIUNGHNw1rPk7CJwOd7:RyvZlXBGejIIztw2CJ9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680487804, "uuid": "44a1be2e-beea-43d1-b4e1-ffb12eeb1577", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680487804, "uuid": "7c142433-16c2-4a4d-8457-7069eaefacac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487804, "uuid": "4627d1e9-f465-40a0-bba8-0b953e908110", "value": "cf3ab9ffe93224da75e1bf3eae94f47c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1252af-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501320, "uuid": "a1a0fda8-4a84-430a-b466-ddc8c8b55087", "comment": "Malware payload (Formbook)", "value": "5ac881ec7e3e315c84979c148ac1d509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501320, "uuid": "a5283484-9a3b-407b-bd11-8a4d40c150f1", "comment": "Malware payload (Formbook)", "value": "8e067a63005c0cb62a0db614acafc9e1964bfd5520c13075d04879fb2aa90451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501320, "uuid": "7d2295cc-2471-4610-b5b0-c024c08242da", "comment": "Malware payload (Formbook)", "value": "959b9a2b299a3dd48d1d9be787ca61d0fa354cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501320, "uuid": "4e037e7f-6f01-42f1-8f08-555760a2faa1", "comment": "Malware payload (Formbook)", "value": "cc409306fe94a335198a0a0cfa14eb0b76a5f8b75be9e61b078c0ebfb052a1faef4f2f06936a183916b19a58b0a9f251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501320, "uuid": "b7eb46d4-10eb-4a7f-9f43-941b9769e31e", "value": "T1F7E41204379C192BCA5D87FDD4B2910B8779AC365A46D3CA2DC879BD76F27808806BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501320, "uuid": "584acfba-6116-4c79-b597-40fa91d4fa90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501320, "uuid": "dfe8ab85-a50f-4c79-ad39-eefbac4684c0", "value": "12288:rItzLwr6ddcr8WjPOcG1sL6uswnW2l2IGqKW859gZtO/T:/WPcrlWFwZ4IGqk59Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501320, "uuid": "8f3f20eb-ffa9-4333-9676-de1a01057f26", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501320, "uuid": "254e47ea-e49e-4d0d-85c8-b80ac5903f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501320, "uuid": "8ad669be-a3ef-4ab9-8eb6-96d2decaf20d", "value": "Purchase Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02aff669-d1e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502563, "uuid": "8da4ae59-fac5-4a4b-9dc6-1daa49c53b39", "comment": "Malware payload (Mirai)", "value": "7bc2c217a01df86c6e18820f857acf92", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502563, "uuid": "b59ebd92-f8e0-402b-ad95-5d3f31df66aa", "comment": "Malware payload (Mirai)", "value": "8e39d36c240e81592cd8bdad771bb918510f8c8ac0e4f50f7af870389ae01889", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502563, "uuid": "f4edd24a-81be-47ff-a215-70f703b33c5a", "comment": "Malware payload (Mirai)", "value": "8252306c73be0b967363b20231611cd21b8ef638", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502563, "uuid": "17d34888-ef0b-470d-9255-197cb3b0cf20", "comment": "Malware payload (Mirai)", "value": "679379f13ccf5c91d9ce6ca229d7e4127669eab81ca22980162ea38bea351be3a902a09fcbf40e2142f5eb4cd4592831", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502563, "uuid": "31728d0d-502f-4df7-b86a-6d7523ce4a1b", "value": "T193534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502563, "uuid": "a8210de8-a23a-4fbe-9335-cb61adcdc068", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQ4LiKimfFoktCe3fYRMj:WShU3q7cEDlCK/0Dw9i8Fok06fYRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502563, "uuid": "5648b088-1f2f-4760-9dd8-623d1ee36980", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502563, "uuid": "ab0efd33-d46f-4944-a40c-bce186fcd868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502563, "uuid": "f07cc09f-2765-4b67-bb35-f822b1b235ca", "value": "7bc2c217a01df86c6e18820f857acf92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2345074b-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525381, "uuid": "8bb399a6-1539-446d-8c93-715ed5517f36", "comment": "Malware payload (DanaBot)", "value": "0b038f819481ba63e9adfd623c824eb4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525381, "uuid": "232155ba-bea8-4aaf-bdb1-d0e5f69e40ce", "comment": "Malware payload (DanaBot)", "value": "8eaea98a33160ee9fda2bb5ff501b6b10e176cd07ec2bca44069711d3df55830", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525381, "uuid": "c46f80d1-be96-4558-bed1-4841cd2d5928", "comment": "Malware payload (DanaBot)", "value": "f8ee7e79a1b235063883c3f2081f20ca3d0c8d3d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525381, "uuid": "77acab5c-ef49-41b4-b5d9-b5246dc4e003", "comment": "Malware payload (DanaBot)", "value": "33b997e4f9aea83897628aa014620c3051690a0301e9e0e36aea236c32fc3ae86eca8c6ce3bf72df0844c93eb3b1cb2e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525381, "uuid": "fdbb68a2-92b3-4079-b4cd-5f18eb44b8a2", "value": "T11C36338252902C66DB3398319D6AC3F4335DBC719966BED73350397E1EB04A2C3A573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525381, "uuid": "b76ab281-b641-4d2b-a428-2490929a7cd4", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525381, "uuid": "9c1d3282-ebb5-4432-8cfa-547ad2f6bac0", "value": "98304:ZixTajl6Ex8LtjV/FswY4H8LsrrBECRTUaQJW+cLPt:ITKl6w8v/FswYS8Arr9R3+ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525381, "uuid": "8ee8be72-6fdc-47cb-9256-059fe2f13936", "value": 4947968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525381, "uuid": "6885c80e-a840-4bca-a66c-c135cb6a7436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525381, "uuid": "afaffafb-50aa-4ca0-8577-b1fbaab80446", "value": "0b038f819481ba63e9adfd623c824eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2975f3f1-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680526679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526679, "uuid": "3924cf1d-7a4c-4ae3-bd63-fb4a88b2b684", "comment": "Malware payload (Mirai)", "value": "5ae296f78581c7c743df9143bbfa57d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526679, "uuid": "ea13fd04-7c92-4df1-b0ea-153b6cf22072", "comment": "Malware payload (Mirai)", "value": "8eb2abed5b5a520afb3917980056c2e60d7b55ab51722731ae634d8cbc7793dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526679, "uuid": "d3a4ec2b-0130-4278-b111-953a939a661a", "comment": "Malware payload (Mirai)", "value": "fd1845d5047352a6a8d4a6a4b3941a076973526a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526679, "uuid": "3cebd1bb-b82a-4a07-aca3-659b7bec65cb", "comment": "Malware payload (Mirai)", "value": "747ef7dc46c3a051071874b263efcd276b6235b11d8dd45efc6f78c3b529bb6ccc9ac8c4e064054dad936f6697566949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526679, "uuid": "57436be5-948a-497f-80eb-880621d9f459", "value": "T12FA2E11572A32D55E3ED1C3DC8AD835BF9A61BFCD0F5327679405620C94D34A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526679, "uuid": "976e62a1-38da-431c-9d2c-1b510f162840", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjIip7whymdGUop5ho:TvQn4j+ZO5fKAlx8ip7ws3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526679, "uuid": "a3761630-ed86-4cde-90a7-dba9f39fd8bc", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526679, "uuid": "cbe37ff8-2a26-4412-9c83-8880930efbd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526679, "uuid": "8a4aa469-ed42-4cbd-a535-7fafa85cb9bc", "value": "5ae296f78581c7c743df9143bbfa57d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4580f8b-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680523074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523074, "uuid": "1110a920-9ae0-414a-ac72-36eec26e17c8", "comment": "Malware payload (RedLineStealer)", "value": "8d8a41e4711850f5d95e97684d65a6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523074, "uuid": "fd71d341-60ee-46ea-8c5d-ba95366e1b02", "comment": "Malware payload (RedLineStealer)", "value": "8ef9aa73a59ff501ec3bfc81d7057573cd425bb1e416a0259366fc2b8928c101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523074, "uuid": "f2240f81-ebe0-4986-9715-56d54b2fa022", "comment": "Malware payload (RedLineStealer)", "value": "313f280b7ca366763a09c23d5e387e3129cd947b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523074, "uuid": "ba8b9ae6-70d2-424d-9085-31f3c3ef1a1c", "comment": "Malware payload (RedLineStealer)", "value": "3870dd928fe8ce2dd8d5334fd72ab2a70bfdd991cd0a55843a2f3a006c5ffd99e1e158342c40fea19fa1dc1508c495cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523074, "uuid": "f4290b80-688e-4c9f-9134-9047579740e3", "value": "T1EDE42262B3F9D432D4B017F058FA06D30B357DE6687042AF27566C4A2C72BD099727BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523074, "uuid": "cf13e5bc-da6c-4475-b1be-2ad25883a366", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523074, "uuid": "196c0b4a-9016-4648-aa95-f5cd26c2760c", "value": "12288:rMr8y90ooZgZAL3GfvUZoSS7h+F7lfl2qEhm0Lk/sL:LyL6PL3wJ2vfl2qEhmrsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523074, "uuid": "b2d57ad0-d014-47f4-984b-5219066d67d9", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523074, "uuid": "71aadffd-983e-4073-99fc-7f2ad6987065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523074, "uuid": "ee2630f2-60a9-41a4-a6ca-847d00367d70", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2450acef-d220-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680527100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527100, "uuid": "44fbd6f6-1c51-4d94-a288-bc42c0e4ceca", "comment": "Malware payload (Rhadamanthys)", "value": "d74f3270099e841625defc0c7a3656f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527100, "uuid": "ae5a469a-ee18-442e-ab6a-7ab5a6cc8c12", "comment": "Malware payload (Rhadamanthys)", "value": "8f3ac756feb4f87207e228da943e9ae2e02f91b9bc5ee1facad58de5f4c1d820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527100, "uuid": "4555f738-f3f3-4ecb-813e-935ced1e29d9", "comment": "Malware payload (Rhadamanthys)", "value": "e05a443ee4e100effb1c7dd3855ad8a13f229769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527100, "uuid": "9aeca8ff-ead4-45c7-a6eb-eec1d9928e34", "comment": "Malware payload (Rhadamanthys)", "value": "cef37d795b37de0b58204666f8725de232b78c74e40c935058b0da4a1bbbfcdd4ae6a8c1b90e674a0b351cb8063807a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527100, "uuid": "58bb9ce6-4b32-46c2-aa9e-e59f92727b88", "value": "T1A506236312763046D1D2C83D8A3B7EA431FF137B0B82DA78E5D6A9C524329E5E293D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527100, "uuid": "b0d98891-165d-474e-9c69-aee1ff4ed155", "value": "6ba2354715fb6abc487d39b692c97168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527100, "uuid": "159f2f8c-0678-4eda-ab9b-1e5b7718c57a", "value": "98304:2LruVBlRV18TGJWqfuIedS+EGpF6bX/4Y/XWhUNe+M:4uJn9U/EGibP4YY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527100, "uuid": "2b3f2a96-cce8-450b-a933-189ded1fb005", "value": 4006912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527100, "uuid": "4f618d67-501a-436d-808f-20238ca23f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527100, "uuid": "cd463c5c-a738-473a-a2b9-83a9c67b4ca3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77789d4a-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680522515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522515, "uuid": "a97f7db1-cff5-43b6-af23-1321c8c3a9b5", "comment": "Malware payload (Smoke Loader)", "value": "0e0f1d392c187051367c45706b6bdb25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522515, "uuid": "e7025940-13a9-4e33-9292-e4fbeefadddc", "comment": "Malware payload (Smoke Loader)", "value": "8fa55ca5d2455bb6d249defb06a46d5f7e7b73932cdac04344d5cffbaa9a56b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522515, "uuid": "c59fae67-c9fd-4fc4-b1ee-86b0b95c2943", "comment": "Malware payload (Smoke Loader)", "value": "7beb096f9f8003a33045fe9d27b681dd8181c29d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522515, "uuid": "3e3cc025-9870-4538-ba8d-73d67f9a1a3f", "comment": "Malware payload (Smoke Loader)", "value": "0b87110c407d0f3847934bccd4ab1482e06bbb80294df43a7899106f3b56b268446999ae0a552bf2c51898f1ee9986cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522515, "uuid": "43924f25-8738-4ecb-aece-7b5c2d268ebf", "value": "T11D64AE4257D3A870EA134B324E2EC3F0661EBDA1AE167E9E2745BE3F09341B1D162717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522515, "uuid": "9a102ca4-aed7-477d-bbb0-7c3d7f78f3e3", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522515, "uuid": "37ad1034-9470-4aa0-84aa-9a972bf38af7", "value": "3072:jvHh846f0aFSBR6CDpC73v3AOJzcQIj1Sv6JU8A7mNFky7xBY2+3oPpPZtkjc86:jKnffMBRwADjIy68ACN7PyI9Ztkjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522515, "uuid": "22382a59-1bae-4ff4-b1fb-041a3f89e3b7", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522515, "uuid": "70463441-63a5-4110-8c4b-47f0efd4fdc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522515, "uuid": "12742821-609c-4d2c-b6ec-bcaa01f169f0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102ba9e9-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496143, "uuid": "5b2799f4-d0df-4ed5-acc3-67b6f15cb9f6", "comment": "Malware payload", "value": "d4656dccb5268f4cfccb8ad587e18c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496143, "uuid": "74227e34-159b-42e5-afe4-1ba673e849c4", "comment": "Malware payload", "value": "8fe3f37878ac4843e8929764d04ce27634241426ea125fa2f674a42eb01c231b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496143, "uuid": "73a2df9e-ab95-4962-b972-03aa00aa6f6b", "comment": "Malware payload", "value": "00b0bdabc881eef25d5843a3b83060a953640efe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496143, "uuid": "8feea9b9-7505-44bc-b9c7-d8ca4f97575b", "comment": "Malware payload", "value": "14f1d479fae4853690f2fa6ff24a14901fb51f6d704edad92f809b36244b8cb69b399ced8d1080aa69ada29ee10b2565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496143, "uuid": "e8e13b5b-a763-4223-867a-d2592af58f95", "value": "T10D146B42A7D05822E9FB27320AB592755FB7F8B45A3898CF05947A1E1DB0390CE173DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496143, "uuid": "8e30d89d-bb5f-43cc-b0f8-3cfa4518d7ce", "value": "3072:eZ8xG2I8sPZzXVTMpLDMTI1D3hXPNX+Md9:A8QhXVc6I1lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496143, "uuid": "8328ce8e-8c73-4d90-8ff7-2d22a32c553d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496143, "uuid": "3c62b6f6-99e2-43f0-8ce7-55c8539351b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496143, "uuid": "2b70050a-40ca-4beb-a7a9-386e92c8fdf6", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1317239.3790.27234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efb3c99-d1e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680499630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499630, "uuid": "bce9c0ed-1b45-4b10-b20c-23729beacf9d", "comment": "Malware payload (AgentTesla)", "value": "1563a5093416c942b8e57455abcef664", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499630, "uuid": "0583e93b-76c2-4d68-acd0-a419b9d1080e", "comment": "Malware payload (AgentTesla)", "value": "9072096046bf04b2f07da98d57dea07374aeb85294ba21404dd81176839737e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499630, "uuid": "b0a85730-11ec-4963-a507-0c5b8cb4ba53", "comment": "Malware payload (AgentTesla)", "value": "fcc95ab87d20ab43ed301bc53dbea6b208be4151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680499630, "uuid": "08d0dc3a-c369-4c52-a76f-2efe68e70f7f", "comment": "Malware payload (AgentTesla)", "value": "b42c89510a586b8381f91664cbcbd2064e42ba192271436767c33f69693ea1bcdaa8e080ae9631d3f27713224b7e30c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499630, "uuid": "9b415125-ac22-449e-84ac-2039a3ebdb75", "value": "T10405F06371469D67C65949BE4560F79D833C8F225A0BE3C968A53126EAB3F0B1F08DC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499630, "uuid": "3b4076dd-1084-41d9-9607-2aa51cf023a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499630, "uuid": "43d0d600-d226-4a36-96ce-e31b87c6b673", "value": "12288:ietzLwrgtxmu8vcO92H6PAOU8WNR7uz6VdTqoHkd6/Djc2KMffJo1mJxRHHE6mRL:OUtp83FYOKduGVI9dk0vMfJYOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680499630, "uuid": "a3311308-f89d-44a9-9bf6-eab41e484e0d", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680499630, "uuid": "be6ff31b-38d0-4b1e-9a94-2bf9d48fc5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680499630, "uuid": "89f535e9-2ba2-4741-a76a-df6454e5236c", "value": "SecuriteInfo.com.Variant.Strictor.25322.24521.28210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53778da1-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680512147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512147, "uuid": "27074dcb-af00-41ff-84cb-21c3d7da77f6", "comment": "Malware payload", "value": "ca8d1cce22089367d84921fe96885b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512147, "uuid": "3662a34b-5e45-4af6-8e01-52e3dd19ba75", "comment": "Malware payload", "value": "9084944a2138f23af289de2fe61573041b261c781f9b94bfcda939f973c4f0e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512147, "uuid": "c01305e7-5b3a-43ac-b630-0ee2950ad8de", "comment": "Malware payload", "value": "6920abb052cb200ddb111294cb84835e6c4a1ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512147, "uuid": "4280f9f7-a429-44ee-91de-ce9a87a580b4", "comment": "Malware payload", "value": "925e58c6689777c149fe03e47128f22699e5ac3ddabd028863e0534f19cefa0f77aae6bb6e85a94bd5adae9e585117b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512147, "uuid": "e3ef1ec8-402a-4b68-90f6-67d437ab424c", "value": "T1CA834952B5D1D471E976193108B8EAB18E3EFD240F61AEAB3748063B0F342D19D26D7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512147, "uuid": "a0f863b5-fea6-493f-8bef-186ea4e61190", "value": "ce2dd1d93b3b08296b715229b7f9bf29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512147, "uuid": "d6ff271d-53b9-48a9-9740-237e3ca1ec13", "value": "1536:lhzsumPxqXAtt6rtVaXpMGnsuBqlAOzyKDW8sY6ZmoTsW/zQcdvEC2zupUCGsQpf:luxqXAf6rtMXVBqlAOzyKDC0cvEC2apu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512147, "uuid": "3dbcbd05-eb62-4fc4-b462-d8e0b13a8cff", "value": 87336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512147, "uuid": "a0451c06-3499-4f56-8a7b-14967d2d8301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512147, "uuid": "bd169d83-b46c-4ed6-8dd7-fb54964b29da", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59daac65-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680525472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525472, "uuid": "08921da6-8b36-43c5-ab54-16d241e26b43", "comment": "Malware payload (Smoke Loader)", "value": "9540b7d6cc7c7a132408988be0b6e2d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525472, "uuid": "6d055c9d-ba3b-4cd7-b648-f89e42deb041", "comment": "Malware payload (Smoke Loader)", "value": "917a2d9bfedad8aea9026f4c980573d7dd621b7f547c828a49b5c46c4ab369c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525472, "uuid": "6979742f-ba81-4e03-885e-9042d2e74c83", "comment": "Malware payload (Smoke Loader)", "value": "1d9eda5390307bddfa8f60695439d257c3240a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525472, "uuid": "c1c6f50f-fe99-4592-b4b0-6252ebdb355a", "comment": "Malware payload (Smoke Loader)", "value": "56f3728ad30252a6b8c6d63d631aaf2fbab318982c7b08f3fed7d2f5e8bf8e50671ebef1278f8c665dc68c49d428e099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525472, "uuid": "45f08e32-4c00-4540-bcd3-cea2b40c562f", "value": "T13E15A3AC366432EFC467CC72CEA85C64FBA0747B631B8617906F119D9A0D887DF111BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525472, "uuid": "6590112a-a833-4689-9110-ef9c681a642d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525472, "uuid": "1701cb0d-d477-44eb-97f5-2eb952f2a40d", "value": "12288:1Vhj52QhSahqjZYjXlP86kklJp5OFeCM2/4OyywVDjZTk4Km3oq2q4ANYSr7MSOC:rhjQTCWoN83Wfa/jwV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525472, "uuid": "0f1dde2b-2e29-4630-8430-49f0eeb2a5d1", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525472, "uuid": "65bd255a-62b1-4fb3-9efa-c2cde5f388a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525472, "uuid": "eeb53620-6c50-477a-9e16-39e44899ce4b", "value": "9540b7d6cc7c7a132408988be0b6e2d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7de2fdf-d1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680487432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487432, "uuid": "9f4df3ab-0242-471b-b60f-c76dc95cafec", "comment": "Malware payload (RedLineStealer)", "value": "b639bd399837f1e0c1424313f0f1a18e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487432, "uuid": "8e64d558-6fdb-49c0-ac39-a2c2f474b4e4", "comment": "Malware payload (RedLineStealer)", "value": "92e13766256632bced366751543252ccc72a9b82fdacdfd95e0074309e1aa25e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487432, "uuid": "9ba1b70f-ae5c-41a6-b2e6-e2014761840c", "comment": "Malware payload (RedLineStealer)", "value": "a53c3f3b5480e89831d1a30793d8164993ab3a07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487432, "uuid": "37aec783-0a79-4f03-aaa9-43dca8db89d3", "comment": "Malware payload (RedLineStealer)", "value": "ae53637d807ce4c036a164ec68749c838c3cba826c63231cc66cc645b7689d153fde5762f5da2c34cf420c74deef8dfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487432, "uuid": "ca3b7205-7dce-4eb1-b594-d92c2cb8a79a", "value": "T17374F1137288D032E16A05354426DBB59E7EB835AB259ACF7B90177D1F303E2DB3634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487432, "uuid": "df42dd38-0b88-4b95-8001-0701a39189fd", "value": "2872f2807be0ca81e71b7944856cdb17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487432, "uuid": "4eb4a13e-46e6-49b5-8b04-e4618c3bb4e0", "value": "6144:0bbh/s/Lo35Gj2ikE8eMMH3hvRmgcZYKlXpGg5HTSMJYBQj1m/1:2h/cM35GqHuhvRmFZYKRog5HTnJv1M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680487432, "uuid": "226d7499-cdb2-4869-af99-34441518589d", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680487432, "uuid": "e6050c6e-859a-47f6-97bc-111ea99720e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487432, "uuid": "7e4c4817-b377-4d81-b0c5-6d782920981f", "value": "b639bd399837f1e0c1424313f0f1a18e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b26a08-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525353, "uuid": "6c0f8ade-807b-4423-935d-a7d96a00dc94", "comment": "Malware payload (Rhadamanthys)", "value": "b779ab5bd1725ddbfdcec06e53e944b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525353, "uuid": "fc71e474-a658-433f-83f7-8d3996a4d640", "comment": "Malware payload (Rhadamanthys)", "value": "93c44c1e87360a8d8c7741f1166e14a1bb3cabcac4f296ef9b141a34b1c0553c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525353, "uuid": "60a18684-e87f-4f66-b044-5ce82355be80", "comment": "Malware payload (Rhadamanthys)", "value": "cc465b104362dd5e3d08e5c603983aaa47d0a62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525353, "uuid": "02ad6f5f-eb90-48b2-b53f-05b6c7710eec", "comment": "Malware payload (Rhadamanthys)", "value": "6f5380cc98b491c5d4dc1baf7b98afa8695321da0f7529d8e2a788c4d327330c759c94d290000c5871dd41f716e5036b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525353, "uuid": "2cca57ff-025c-4238-818a-473fde23832d", "value": "T16D64D04217E4B879E61247324E2EC3F42B1EBC619E557EAE1745FE3F09341A2D222717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525353, "uuid": "9fee9a08-d53a-41fa-8f9a-96c923382e59", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525353, "uuid": "09c880e4-8617-49c8-9d00-d6b6f9c1b62e", "value": "6144:vaNnIy34y2xv03+WJIMmk9rdKsxKRvt6aFtRZtkjt:SdIM4Hv0PVmk9rdUJtNrGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525353, "uuid": "72de872d-dd19-4f8a-a233-098942729a1b", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525353, "uuid": "40da6fe6-e365-41bd-9d3c-754e32ec8d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525353, "uuid": "bf797e82-d270-4506-9a6b-eada3f6881c7", "value": "b779ab5bd1725ddbfdcec06e53e944b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff83b13b-d247-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680544218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544218, "uuid": "87a06bf7-9f68-45c4-8b9d-f7d67c19e233", "comment": "Malware payload (AgentTesla)", "value": "0ce5567528b42c6303bc25fb426fe339", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544218, "uuid": "27072c9a-94d0-4fbc-92c7-06e0b624d6e1", "comment": "Malware payload (AgentTesla)", "value": "93f4e2b2ceaf8686232472e2a15391db4ee4164c65008f193cff5c30e7b80989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544218, "uuid": "50787299-6f92-402a-a752-7660f888608c", "comment": "Malware payload (AgentTesla)", "value": "e1cd760e047149cf5d7893e9d4c8a56f31816d92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544218, "uuid": "bd98b38b-b06f-480c-8a69-e8c9807d7b35", "comment": "Malware payload (AgentTesla)", "value": "b57dbd8111c0d97a611130fbf17427b506295af7c04f59a0c17abea40a889fa3c112d35002970d94f1216898874d0adb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544218, "uuid": "52d9b325-a676-48a9-b838-932103729b25", "value": "T15DD42372A415984C1190D5E8428B49AF1FCE26ACD198C621473AE7EBE63C037BB5F74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544218, "uuid": "0c78a26e-5b5d-4ec2-bca9-4975c67a0445", "value": "12288:8W2QG7rIoyhmvD3azVVHQaV/QyofDecjuJKQBKARvJVVucm51/ch7mo:92QGAoyKK5V/pQyofD3j4toARvJVVufO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544218, "uuid": "9bd48b5c-3b65-4bcc-bc32-ded3cc8460a2", "value": 606223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544218, "uuid": "f79af93a-41e3-4132-a2e8-294b98f5c30c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544218, "uuid": "e00fbadc-e6a3-4ed2-b3bc-a58ba47dbfa2", "value": "POM21002942.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee748da2-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680528728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528728, "uuid": "6b346c2b-d13a-49b8-a6bf-c2c648f607b5", "comment": "Malware payload (Guildma)", "value": "ef084a5bf70930f4f2a4245687dce6b2", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528728, "uuid": "872a2132-c31a-431e-b243-4ac3c614df14", "comment": "Malware payload (Guildma)", "value": "942e23f71fa1cd37b51efb127a2335a926e9d7413ae7a27919175a0eed646cb8", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528728, "uuid": "0305d8ed-69bc-4cb0-8300-16f3e0249fdc", "comment": "Malware payload (Guildma)", "value": "99baa75502d5229f5c8e93a20739c5ba1c04708e", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528728, "uuid": "c1407925-09fd-4e5c-b3fd-b0ec445800ee", "comment": "Malware payload (Guildma)", "value": "375b92cb45b4260b79dfb2b81e7b7155e67fc2b02a7d3db2c8087d4b545aa32403da18831b2590efd26acdbe09c65478", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528728, "uuid": "23a653aa-4427-4b1c-bcd3-3db01348b72d", "value": "T1B9C2BD5FEA0C6A2E3560FB0AEFE64008E5341C9C8F63D00EA85A5E89159D4FE07BD7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528728, "uuid": "83c6f80d-92dd-435d-ba53-1f32522e86e8", "value": "768:V5pDzFUJNwzbNuK9jIjkvJzCNCyQWHve71L7xd:V5pDzFUJNwPNuK9jQkvlCNCHAvY1L7xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528728, "uuid": "8cc79d3d-5ad4-4984-a73e-c296371d1f4e", "value": 26007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528728, "uuid": "28cc221f-b227-4168-9bb1-774179aebf12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528728, "uuid": "5bc3db93-bfea-4c3f-8357-f3477212ccde", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49411934-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680512130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512130, "uuid": "6611a9ff-295f-47e0-a1c9-d1633e997f5a", "comment": "Malware payload (GCleaner)", "value": "7c8a391db7f73dd7390cdb831c7a7d0a", "object_relation": "md5", "Tag": [ { "name": "7c8a391db7f73dd7390cdb831c7a7d0a", "colour": "#779F14", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512130, "uuid": "92d0084a-f63a-4db3-90b8-18ba4f619b96", "comment": "Malware payload (GCleaner)", "value": "94efede636b48fa99c4f651426b1a9c6c70d3579be40c6bbd34a5f27f7920918", "object_relation": "sha256", "Tag": [ { "name": "7c8a391db7f73dd7390cdb831c7a7d0a", "colour": "#779F14", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512130, "uuid": "6fd47bad-90b4-4575-8b96-dcb8a43d8fb6", "comment": "Malware payload (GCleaner)", "value": "9412fa645ae5f05bc9fdae5b8d03adf17176121f", "object_relation": "sha1", "Tag": [ { "name": "7c8a391db7f73dd7390cdb831c7a7d0a", "colour": "#779F14", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512130, "uuid": "404755a7-0337-4673-92c7-36a81b17d60a", "comment": "Malware payload (GCleaner)", "value": "411db1bf2e56f85051ac4b75799b66c2df2da465c5ac112975fadcc827999c8175d35a02e06650eb9eef941a9ee9dccf", "object_relation": "sha3-384", "Tag": [ { "name": "7c8a391db7f73dd7390cdb831c7a7d0a", "colour": "#779F14", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512130, "uuid": "85865e43-6232-4a00-a2e7-83bde7daa296", "value": "T1E3834A52B5D1D472E976193148A8DAF09A3FFD205E619EAB3748063B0F346C0CE26D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512130, "uuid": "7fb48911-54d2-4df8-94d2-7cb55185039c", "value": "ce2dd1d93b3b08296b715229b7f9bf29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512130, "uuid": "f8d0aa59-5adf-4bee-8cdd-c8701115eaff", "value": "1536:mPn4E9y3DjKo6YtejupMGBsRBql6rz7lDqfsx6ZmoTsW/zQcdpEC7pUU3Z:73DjH6Yt8uQBql6rz7lDK0cpEC7pUU3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512130, "uuid": "d97c6ab1-7633-47bc-b731-9c3c623ea066", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512130, "uuid": "1ec8f3ee-bfd1-4e57-936f-337423e93aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512130, "uuid": "84e1d265-eff9-407a-8c55-c6bcbee2347a", "value": "7c8a391db7f73dd7390cdb831c7a7d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4b6005-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680533534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533534, "uuid": "24ed3905-70fc-4a5a-813f-b83fbda4c3c0", "comment": "Malware payload (CoinMiner)", "value": "8cdcda604a4be0a91db601de7786b28b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533534, "uuid": "a7fb51cf-b44c-4163-a425-4f94ab19ca40", "comment": "Malware payload (CoinMiner)", "value": "95f429b6b59cf4098b2ff0bf681a202e8c22987bdbdeead2a589346960f0997a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533534, "uuid": "c4503d8e-663c-440a-bf33-bc2728382ec5", "comment": "Malware payload (CoinMiner)", "value": "042d389240a4299688a5edc0549fd2e2b03e09e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533534, "uuid": "450d2b81-1d61-47b7-8bb4-fe9360469ef2", "comment": "Malware payload (CoinMiner)", "value": "3a031a12e0a46689d639105a4e3fae1526a145b94041ecda279dbc6b07a494209aa4855b2fb5e037a2e8e7ef23cf7fe0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533534, "uuid": "d590031f-c863-481a-8fd2-44bd7191e12e", "value": "T1F146E1D741794ED8CAB69531671FC13B2EC9B176BC05824C97C2BF740EC84399AA27B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533534, "uuid": "0896c773-a9f4-4eea-ae52-7d185b7ce086", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533534, "uuid": "3db0ac09-240a-4127-9bb4-44155c6acbc7", "value": "98304:0aayaVTxvWWK5ba7Ers/ZxFBFlBuo6X9U33CNurKadNF:05yaVVC5ba7E+xllN6X9g3xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533534, "uuid": "023134d8-3d48-47ff-8a8d-0d0a006e0f2c", "value": 5853696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533534, "uuid": "7363464e-092c-4c28-aded-f27990d4a85c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533534, "uuid": "0b281db8-3b3a-4d28-a8df-7484caeda652", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bce785-d252-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680548598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548598, "uuid": "f35d05e8-15bd-450e-9187-44d27052279a", "comment": "Malware payload", "value": "e7ac24bd16bdb83808f940ebd1930e3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548598, "uuid": "cbb0c4af-cd99-4c68-bf5e-832124ac43a0", "comment": "Malware payload", "value": "964e8303695ab953546f9394726829fb887bb6bc2418d4831ac611742646b4fc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548598, "uuid": "8abe7cf8-62ce-4917-855f-eaa5eeb49814", "comment": "Malware payload", "value": "bd09f6508efef4ccbcc343d150adfd723bb3b866", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680548598, "uuid": "c87015c2-2ebb-4137-8759-3699d5dc889a", "comment": "Malware payload", "value": "4e7339b74b3da4e0056109352be8c81f898fea2f3618f8565b2575b73807a2dbab2365d302f7d5059cb0d25b18d125e2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548598, "uuid": "66c19969-fe08-43ed-aac8-15bcb51e4d63", "value": "T1AE87E04AD50DDA25D8DEF13CAD3D0AA2E6392C64166CCC17991B7148FABB6F00723793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548598, "uuid": "a7da4c2e-c31d-489f-b39c-50062b06f984", "value": "393216:otDkk+VVEKKlj2Ey/phVxrjcDt+tC5Qs4NkbokoTRFbBKlrPkXiQjT3+kH97M2yC:Pk+V5Sfgpj1stex9k+RFlukXiAolvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680548598, "uuid": "a6d35baa-84eb-48b5-8e67-2763fb852053", "value": 38892114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680548598, "uuid": "fe8d6fcf-0f04-437a-92d3-16043ccbdd03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680548598, "uuid": "3c3a8166-bb4a-408e-b977-be49189f64c4", "value": "Skeptic Tyson_2.0.1_Apkpure.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e42f3ac-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525345, "uuid": "23a1b7d2-0687-493b-87e3-9c42f6f2c340", "comment": "Malware payload", "value": "007b1b04784cf05b9436e7639829cfdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525345, "uuid": "345ffa4a-0de4-4700-8779-cd56af6e6f4a", "comment": "Malware payload", "value": "969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525345, "uuid": "f81464b4-20d4-4483-bfa6-4ba484bfec11", "comment": "Malware payload", "value": "88970b84422f209d98fa818642640e8f9c5b5b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525345, "uuid": "3cec268d-0112-45a8-bba0-22bf753d83df", "comment": "Malware payload", "value": "3d5d88514a4b770b8486faa18aa88cafbab56ccd5430c8b87e50bddfb2740b71cf43ad4a277629ca489f07c32511eb8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525345, "uuid": "5009d5e8-e42f-4351-a773-e48294a2c507", "value": "T15E43C02437E0C0A7E8B307311E3A5A2A6FF9ED2114B4970F27505B5D7E76681EA1E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525345, "uuid": "32179087-94f8-4232-ba8b-23d93576ca4e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525345, "uuid": "12beece7-79e7-4f8a-b02b-450635a21493", "value": "1536:ImsAYBdTU9fEAIS2PEtuHbtJ/7dqrW5I7:3fY/TU9fE9PEtuHbrIa5I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525345, "uuid": "7389b581-3047-4640-b497-a06254ea7939", "value": 59038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525345, "uuid": "47f9213a-dc4c-47e4-abe5-f4b73d809a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525345, "uuid": "7bd311d2-6be1-468a-bc23-79bfa4375ab4", "value": "007b1b04784cf05b9436e7639829cfdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff48e18-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680533643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533643, "uuid": "290bbb53-81ef-4f26-aa7a-8cd298f38d0a", "comment": "Malware payload (Mirai)", "value": "1a20b8eef4823c5dfee6ebb2c58fa330", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533643, "uuid": "fb6c1ae1-1a76-45ef-8e82-b5defd06bab3", "comment": "Malware payload (Mirai)", "value": "97206696b44a886c74bf5de1621673a2d58ac8c9361493676323c2170a867fdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533643, "uuid": "270ecbaf-65fc-495a-a7f5-ecabdbd61654", "comment": "Malware payload (Mirai)", "value": "599a885170312174dac0f5ac5e0b39ba2e5b2b05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533643, "uuid": "11cf58d5-a299-441c-953f-9a1afe561fd6", "comment": "Malware payload (Mirai)", "value": "a6e545b51aeb53e822bfb11bdcf5bff8acfaa45f97b324ce18fb3929df5eca6d4022704d46189a114a26f339b4c4873a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533643, "uuid": "8f4249b1-da84-4607-a6bb-7f388abb8234", "value": "T120230271880ECDF125303C76EBD5D3937AA129B1C6772123DA290A3C6F697131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533643, "uuid": "b796aeea-ba28-4940-a198-0abdfacbab67", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3P9q3UELbUXfi6nVMQHI4vcGpvj:gECFd+A6YHAx+LRQZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533643, "uuid": "d4ee7b04-5ee5-4e89-aac9-534137630679", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533643, "uuid": "76c97094-a3e3-4fdf-8566-5f62d1c84613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533643, "uuid": "047a76b4-85f8-4c0c-b580-ffeb8a392d3e", "value": "1a20b8eef4823c5dfee6ebb2c58fa330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850f22b0-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525545, "uuid": "f7e36be0-cc24-45bc-b1d5-bd6f6abeee7a", "comment": "Malware payload (Rhadamanthys)", "value": "f1d904f1d0a463d621e943259e4e66fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525545, "uuid": "c74b8322-b0f6-4bf4-84f5-28a301003414", "comment": "Malware payload (Rhadamanthys)", "value": "975d017bb22320034e4a3e7cf7a70c95f73bb9826c7279c52542e0ffdf031833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525545, "uuid": "5e271498-8ef9-44fd-b187-fcc4fda34233", "comment": "Malware payload (Rhadamanthys)", "value": "0ac5cc8cf489c7b0e8933edbe7a2ccf0f2bfd28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525545, "uuid": "4a2bec92-b4ac-4fb7-9c38-d7da85d11dec", "comment": "Malware payload (Rhadamanthys)", "value": "aa0a8612ef2f6874fdf99fc03578287c6aeef601d6ccd574c5b131fc7d90452f46f226b720cc8c4856d541381169fecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525545, "uuid": "a7571a5f-2018-48a9-9cab-0833d9912757", "value": "T1E464CF4267E0A871E61247328E1EC3F8275EBC61AD14BE9E2655FE7F09343A1D22171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525545, "uuid": "38973fc0-4132-47e0-b8f7-d4814df970b5", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525545, "uuid": "9e1e3a99-2196-4ed2-9527-1ecbb6173d09", "value": "6144:mvxrzDqkJK8lvumzlCNhkxAMJEAU3+jZtkjt:m5rXq0nu5NHv3+jGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525545, "uuid": "d05df737-6527-41e3-91eb-d59f1541098d", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525545, "uuid": "7e430344-76bd-4d7e-95b8-aac77dadf4b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525545, "uuid": "f1dc3737-1d22-4fef-a96b-350922ba1b0f", "value": "f1d904f1d0a463d621e943259e4e66fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b53d0be-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1680501315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501315, "uuid": "1f6ff26a-13c0-46b3-8d2c-013c3670127d", "comment": "Malware payload (DarkCloud)", "value": "e3f21a7a4a879db45f6e3feeb8d43c5e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501315, "uuid": "90afe320-4a41-430c-8233-d3c93cc7f89d", "comment": "Malware payload (DarkCloud)", "value": "97ba4422534cfd514e9dff46d3fb40efeb33ed2ad0ab29dee8a312453049203d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501315, "uuid": "528100f4-efe8-41c0-ab8e-ed4d2f2df0a4", "comment": "Malware payload (DarkCloud)", "value": "2d198951d904596d300933714f24acdcc796fe77", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501315, "uuid": "4f8332f4-6e05-461e-b8ff-77280e4cf95d", "comment": "Malware payload (DarkCloud)", "value": "63ff89c3b65062575664706d3d0a769cb32d43358d307c4c880c5b912ec3c8f67c3d3b4fcc28fbba7ed059fa803eab7e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501315, "uuid": "62ce8a7d-df8a-48a9-9949-2e9515b03a74", "value": "T1B19422487AF5D5F3E2F27E3166BA63776B6EC93605A49A0EA740070CB5276030C0F75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501315, "uuid": "8f3e7b8b-0d11-4fcd-b857-69bb7701098e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501315, "uuid": "96719712-5eab-4f1b-b897-3a2799934ce4", "value": "6144:vYa6T3YS/vfoY2wXVVfY5Pv8wsD9QkiF2VIBn1AyxhOiMshL3Qlk1OkoyoV3OCcn:vY5XswlVfmPs+ktIB1T7vhhn4Fr+CYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501315, "uuid": "63f8f032-e6af-418a-8dce-3c93252a2d3a", "value": 443526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501315, "uuid": "0eb04516-2bbf-4d9b-91fa-428c647b3888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501315, "uuid": "d8b09800-3c20-46e0-9ea4-94613e3a97d2", "value": "PO_Scan Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b62806-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680523027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523027, "uuid": "93e23b44-0204-4db5-87a1-96e7934f45c4", "comment": "Malware payload (RedLineStealer)", "value": "cfdf21ae5b7c91cc7a5412421c28a242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523027, "uuid": "fce707fa-df35-40c3-bf89-f4cb82ca1826", "comment": "Malware payload (RedLineStealer)", "value": "987698b00992bd51171ddefadea4ecb2e5eef7211f03668ef7f154bc2a798e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523027, "uuid": "a851256e-e6ae-4554-a083-52b752d86ced", "comment": "Malware payload (RedLineStealer)", "value": "8769303da7fe998a43015a910626fd16e0db1dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523027, "uuid": "b697b819-1079-488e-80c8-8953958d5580", "comment": "Malware payload (RedLineStealer)", "value": "46662f1aea5c3c3423a0023bc2f2e6be0f40a0ae02feb092beb83d1d8dffd1a70c55349738d850be17c081aad26062bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523027, "uuid": "55985dba-0360-4d2e-8135-41a9d37ab35b", "value": "T161252313F7F910A3D8F61BB199F613A30A31BC704AB8466B3B5AAC5E19721D0D572327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523027, "uuid": "53a2a06a-2e15-4f38-b629-763492767341", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523027, "uuid": "19839560-9930-49fc-9a02-444df3e84b7f", "value": "24576:Ryux9p6iGD8ahWDdVrsYzyTuvBKKq8oXIEVm2iD1xK6H8duHjo:EuR0DrIDvrscHq8ohVviD1x3zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523027, "uuid": "9f302d51-5830-43f5-a39d-b31bb7fa519c", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523027, "uuid": "6e74c6a7-6bc4-4dd9-b058-60091adc168e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523027, "uuid": "89882354-47ad-4c9f-867e-8988ac911b35", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803b1209-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524678, "uuid": "5eba93d1-3287-42aa-919d-70e6f1a040c8", "comment": "Malware payload (SnakeKeylogger)", "value": "76fa888f49eb0823a6bf23b7025e4575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524678, "uuid": "0dc90c11-132e-4096-80a3-5a690dadaeda", "comment": "Malware payload (SnakeKeylogger)", "value": "991bbcfcdcf46e0e2180f8024b6ba4d87c72d36289bb49e023a9fb04c71ff191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524678, "uuid": "75a64819-984f-4d2a-80cb-d264c558b356", "comment": "Malware payload (SnakeKeylogger)", "value": "6a09ab8dbf6c23f189053e2332f43a7cb7492316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524678, "uuid": "6d937535-9716-47c7-bb0d-d956290e9ac2", "comment": "Malware payload (SnakeKeylogger)", "value": "97101abc00a84cefdbac4011f03a037ede091b8a4ed7864f62d61cdd89ceead56ef7db57731c696b6fb4ae8869c2a058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524678, "uuid": "12d71395-d99e-4b6c-ae42-6d9208543696", "value": "T10AC41248323CAA5FCA6C06FFA4211046C3BD98367A06D7DA5DC9A4ED27F2B444905FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524678, "uuid": "7ff84379-b560-4759-8916-b034742563ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524678, "uuid": "f318796d-8144-487c-9234-f3017c2084f3", "value": "12288:satzLwrQTtoMF0K3JecxtbwO+VsZd9ZumgtP+ZnD4qMSOgqnB3:gMZeQpJKs7juTEZnD4DSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524678, "uuid": "5abb0860-b09b-4ac3-b6da-ae2a8de84bce", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524678, "uuid": "b380ebdf-04b3-4c82-9702-238216c634d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524678, "uuid": "a32d461d-1346-44c7-aa77-0efb3c73e11c", "value": "41jjKa3asuAaTmT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd5e1aa-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525506, "uuid": "5d6455fe-1fb0-4613-b6a9-8468c8be5b1e", "comment": "Malware payload (Rhadamanthys)", "value": "e56cbf4cd824b44a3917c63d492c768e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525506, "uuid": "c5394c6f-a375-4ae1-af14-04c6862273ad", "comment": "Malware payload (Rhadamanthys)", "value": "996ae2564d05f89a89a93ea723c94e3ea978386acdc085fe6c2e49252625c3be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525506, "uuid": "abc1d59b-77ed-472b-8b66-b8c8ee001203", "comment": "Malware payload (Rhadamanthys)", "value": "f29b7e77d3a5f72f9be167b6f80f002a202d181d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525506, "uuid": "0c6830e0-ba57-443d-b0a7-a062c412fa18", "comment": "Malware payload (Rhadamanthys)", "value": "a643c5833024379e255a060150dfa2fee3ffc4d03763ede5dad526ac432bf42b7a3dcde539ffd6a2ec861a826de1d524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525506, "uuid": "992cbb9f-2976-40bc-a5ce-233e51a42cab", "value": "T14E64CF4267E1B830E61246318E1EC3F4261EFC65AF3D7E9E2B55BE7B0D361A1C126316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525506, "uuid": "0c91fa93-0195-448e-8cfe-224c4b0a37f3", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525506, "uuid": "955b2b49-d0c7-4ad4-8b3d-1d8360cdb6c9", "value": "6144:BPPVsutvu1Umc9W9zLsB3jgW+/v8LNa10+6RuZtkjt:BnVsuNu1Bc9Y3cTB+/v8ha1xSuGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525506, "uuid": "4714b910-ad72-4c61-944b-6e6c6bc2fd1a", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525506, "uuid": "552cd67f-c01f-440e-a496-27709cce75d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525506, "uuid": "5498b9a0-7e96-4cdd-97fc-e1c857fc2201", "value": "e56cbf4cd824b44a3917c63d492c768e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425c818b-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524574, "uuid": "e90fe47d-3c93-4bbc-8be3-a26b3d4dcd6e", "comment": "Malware payload (SnakeKeylogger)", "value": "df89e3220b6f7e01c728f4f6c40e8f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524574, "uuid": "000df0ac-57cb-4e01-895f-74f0c12b9e52", "comment": "Malware payload (SnakeKeylogger)", "value": "9977ae92bbc2423a63bbe866d7bfbcd4f231456370a2e4589b76e4a48f9f1569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524574, "uuid": "bd367cdd-3da2-43a7-9816-bd0f3e63588d", "comment": "Malware payload (SnakeKeylogger)", "value": "a97dbfcb8628db68da7aaa4a65b6eedb0086d563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524574, "uuid": "318e15eb-7fb2-42d5-bc5d-7b3161dc3173", "comment": "Malware payload (SnakeKeylogger)", "value": "b1a912483ad4ff6de7e6191b55581308782de3bc4d8c4821f5deb925f57a8a2b81f28806e0a88577c9b649d72f635265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524574, "uuid": "d8f25c7b-02ca-47c0-9932-60552085cccc", "value": "T13485C0F31783FEF5D6BA1F74DC8122004DA7A997535CA29CAECC05EA17B1A049E02DB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524574, "uuid": "ba36f2a0-a7fc-4218-bccf-aea7978106d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524574, "uuid": "ff9e876b-2d7f-448b-a62f-e7d177b169f2", "value": "24576:D5l7Wb2zCdDtwU/GQnKyCqyPCxu5ORsm68tx7onx7Qyici7TnyPuPC:/7W3tVuuPj0mzYC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524574, "uuid": "ba139b53-8945-4cc9-9605-16fe61a95ebe", "value": 1838080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524574, "uuid": "8765b658-0253-44c5-9390-1ae9919c3103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524574, "uuid": "baed7f69-49d3-4426-8aae-881909d1f75a", "value": "Airwaybill and Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b552834-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496162, "uuid": "e0c2f6fa-8232-4230-bee8-587d4b474af6", "comment": "Malware payload", "value": "7b8da139e800d90b14ec017cbfbc5ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496162, "uuid": "346a078f-de00-4448-8d90-faa57aab4f4c", "comment": "Malware payload", "value": "99db1d4033c5e63ce51a581d8ee1353d15c40e201a2515be86ed710ccaa09751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496162, "uuid": "58c5ba44-eb71-4b5c-aa7c-ade6b3765ebf", "comment": "Malware payload", "value": "e57a91301a1447c83ad38d53b1360c891e510991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496162, "uuid": "d7c74c92-2b4d-4d00-aa01-441195fc75e1", "comment": "Malware payload", "value": "fe5e70468c2e02a9419816217328d4acbeb0e026b4283d452c4359fc2491d12ae0ccd5365e5141eb198a9460d9b21105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496162, "uuid": "577dbbef-30e7-4be1-b102-ea32faa997da", "value": "T1B3157D82F2E140B1D66D36B144772779DAA949070B10DBC76195FAE83E232E0BF3BB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496162, "uuid": "feb881a8-34a5-4e00-82bf-f4536f0fa750", "value": "12288:b5y/MCKV9MXjkbnNF9nevqYQWy62yPXB:b5mKHMXjkbr9evqMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496162, "uuid": "dd350614-ac80-4dcf-8d8f-36ebec5aea28", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496162, "uuid": "a88c9369-71ce-4fe8-aca8-395cefdeefeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496162, "uuid": "052a90b0-2bd6-4eb1-b9dc-9765e8167361", "value": "SecuriteInfo.com.FileRepMalware.1863.31164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f12e01-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525385, "uuid": "aee41ca6-0b01-4dff-a65f-e53e7528b1c7", "comment": "Malware payload (AgentTesla)", "value": "27c159a49e654e3c14a3ceee213d61a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525385, "uuid": "76647a25-074c-4745-b4a3-41244a6018da", "comment": "Malware payload (AgentTesla)", "value": "9a580a40478fe984f873013902404ec5eec375ffa95035f3d54f66fb6cbacd5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525385, "uuid": "fde83727-baaf-43a9-b345-b7be814a3034", "comment": "Malware payload (AgentTesla)", "value": "d3b800e97172d89503599ccaf55504943b34fdb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525385, "uuid": "27e1d083-23f3-4c76-98de-6def05ec5942", "comment": "Malware payload (AgentTesla)", "value": "2a4265162e21d6e22460e0c6daf673352f734c5ca29487e25e40f2b0059bbd7fca8d12d66a787192f7cb3230c030194f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525385, "uuid": "49b5b414-10cd-4e53-ac0d-aa7c6562a103", "value": "T1C1D41209376D661BCDBD0AFE9161650A83F599267A0AE3DE0CCD6C7D16F3B904802F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525385, "uuid": "29ae597c-fabe-4ad2-8040-f2073630feb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525385, "uuid": "d7ff63f5-50a5-4f60-8340-03095c65b4ad", "value": "12288:IotzLwrgczcf1bNMEO9xMI0B9WWDVaruQBsG:6P21RMhO9WWDXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525385, "uuid": "ff120bdb-de21-4b92-b98c-5508a2463e11", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525385, "uuid": "b91a3bf0-bc59-4ac1-b4e6-330e443da9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525385, "uuid": "6cb0ee71-1dba-464f-8229-02f635d46bc7", "value": "27c159a49e654e3c14a3ceee213d61a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f39a528-d22b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680531816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531816, "uuid": "875987e5-bfa5-4990-8fb9-5e52e413c048", "comment": "Malware payload (Guildma)", "value": "5a6d7609a6454e05662037a56657df14", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531816, "uuid": "d1a403eb-23bb-4958-a849-0843314d55ca", "comment": "Malware payload (Guildma)", "value": "9a84f1bb39cc6b4c5c8db4300462951f4f8a90d0e6445078865db968aae40393", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531816, "uuid": "769c07f8-ec3f-49ce-a9fa-7fdd65a9c05b", "comment": "Malware payload (Guildma)", "value": "d5676e09cae403eccee9319709b4de4757f1d459", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680531816, "uuid": "bd803cb6-9dee-48ef-9b2b-b7c111148f8c", "comment": "Malware payload (Guildma)", "value": "23eda3274bb15fc7576175e3a7eb969a1f4af3bb100b7f27bc3715d7345dd4c56133471564cc6be4021ed031485cf25a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531816, "uuid": "d0c01387-e80e-48be-9b71-c5e96a73aaef", "value": "T1B0F0AB4DB1A27C91E05CAD35C9464B888D1C76961F015252C2CE2A846774D5DE90D972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531816, "uuid": "cfe130d7-5fd7-4ed5-9941-bcd6f47b3e92", "value": "12:8rflM8OBE6ZGQWgk91BBUvjdh2bLpOmqm7kwsjvTptsGN4:8loGQWF91DUvXwLpORm7av1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680531816, "uuid": "737a08ba-178f-42e7-8e0a-b2320272277e", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680531816, "uuid": "df98795d-d797-4f26-bb19-c74041cee755", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680531816, "uuid": "f6490d90-8f16-4171-898d-853b37e2633b", "value": "Curriculo30268825a__569.95605168.088029.32986.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1db4a5b-d1c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680487797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487797, "uuid": "3c156f5f-c20d-4dfe-b97c-69edea868a54", "comment": "Malware payload (RedLineStealer)", "value": "103ea6eab3c8319c68efe3357bcc5325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487797, "uuid": "229e0a02-c604-41e1-a816-d8fa6cd486f4", "comment": "Malware payload (RedLineStealer)", "value": "9ad0e30aa9644a1156e04b683dbf5b3c3459e62b3178a36e900352c0428181b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487797, "uuid": "e432693a-0b77-4c0b-8b82-8e3be193d931", "comment": "Malware payload (RedLineStealer)", "value": "1efcc6693842eeafc6512a8e54c55258eebfd1cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487797, "uuid": "5fc20aa5-9078-4be6-9f78-ea852dc78e9e", "comment": "Malware payload (RedLineStealer)", "value": "f938dca15154ee015c92782e143fb2cb0f269b82e001c57c90acee90fececd0a65825ba7c68d639a5afc10361bb4b247", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487797, "uuid": "cd612d11-4fc4-4343-a859-c049656dd9fd", "value": "T120E412536BF85062EDB457B048F703C30736BCB15AB40B2B3749989E58B2A84B57A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487797, "uuid": "6abd7f54-d0f3-4271-8044-c05cb0f3ae06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487797, "uuid": "42147188-5def-43df-9886-f2a49bc05cab", "value": "12288:6Mrny90Xqb9ZIEE477gUm8ZaErJcL9he+ArU8Ry/w5xvcr5gt1:ByWqb9dJ8Um8IE9cZg+ArTMw5xEmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680487797, "uuid": "38c75661-e845-429b-9db5-65ec9462b325", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680487797, "uuid": "c07915f0-9355-4910-a157-6cf7f82ead63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487797, "uuid": "5ba8b6fd-3d30-4501-bfa6-48dec7e88318", "value": "103ea6eab3c8319c68efe3357bcc5325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c31b14f-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525396, "uuid": "3a3ce74d-8538-4735-b22c-9f414a6e9eb9", "comment": "Malware payload (Rhadamanthys)", "value": "25a390309230057618cb7fcc2fc163e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525396, "uuid": "aed2a617-9477-448a-92fa-b86f939556ae", "comment": "Malware payload (Rhadamanthys)", "value": "9bd7176592fd6c3067c61114736bef9547eea56859e196e65f0fd0e631d7d6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525396, "uuid": "94d4a754-6831-4afa-a54b-e24030fa2cf2", "comment": "Malware payload (Rhadamanthys)", "value": "a11480f8091909f94293c9107cc76dbe5ee02fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525396, "uuid": "b2737e9d-4bf6-48b2-8b0d-9978519f86d9", "comment": "Malware payload (Rhadamanthys)", "value": "3186ef1057d7f13d910b0894ac1e979c1bfee498fe06c9147ced2cd264eda4aa20dfb069f7c5a365153c350b1444c654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525396, "uuid": "07b91e82-abca-45c2-a68d-831298b49de8", "value": "T1CC64CF4267A16871E2134B328E1EC3F46B1EBC65AD15BF9F2785BE3F0D341A1D262316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525396, "uuid": "d792aa37-0747-4686-9eaf-9a6a55f54854", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525396, "uuid": "18bd7b50-5d68-425c-9c98-2f33c0a09dec", "value": "3072:ZDAnGKSQuEZ1ksggDin6dtkklvcYC2ZhjogV9X0AXasmeOBgJiFs6FC5w1ZI6x9s:OwQb1ggljH9ksmLsa1mfZkkZtkjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525396, "uuid": "461e6a63-9a0b-4611-b259-c8cc8c2cde3a", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525396, "uuid": "78862df4-db3b-4684-bb29-3b19f9014323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525396, "uuid": "6fc8574c-a495-4c8c-bc2a-f9acaafda7f6", "value": "25a390309230057618cb7fcc2fc163e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af82b1f-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524535, "uuid": "ed35570c-0354-4ce0-b367-d36a2072043f", "comment": "Malware payload (SnakeKeylogger)", "value": "6f7a087c8230ee4a56c3275ee995363f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524535, "uuid": "20a0c0d5-e061-4eb0-8738-51adaf12da36", "comment": "Malware payload (SnakeKeylogger)", "value": "9c9e8b1e8e1abce02b30be300191b7424c10e0bec236fd9000e5b641c9ffc8ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524535, "uuid": "cbda3f87-adca-486d-9c81-724e3a3d5e2b", "comment": "Malware payload (SnakeKeylogger)", "value": "95fc0614706cc6772109f6f67b938632b4837c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524535, "uuid": "1ed707e8-2447-4b94-b576-b0993dc83e80", "comment": "Malware payload (SnakeKeylogger)", "value": "272194722e6c192899b65978f75c2d4c8812642061d6cb9b5aa8dc0d02111fa6ada5c03659859b96051eb490a37ae8d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524535, "uuid": "e1829fa4-0f56-449e-8b26-dff2579bcf34", "value": "T1AFE412116699A733CE7847F660739654077BA9272413F3BD8CCE90EEAD22F14C992C4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524535, "uuid": "6457bfdb-8bbf-4c5b-b42b-eee2cc3833fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524535, "uuid": "cf959db2-ab1d-4cb2-8540-53fe3f70fe46", "value": "12288:EW5CBWKdq1FbwwJLwrJozfmgpuOroA9hh+KwwnMAGMRVxWpPupaW:EJfrpN2ugPxhNnMnMlWpWpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524535, "uuid": "8e546c96-973a-4825-be6b-70eada554d7b", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524535, "uuid": "7f72e3b5-9b64-433c-bf26-b3d87d5cd8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524535, "uuid": "cd7fbb2f-bd4c-4590-b386-e9501d6826e3", "value": "Confirmaci\u00f3n de recibo de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11740ba9-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496145, "uuid": "8643349c-7145-4161-8c76-338df38d1213", "comment": "Malware payload", "value": "bcfff3c24a2dac524af76fc7195085af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496145, "uuid": "9557dec0-17a8-4063-8e7f-167d169c2aa0", "comment": "Malware payload", "value": "9ca11dad6660351df633c38c2f43a0cb0345997656d1f6eaddeecee3c4e52c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496145, "uuid": "8d11cd37-fe49-4699-bd12-cd05a6392be4", "comment": "Malware payload", "value": "35c8689ef366a7c84a7e9361fc080754a8c7550e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496145, "uuid": "39480588-e2f4-493d-9a47-c7bea47fa6b7", "comment": "Malware payload", "value": "5beb5d1e5a0c039f215fc04abbe0db5df6ec4153dfff9e99ae51e696fc1aa07a971800d862a827bb88f49f864b4671c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496145, "uuid": "c886fddb-d34e-44b9-91f6-b4153e39f023", "value": "T1F3E288A3D64B6464ECAD697859DBBB7F2B67F4315C311C48CE057C0FB022B322824E68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496145, "uuid": "b41371a3-5126-4b53-b4ad-a815f2605f3d", "value": "192:NyRix5defpIIwhpb1XfG13k0O6zxf2BMn:wkx5defpbwhpbpG13tjxf22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496145, "uuid": "28355f26-0175-4e70-804e-6692a333a7a9", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496145, "uuid": "e5d272de-7644-489f-8f33-dbae16aed0a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496145, "uuid": "6ab2ce3f-2804-40f7-8e2d-6f7b5375d407", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.10907.24121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723732dc-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680522936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522936, "uuid": "781e8a2e-1430-4e52-8257-98ae4ea1b2e0", "comment": "Malware payload (RedLineStealer)", "value": "7ac4f24ee894f6600df3fe460721384d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522936, "uuid": "ab705538-f854-447c-adfe-fa451f380c76", "comment": "Malware payload (RedLineStealer)", "value": "9d068ce15d60a71c72e55b7d3cb8963c2733b8aa7c9de4942f971fa08466056b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522936, "uuid": "c85faabe-ab62-41d2-9526-6591f4913e0d", "comment": "Malware payload (RedLineStealer)", "value": "f71a4c3929ee29cbf420e0f6393d6620917c3591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522936, "uuid": "adee72b1-30f5-4feb-bc4e-08a76a5aaf9e", "comment": "Malware payload (RedLineStealer)", "value": "169a52f77c5bdf9c36a57cc5e5ff79f18c8057bbeb2fa7461f0834873b800ad0464c9bf3adff39944c799c872752fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522936, "uuid": "ab92e73d-c055-49c4-8da5-a293d3e8d55b", "value": "T16D252213BBED9171E9B4237086F316D30635BCA29878C30B1B42995F18B66E0F571B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522936, "uuid": "19ceaae8-2cad-4754-b4d5-5f1c984cf0d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522936, "uuid": "00834998-b8ac-4d6c-bec9-693bcb5ddc52", "value": "24576:6y0WnvKY4dpzLTRzHX4qlMkYSMteO2iubaoPH6lq:B08KnfSSGeXiubaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522936, "uuid": "d84c1a8c-8b79-4f0a-9eac-251d5ed23a1f", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522936, "uuid": "7a91d890-6121-45ae-89ad-06bec28b5f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522936, "uuid": "38f79516-7117-427c-9502-1383a3574ff5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a92728-d227-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680530451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530451, "uuid": "e501ad12-031b-4578-b56f-285d70e549ff", "comment": "Malware payload (SnakeKeylogger)", "value": "a78e799e4b8a0666cb2b65c4b73503ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530451, "uuid": "4b7076fc-53c1-4715-b26b-85610393919f", "comment": "Malware payload (SnakeKeylogger)", "value": "9d0c4555f8cc20b85e53a735fb30e5c968fee9c3d7512996f17bd4f752b49aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530451, "uuid": "f1457d1e-e035-4f0d-a0d3-dd76fe66a0a6", "comment": "Malware payload (SnakeKeylogger)", "value": "30ccda892798b7d903c6e6728a9aed58d7cb42db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530451, "uuid": "0d7b3612-a98f-4eec-a4f2-bce0b2bb782f", "comment": "Malware payload (SnakeKeylogger)", "value": "f90b626be130ee1b855317b61bc90a7e61088ec90c8064da5fc8035b6f72298f48ca5e8a80b9a282bf4e9ddabd811235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530451, "uuid": "c83ebd21-8e03-48ab-86fc-bf0a169f97ff", "value": "T142D4021CBDF9A523FABA43B618D013905F3212256336DBEACCD9A0C43DA778994F0657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530451, "uuid": "7985d3e4-1ea9-467f-b133-9a01dffeeab8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530451, "uuid": "64bb301b-3653-42fd-8757-67d38f2b955b", "value": "12288:bYAGUowC0HmGR66z+2BE4aR/FoYzwEjP5wigzvRuQbal:b9GqHmCBEVj/zNirzpuwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680530451, "uuid": "f7207556-a8ea-4123-aa04-8c0f38953a7a", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680530451, "uuid": "f4b0e96e-7cdc-46c5-ae9f-e60c829531fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530451, "uuid": "a56c9d31-563b-4fd8-9caf-c9e18cecf691", "value": "Inquiry_03042023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e015170c-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680524838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "0b2f2c47-4dcf-4263-967d-ce0904ba0f72", "comment": "Malware payload (AgentTesla)", "value": "0c4a5ea1a54c5d7d4f25925bea591db1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "a5ddf6bc-092b-4675-bd24-b9cc191b23f6", "comment": "Malware payload (AgentTesla)", "value": "9d99aa5e582b2b89947e9a42a1154b9ec2fe288463273851b213b61ff5f567ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "217258e8-8b66-4a16-978b-697b1834dd1f", "comment": "Malware payload (AgentTesla)", "value": "68ab63c2fcf21a369364bc80053c4a7ddb08dbe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "48120974-a955-43ed-9a14-6bcf1fb1200a", "comment": "Malware payload (AgentTesla)", "value": "b21cd12bda2dbbed1a6234e53bfcaf2b4d5d721196a4e69be784b7d3ee9692a22922b7dc10feb8c1f3c554aaa3ff35ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "65a8e9bc-4bb4-4ebf-81b2-910f630db072", "value": "T1DFF422047A0EF733CD7E4BF3916392220379A9265442D73C6DC7A8DE5A33B628646D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "089d3dc2-b522-45f3-899b-6262c12bf31b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "bf479f2c-720b-49b6-81c6-aae891a048a2", "value": "12288:F5CBWKdq1FbwwJLwrSdaV+6mR1V3oPYbd3JAzKAbbwy56tUDnyNHxWOjCvw9:ufrp+dSmRnz6whUuHxQ49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524838, "uuid": "d5ca8b7c-fa37-451d-9b78-98f1aa4f118d", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524838, "uuid": "0e2192e2-5331-456c-bafd-c1b0bab4b924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "7edfcd3a-ca17-47ab-91ec-85713d942ab4", "value": "CT12# TC-WI-60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aeb26a-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525406, "uuid": "0374bd1e-db3c-44b5-8bd0-72358b17ef81", "comment": "Malware payload (Rhadamanthys)", "value": "744a05d239d0e6f84bea77a48e2d7a6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525406, "uuid": "dfc28d3f-b2db-42ea-8017-b6adadf99a60", "comment": "Malware payload (Rhadamanthys)", "value": "9db531c69951bf760311c61c506dc48d23ca12a8b448bff770288f5bdf685c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525406, "uuid": "b837ce9c-af56-4d00-9773-10f84789bda3", "comment": "Malware payload (Rhadamanthys)", "value": "845b8ef437ff30bfc8c5257b3b018c7508192770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525406, "uuid": "f20df7ce-e9f3-464d-ac90-169f23ca80fd", "comment": "Malware payload (Rhadamanthys)", "value": "5bb18549d8eedc4f708a7241fc8ba4c6695550b568745e51de42cc7c6d6ecab3c0e7372e614bcdb55a8d304dce170651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525406, "uuid": "a8797a05-e855-4716-a722-0cb74f934f8a", "value": "T14A64C00267E1AC73E52257324E1AC3F42B1FBCA1AD257F9E2655BE3F0E341A2D121716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525406, "uuid": "edf86448-76fc-487e-9af0-0796790a3e59", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525406, "uuid": "c6236ff3-c2d6-4857-9057-a9b698b1b06d", "value": "6144:sw1YeT1hoyv9b1dVrCyTA1U0/67TCICEq9Ztkjt:F2eTroyv9b1S2w4g9Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525406, "uuid": "12a66d6a-040a-4251-ab25-4d5d4816ac93", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525406, "uuid": "9199c331-1598-4473-9ab6-0b6849394998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525406, "uuid": "6f2b1489-45f8-48eb-ad39-61daa3636878", "value": "744a05d239d0e6f84bea77a48e2d7a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21524c5e-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532249, "uuid": "f8ae6328-ce61-431a-ad3a-bae883db1035", "comment": "Malware payload", "value": "188747a77b232cda042a2f6c9db8e948", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532249, "uuid": "239336e2-336d-411e-a425-70c92cec2e4c", "comment": "Malware payload", "value": "9ddb14bd83a74cf45ceda63119d778c91d3e32ec1e9916a5469448434e24af1f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532249, "uuid": "27078378-6175-416f-b740-52ddd155d32f", "comment": "Malware payload", "value": "b0d1b4cd8e4f7501c9327805a5bf42c46a264d00", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532249, "uuid": "c3331834-a7dd-4cbe-b0f5-d5f77faeb1a7", "comment": "Malware payload", "value": "8a504157d77a40a680ab7d6dde07c7144c52e7a461ea5be57027f552970250a5b5ea8f73e7ecb0000b9bd310cd0d995c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532249, "uuid": "d9bff432-f12f-4ad0-a7cd-2d1eab8a7742", "value": "T18545CF340B9CCD5EE7ED16BEB1E600B0A6BCD655DB83E36B048439E63F5B3C46941292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532249, "uuid": "d4360f24-0e2a-454d-a3f7-87b9b2fdc00f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532249, "uuid": "acc90581-8f89-4fd6-91a3-a030a1a1974e", "value": "24576:6qUvktHcyn35GzrQ6LJXgTR/wZt8uE0bbfiO7ov/o9ohwdSPersW3:MMmr5dXgT9+zE0Xfv7ovwCwKer33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532249, "uuid": "e4e40f2d-0f94-4482-aa84-45072356df8c", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532249, "uuid": "56917665-a009-4373-8b4b-cf75b05652f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532249, "uuid": "3f145388-2320-4038-a44e-2770f65cacc5", "value": "09759e7487a17e4b71961f09c781f27b208ae6ed3f7c103513bb492afad1a4ed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4751bf-d1fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1680511519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511519, "uuid": "88fcec48-c0d6-4465-a152-2cebcb7286fd", "comment": "Malware payload (WSHRAT)", "value": "6ecd1b4c44ebec3bb195abc6e0aeb1fc", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511519, "uuid": "170e53ef-35ea-4744-8833-bd295ee010aa", "comment": "Malware payload (WSHRAT)", "value": "9dfca9429d741fb4b39d97c4d48e4c542193cc68930faead1c77e74f9bf3678f", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511519, "uuid": "a4720412-648f-4224-8e0b-8839d353bb8c", "comment": "Malware payload (WSHRAT)", "value": "d09b365dc98d35e3e53e49503184f38aa9efd9b5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511519, "uuid": "edfae760-4a6c-4cd4-9841-97749dbcc884", "comment": "Malware payload (WSHRAT)", "value": "7a7b82c30765c630924285179bacddee22cd51fa5356cea00d9a23cb3d5bff4fadc44d16de2fe3e3821fefdac4e323ba", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511519, "uuid": "adf29235-ead8-46ac-89ed-d49a0ab0f6d1", "value": "T1CC2468023E8BF93C155F3D0025380E769F8EFE62D61991665A495FB893BB49D033F829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511519, "uuid": "fa60adac-e91c-4449-b2a0-21ee2f4aa6d5", "value": "768:uYcgYP1Tsg0HlHsf6I7j3nS3ftCSrCURr4n+xPJOxkvsWssnZ1BWKsnCWKsnSRQz:Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680511519, "uuid": "3ccdfa9d-ca70-48b5-bc14-adefbb54c20b", "value": 224031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680511519, "uuid": "24ed279d-c3ad-48a4-af5f-d02947529697", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511519, "uuid": "3efc5297-883c-4e5e-b08e-5c9eb3beeda6", "value": "ORDER432023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1f6701-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680523464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523464, "uuid": "7ecee555-b5eb-4ea7-98e9-0a7243baef87", "comment": "Malware payload (Amadey)", "value": "6fbfed742c4fc5ae0322e0fc0c7e685e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523464, "uuid": "6a557ba9-f838-4672-a04b-15e31acb95f0", "comment": "Malware payload (Amadey)", "value": "9e0f8b54f891c8b4471b30f368e54e63ee45fb8bceee91b53e8e677024c1a1be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523464, "uuid": "21c0e5ea-e205-43b7-b5a2-d1937b0b401c", "comment": "Malware payload (Amadey)", "value": "30dd0a6fc49bc937dc3b0b21ec7410499c7d50f0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523464, "uuid": "54f87cbe-935e-4219-8d75-1abfac3d1753", "comment": "Malware payload (Amadey)", "value": "50f972b716ef809c9873b754e45f02d43775e51cf6535cacc6fb2671a9e2d1d3a0c64547369224695db553474c9526cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523464, "uuid": "d2706723-7e18-493b-8348-cbe58d7d5d95", "value": "T15C645B0252E46830E53E5632CF1EC2F8271EBC629F697E9B3675BE3F09701A1D522715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523464, "uuid": "b7736b4e-5f24-4604-a660-b0ba1fa93736", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523464, "uuid": "8cccb31d-da62-482d-a733-83ecf28e7287", "value": "3072:MQ6qlCa/5sRNbGoUfiDfHfuX9QaRpCyg45W7wh0kSJHXeAgQBeijEPS:9DlCM5sDHutQsMS0FXBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523464, "uuid": "7e18c614-977f-4b17-8acf-a2c02e4639f1", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523464, "uuid": "22ec50f2-989a-46ca-9f48-64560e0ff735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523464, "uuid": "421c35e2-abe2-4974-ab63-f49f6ee73d05", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7317e1-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502500, "uuid": "8675a44b-2ef4-4834-868e-4493b195ad4c", "comment": "Malware payload (Mirai)", "value": "ae611a1b5c653368b3bf8d2471d07551", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502500, "uuid": "d747f4ae-ac66-43c4-9059-ae7f678a946a", "comment": "Malware payload (Mirai)", "value": "9e78356139f7c56fe4aa9a1123a3d563ed270663f87deefc1122938598cebe68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502500, "uuid": "104806b0-3321-4dd0-8056-9d4fce5b1c6b", "comment": "Malware payload (Mirai)", "value": "095855f04a26b61c72ddcf174525cb3bf8ab7942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502500, "uuid": "1417001f-9cf3-4001-ab46-8f558df20391", "comment": "Malware payload (Mirai)", "value": "d9a24e0b7b23803d6ffe7300bdac1c772a006c1f033418a15505c1f4a24f1d4a9119b0272c9825aa589081c6c845e5df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502500, "uuid": "e2bc088b-d10e-4b28-ba83-d5b27e5503cb", "value": "T157B2E0B364C99E13D5F8C179E5788846B3410D39B28473373A65233E3946A2131B8E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502500, "uuid": "572e731f-aeb7-41d6-bb9e-30d9bfaa7ad2", "value": "384:s6+Ex0fXl7KnOUxLTcAc5+LMquG7bYXPJa50KZ2nVFhymdGUop5hm:R+ZfVSOUBcAcMLc6cf0uKWVFs3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502500, "uuid": "c8e5a03d-3bf5-4c65-a28f-6d6d7a3746b5", "value": 25296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502500, "uuid": "3da5c539-07c5-49eb-89f2-1e75a6aa9760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502500, "uuid": "578cce62-c155-425c-ba18-d2d7adca783e", "value": "ae611a1b5c653368b3bf8d2471d07551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dcb53c-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496144, "uuid": "5ae3e4c9-3b4a-4b10-a055-e9f307b0d560", "comment": "Malware payload", "value": "3ed86ee39536c8dfa753d87b3bb51f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496144, "uuid": "fdda3289-3ce7-4bbc-acc9-cede38ef03f3", "comment": "Malware payload", "value": "9e88b1252fdd33fdd22c0436f836d55914eb271fed52186614278e2f3f503be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496144, "uuid": "6cb093cc-fcd8-410a-8840-2ca3dc451e87", "comment": "Malware payload", "value": "bb7b29dbb8b1d0b528d09589b3d843c22cf8b365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496144, "uuid": "620e0f60-f8ae-4281-921d-33bed5699e03", "comment": "Malware payload", "value": "cac6b2e445f8daf38f406cbef6afb8e050ecdb41c7e39cbdc791b106eb358fcf3004127d4e9f1590c4b0af8293313a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496144, "uuid": "e2316ccb-a7f2-4c82-91f0-24142c6f9ba2", "value": "T1A9A46D27F6E18877D1736A7D9C5B86A4A835BE903D2968463BE91C4C8F3C741382D2D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496144, "uuid": "b4ee6c2b-6454-4b33-9863-643fd16a6a4d", "value": "6144:uSvl5xQccMjsriNWh932kHxd79qrnN2jEMRYTKvz8wHKyOFpKl:TTdcM3w/rxTqxzMRLzvCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496144, "uuid": "5df030db-5266-4ead-915f-77f80bc06da1", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496144, "uuid": "e1c9c2d9-6c4f-4b26-a76a-282c7ef2512f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496144, "uuid": "37611692-bb40-43cb-9c40-6dcfc8258daa", "value": "SecuriteInfo.com.W32.PossibleThreat.25717.23428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f46443-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496156, "uuid": "8f451305-bc03-478f-a07b-93644f2d128a", "comment": "Malware payload", "value": "66f80a6c78859dc8c557bcd96243c89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496156, "uuid": "cdb96009-84c2-4a97-a921-45e01174d520", "comment": "Malware payload", "value": "9ed8652a78d1e16324c72f39f35823a4cb990b7227e121601184a9a5472fc8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496156, "uuid": "4797c02e-2758-49eb-b22a-f90bd2c42116", "comment": "Malware payload", "value": "3efdd2b9faad0a00c405485e71fa88f4ace541a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496156, "uuid": "a50b46f3-62fa-4101-9042-c058fc6fea86", "comment": "Malware payload", "value": "90994b09433d11302aef74351bb909f70d215c39b23798c7cd55412e3ecfa6e36b9942c731725f8c3eca2602b545ed03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496156, "uuid": "ed250d43-705c-491b-a094-45a013828ca6", "value": "T109358E02F7C784C6DED278B1197FE7126F3AE518532A44FBA3B45C334A51481AA2D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496156, "uuid": "1ecba5e0-e57b-43cb-85cf-af23b6e5480c", "value": "12288:DPYU1gi0BQVKBOkTix6Bg4Y3GgZfLtFBV:D3iQMUd6e4YDTBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496156, "uuid": "2b46973a-61a2-4494-90d5-975c4ed29caf", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496156, "uuid": "c500987d-9f0e-444a-8e63-baf4d85ec086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496156, "uuid": "9b945acb-733f-4d6d-8a57-30434015f57d", "value": "SecuriteInfo.com.Win32.Evo-gen.12759.3455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a8c837-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501301, "uuid": "4ef30674-6ce4-41e2-ae8d-79e4818f5bd8", "comment": "Malware payload (Formbook)", "value": "ac20a1d7981dcdc4d79c3c2c90a57113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501301, "uuid": "09e0fedb-699e-4c06-999a-3fc95db5fba9", "comment": "Malware payload (Formbook)", "value": "9f24559594b9c2aeb8f1a8225b09be8767f0054710f1e3af837784c025a284ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501301, "uuid": "2249fada-417e-407d-b804-518ad0528a6f", "comment": "Malware payload (Formbook)", "value": "3c3148976370e9fd532dfde2f28a2c5d3869e690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501301, "uuid": "4b768fb4-9395-45d5-ab8a-45556b4b85ed", "comment": "Malware payload (Formbook)", "value": "db5360a9f8c8b6e3d7e69d04b6daa38f321dc9611e1a284642d31e1ee5fbb618360e3f2d4e40a451f66908e6549a3c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501301, "uuid": "f0c8a267-1b9d-4c98-8f50-7feebea4bb0a", "value": "T17C05126BE250AB22D37583F426A18558D3BDB8D11B96FE09AC4D34D302F77209E6770B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501301, "uuid": "5a0dde57-2639-487a-b09b-efa68bee1e4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501301, "uuid": "7d6dc19d-86be-470b-87d6-a1828f7892e6", "value": "24576:t7cG+URHdgkCXYtwpo0/4hhOlnmB3HolQfKIMYD:F1HC3YtwpqpIQfKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501301, "uuid": "2d061a4f-8fb6-4442-9cc0-566022bbead8", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501301, "uuid": "ba1867c8-e4db-4ea6-b2f4-0969908716d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501301, "uuid": "b511cd76-65a0-4deb-ae3c-fb6a9d5dfadd", "value": "e-Secure_DHL Paperworks_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f95ef94-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525535, "uuid": "4e954443-ab52-48a4-9446-6170f994f15d", "comment": "Malware payload (Gafgyt)", "value": "fb2911491e066917f4a74f5e508f7ae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525535, "uuid": "0bdf20f1-c103-4210-a11c-129cdc80fe1f", "comment": "Malware payload (Gafgyt)", "value": "9fc93ba0f3da99b6fe48d8306740aff07f97bf9aa1d8c84ef744b699c2c8b8b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525535, "uuid": "cf3e9ee6-98df-45bf-b627-5c7733434f84", "comment": "Malware payload (Gafgyt)", "value": "42bd44d737da6a0e50577be2145450e2370170a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525535, "uuid": "af758bc8-6e77-4707-8f11-b5a8199da637", "comment": "Malware payload (Gafgyt)", "value": "f437c243b097a4210f98c4686f6bdb4fa95dd38bfb6b377464fc32e1d195312cefa5bdeca592eebd9b0483a00e271463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525535, "uuid": "f06b355c-f0d8-45ad-b9e1-9b45b5e44a51", "value": "T1C8B31792F900DFF2F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525535, "uuid": "c80102f1-34a7-45d3-a91e-3639b2548938", "value": "3072:DG+3MNBCpCTyRQpimmrytKhs4OWlKhRm2pgYMx3IPtW:DHCTyRQuytAseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525535, "uuid": "afaddffe-a29e-45b5-a291-dff317f1f226", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525535, "uuid": "8b54e56c-a09e-4329-b37b-a4506d7f903b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525535, "uuid": "2504b789-69b7-4167-9b8c-c23b4108314f", "value": "fb2911491e066917f4a74f5e508f7ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea488326-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680522708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522708, "uuid": "41221ac1-a150-4f58-919d-32f4095ae0a6", "comment": "Malware payload (RedLineStealer)", "value": "8c34c443a798fdf03f083c7772433816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522708, "uuid": "88a3f0a8-6b5e-4be3-aeb3-07765d86299d", "comment": "Malware payload (RedLineStealer)", "value": "9fceb3cd904e0b485a8783368c537434d8a1cbaea8fdf386179f6ae20cf74154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522708, "uuid": "1ecd3d84-c622-4789-b58b-9ec7d421bec1", "comment": "Malware payload (RedLineStealer)", "value": "c9ad92533ade2728fe13caca72911c73a9b1ce26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522708, "uuid": "a8a45210-6d3c-485b-ae21-6157f26f0929", "comment": "Malware payload (RedLineStealer)", "value": "177ce9bb373936df82aef6ad4994796f03f9f1da641e88cb8968868c094785daf51722e3a7fc38f3627fa36dc153ceae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522708, "uuid": "bbcb6f7c-3c85-47be-9c19-d5f1a7d5613e", "value": "T1A5B41262F7E88132DCF527B019FA03531B367CA09974C76F274AA81A1D726D49536373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522708, "uuid": "c876c9b7-4c33-4106-bdb5-15736250cdde", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522708, "uuid": "723862c9-c9c5-4416-a253-9e3ddb62d7d0", "value": "6144:K7y+bnr+Tp0yN90QEFKgWPwdwBaZnOMUXjrDJaqN5SVEJsrS32eYdmALix9qyAVf:BMr3y90VDdwYOvD9/JsrS32T/Lzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522708, "uuid": "c6215113-5061-45dd-89b3-e5f1ea8c85fd", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522708, "uuid": "f7c15950-131a-4eb2-b543-9926ae88a75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522708, "uuid": "b632bef9-79fe-4aa6-a583-5ab20205109b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01efdf62-d23d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680539498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680539498, "uuid": "47f2a5eb-103c-41aa-9c3b-9fe64b2c1076", "comment": "Malware payload", "value": "1c812c7057527a6d163c54cc4ecc4830", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680539498, "uuid": "e79f9451-0808-4a5e-a910-362706ccac20", "comment": "Malware payload", "value": "a1452126afab8381749c34ab80303fcf95f94af500ba6acd7dba3fbbafa3295f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680539498, "uuid": "4a75aecd-a075-439a-9a61-45cb2d9cbaf4", "comment": "Malware payload", "value": "4d0eb4ce2b9834d680ea5593c8368e7899e8a1a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680539498, "uuid": "f287a3d2-5898-4b8d-ab56-1ff1b06131e0", "comment": "Malware payload", "value": "230dd2fd0c5e0d6f118f3904a8521fa95ea64f5fe0e5e1a4e7e7ec0a80425c1b4bb309b555c6e3ba69d691407d6edb9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680539498, "uuid": "7cde9238-422f-4fb4-99c4-6f716a5c2799", "value": "T1F9935C0176D1D0B8E4AF02361874AE015B7D7EA1DBF49DDB7B84168D6AB02C06F36B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680539498, "uuid": "b7faff58-45d8-4645-8613-31a7c4798a74", "value": "a71870b2900b81810c8101229eba3bda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680539498, "uuid": "5dd29f16-6b52-45cc-ac52-c64a61a351af", "value": "1536:yjGllSyDgwaiaAR6Ts7b8K5kASGlGWSoZ8dkEU+ScHA6sWjcdou8U+eUus7FhE:gDmDR77glU+3Qou8UPts7XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680539498, "uuid": "83af0959-1cd1-4820-b7c7-0dc7a7c75b1d", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680539498, "uuid": "7b454336-a0cb-48dd-a76d-07a7a8fded70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680539498, "uuid": "c3369c7c-3843-4cfd-a1a1-85e47489df94", "value": "SecuriteInfo.com.Trojan.GenericKD.66185990.4329.19280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd70446f-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680526606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "3dc2d6d0-c7cf-4f74-8e40-2f657d925e34", "comment": "Malware payload (AgentTesla)", "value": "c9f61ef43cc4a52305b67eba4b198dd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "bad08895-b865-418a-a936-056b9efb3e2f", "comment": "Malware payload (AgentTesla)", "value": "a149d594242461b2f92e8b4954e539ddf86e14217929ac18a3ae6fc26a7ad98c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "32b1899c-0697-475b-9329-776cc6c6cf1f", "comment": "Malware payload (AgentTesla)", "value": "18155d7d10db3ef43ac57cf00cedb313677d95c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "7b7e2ae2-d8fe-476b-8bd7-07bfab16fbc7", "comment": "Malware payload (AgentTesla)", "value": "820868f0db9e4f23fd6224a851627a390521f974d5c84c01e09623a7dc8126ba32cbc918a8e136c9819808a35a348b9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "0eda3494-4c76-47a9-adaf-5bbf0eb1f570", "value": "T1FEA4781029704C98FDDEAEB9982A01D759E2EC0E6561D51FCB183F4A85B434CFCDAAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "2d587039-76ec-42fd-8293-c4d6c5757666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "c3e4a1c5-474f-4485-9928-ef356f0571d3", "value": "6144:hHJ5qgkb3gKWbB210TcqQpyjdvp5BXFjQr9KB39BZ+gfHbv:NJ671acqQpypXBXFjQr9KB39Bkabv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526606, "uuid": "fd396014-a4ac-42a1-a50d-89addb284639", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526606, "uuid": "867c0d17-9ad7-4271-9152-be50682d8418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "a4e54505-0e20-49e1-90c5-36dfbdfc768d", "value": "PRODUCT LIST_MT014 & Boruh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7331e6e8-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680523367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523367, "uuid": "0e01aa9b-07af-4422-bff1-05b9e9a6f5f9", "comment": "Malware payload (Amadey)", "value": "68a9b3b951dd04cb7bc8b14efd585037", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523367, "uuid": "58be7685-da3e-4c87-ab73-45dd6cbc5760", "comment": "Malware payload (Amadey)", "value": "a17d4305d879fd288d926be3d78e28d798743522d0a0f9e98d7befe423a6bc88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523367, "uuid": "2be7d527-1a37-4ab9-8cda-c3bc16bdece5", "comment": "Malware payload (Amadey)", "value": "207a20aac8a8d1537d50fbb494215de4ae01cfe6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523367, "uuid": "858457a5-36c3-4d75-94e9-e1ab4268a782", "comment": "Malware payload (Amadey)", "value": "bb497e2d84d29de2f539b3fce62c12c0a7435b9ccf6f83496c241b1bc3a0c072e70f93244383a1702b85fa7299a46f10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523367, "uuid": "7fa49de2-ba79-4b41-8c68-2e396d523420", "value": "T103346D4256E86C30E63E47328F1EC2F4261EBC625E157F9B2679BE7F0970071D9A2315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523367, "uuid": "2a499f2c-34b8-4225-ad78-675c5096be90", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523367, "uuid": "2dffa5b5-66c6-4fbd-9fa1-57a8ccabb203", "value": "3072:188WRPZvdFUsQnRFhuCoPel4ispR7LMkjjhJunuRVlgf4y+hKx7XJLHhGSCOEP:OlZliVRLef1js8Vl84XhKx5LBTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523367, "uuid": "19cae0c3-10c3-488c-af24-f0363101018c", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523367, "uuid": "941e64a1-4d27-407b-a7f8-3192b3d8437e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523367, "uuid": "5dba1148-883c-43a3-8ddc-ed657671f131", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe9202a-d258-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680551386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551386, "uuid": "940a7cd4-bf91-4b18-9474-36740901d90a", "comment": "Malware payload (Gafgyt)", "value": "8e8ed0b7aff5bfd3cbf71b064d1cb3df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551386, "uuid": "60f4056b-c7d1-4385-9ce4-c1c37dbe9a92", "comment": "Malware payload (Gafgyt)", "value": "a23053307b88f5f698b59c7ef226e3b2346b78930ca19e63ce1c14df173fe9ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551386, "uuid": "294e3e9d-239a-4d49-a19b-997205919908", "comment": "Malware payload (Gafgyt)", "value": "f8b1627d2d38794bfdb6584c7943c11378f62c93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551386, "uuid": "4d102e37-99cd-4f96-9ed0-3e174551c6ed", "comment": "Malware payload (Gafgyt)", "value": "d77ed5c13e3f0f53f71c9434eccaf0b043a8e68e1e2b8fd001a353254774dbf3b494f2cecbdf162baa9d25c0b4c014b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551386, "uuid": "d1bdb839-14f4-499b-825b-0eebb3a59bec", "value": "T1DC93F8B5E642C7B3C8C307B202CBAA690D21B5EBDA1A9E09F33D7DF46B124C47512B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551386, "uuid": "f778eb5f-21aa-4435-ad8f-b3bdf262d414", "value": "1536:Yke9EM4qV+g04ykYMY/eAuPW5MQj+l2WgxKmF+wVOzjsXcfWDk:O9EM47VvkYZ/QemPl2WgxKmEwVOzjucp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551386, "uuid": "ebcf5de4-ae2f-4f50-94a0-59db92de4b89", "value": 93324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551386, "uuid": "eadc702a-058b-403d-9cfd-64a33f285509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551386, "uuid": "a0d5a9a7-3d46-497e-9236-f8aa4c018e53", "value": "8e8ed0b7aff5bfd3cbf71b064d1cb3df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0099d88-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680524838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "b8c2ed7e-32a9-4f4e-9631-7676be89deb0", "comment": "Malware payload (AgentTesla)", "value": "8b33f455d3011f5b75cdf053e59ab724", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "7d1b5a60-e211-4cc2-86a9-607f1be442db", "comment": "Malware payload (AgentTesla)", "value": "a274aac5116a0ac420cbef327f96663a687239d4e8668a2b89ad65b6147c8fe1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "e8dd7679-19a1-412a-b7c7-31c2a08f5ad6", "comment": "Malware payload (AgentTesla)", "value": "29c35484623d8b483e4f4e2f053b873b4d08f55c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524838, "uuid": "ec522c1f-d24b-4972-bdc7-415fd64c1ab5", "comment": "Malware payload (AgentTesla)", "value": "aafe133a433658f540992f0a995936e36b9f1ab52b0b2ae3748c2f7b088f33bae40d156b530fdc4635e6f98159119a30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "e86b3658-dc3a-4155-bbf5-3ed6eccf8f24", "value": "T1DBC2F942E79E03B88B511173672E1BC9A77DE63E735044A2786C9234339DC2E4676AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "e0c7cf1c-5549-4fb5-bc65-85bcf480739b", "value": "384:wQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZV1Xb14nJ33OzEQKXEq88koTs:sFx0XaIsnPRIa4fwJMdqnJ33QKXEj3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524838, "uuid": "40b95beb-30ab-4a69-aa83-095d400aaf16", "value": 27564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524838, "uuid": "42a65356-89dc-4d31-86e9-ec34e31ab731", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524838, "uuid": "1c07403d-32b9-448e-953a-7766d26a9b1f", "value": "INV000381021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5570f2d-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502540, "uuid": "813484c9-f5ed-48f0-89ed-a05c6400792a", "comment": "Malware payload (Mirai)", "value": "1ef0aa3f6c4675f4f0df6d31ca01e6e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502540, "uuid": "459a81fc-a6bf-4d10-acae-d2c6d11f2e0d", "comment": "Malware payload (Mirai)", "value": "a277125cb9e4442dc8c1e148945d8ef11366eaf022b2b14bc4f51294ec303032", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502540, "uuid": "d2894237-6920-4e9d-8122-7a3413283eaa", "comment": "Malware payload (Mirai)", "value": "ee7130293e037298ca693e5780974333191d4121", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502540, "uuid": "b2789e44-9cdd-4630-8c01-3365cae4e21b", "comment": "Malware payload (Mirai)", "value": "b4f608c2260fb8c46d3d44d6abf1fc759cac309c71638e4b414484e3bdc0ecc14ffd24eeac28bbee531ce90f9f64b405", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502540, "uuid": "90bc6e7d-8268-4f02-898f-835cd4715b04", "value": "T1C7436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502540, "uuid": "197862ed-aece-4b4a-b813-9509e4490094", "value": "1536:JeESt/basV2rcZhG6ySN7na6flSR9zWOIaEjrqMGs:JeESt/basVTgS7na6fQRVtXESd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502540, "uuid": "e5d61213-dea3-4077-97fd-08f4494128d2", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502540, "uuid": "e877bb5f-83f3-46e1-87bb-5e8362262af6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502540, "uuid": "f1b33bf9-aa69-4310-8540-6fec6005e85e", "value": "1ef0aa3f6c4675f4f0df6d31ca01e6e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234198e3-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532253, "uuid": "4e986638-f454-4c7f-af21-1f9b28146944", "comment": "Malware payload", "value": "f7c0088c034909f433ef6ee0aad16548", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532253, "uuid": "7d9b629d-b2d9-4f48-927d-9f2a4206ece1", "comment": "Malware payload", "value": "a29f527bae2543433440e83594e46d428e56ff7972e1fccf1ea7ac3d1aac3f12", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532253, "uuid": "61cc483f-b1e6-4a14-985d-c6abde833bfd", "comment": "Malware payload", "value": "f7f71151215a5aaddb2ec8f698a6916f1cfd22a3", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532253, "uuid": "3d5ed47b-8662-4b73-8df6-3b82265fc533", "comment": "Malware payload", "value": "292634e3532c4db6224c831f7b373d9e80495afec77d5a340da1f2d7b4499dea617e1636df8e54b2a09dab870b7a72eb", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532253, "uuid": "5bab20f6-cb84-4c72-804a-19a40cf0312f", "value": "T11645CE07179CDE1EEACF4A7690D440C1A670D676E79BE70B447038EA7B963B28F41386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532253, "uuid": "b570f704-d9dc-4fe9-8cca-a8c850ff53ae", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532253, "uuid": "cc3ca1bb-f419-4917-a1d4-3263d9d0fda2", "value": "24576:FPxTtDsAy7VjDGRU8T3uPUEgv+ZmGddBV6Xu0K:FjIjjDGRUG3uPPgUnB6+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532253, "uuid": "88ddc4f8-f719-4147-9229-bb3d7a34542a", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532253, "uuid": "24e4895b-d3e1-47e6-8f9f-ac9e05b03967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532253, "uuid": "63c66717-97f8-4fcf-9330-3abfbe8b71b4", "value": "29dd055ad24db1b2e7054b06ffc65225838b5b5a384036ef0d6ba33905824f3b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c44907-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501325, "uuid": "e3787465-75ec-4755-8362-5015f5854093", "comment": "Malware payload (Formbook)", "value": "db0f79a32d40391e30785165ca81c008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501325, "uuid": "4cdfa2e3-dcc4-4a8c-9f3c-4ae187400f33", "comment": "Malware payload (Formbook)", "value": "a3159a3432f7655c72a5189f65dac42733dba6d39955aabd16e395b50f6ffaa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501325, "uuid": "8b2e909f-1787-4eff-a1ac-da63b75a77d1", "comment": "Malware payload (Formbook)", "value": "a424f03f17c60ad350dfa339e259bf4e2d154397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501325, "uuid": "8447af50-c267-4740-8c4a-85c5ca5741aa", "comment": "Malware payload (Formbook)", "value": "1a45a0c95515b98aff71e75c2ff9efadf9b88980941c41b6a5a418c046f1fd0dc3d71f0cc971aea95312fbe8e29e5ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501325, "uuid": "f7b4b86a-4bbc-4d20-b4ea-bd9764593956", "value": "T13D051255F6946121DB3987F845A08D04C3BCA2D317A3EB49ED0C61E36EF53D40A2FA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501325, "uuid": "8fc94269-9676-4846-8db1-b615db527751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501325, "uuid": "942b7282-2cc4-46e3-a145-ab2af7af57c1", "value": "12288:zPiKdJVZz5dl97jd/XtKso1dBl3pZeUe6mhST75mEgBFFXNxbe1srfjSd:7FVZ9t7j9DG3Zl+y75mEgtXNZrfjSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501325, "uuid": "93a8e353-48d0-46a9-bfb5-affead867cb6", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501325, "uuid": "b9fb861b-984d-43d1-a9dd-d942fcb91f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501325, "uuid": "8f612956-6e1b-4cd1-ade9-8195f5a3c3f0", "value": "RE WO NO 23085EGYTVR GROUP LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146bb07c-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526644, "uuid": "625582ff-a061-4fd8-a404-53eaec51b1c1", "comment": "Malware payload (Gafgyt)", "value": "e0b16d808bc94891b534bcb13e08ae48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526644, "uuid": "2b3cd0ad-a50c-44d9-8c5e-8b07686c16b2", "comment": "Malware payload (Gafgyt)", "value": "a31d852d9864cc0aaf89ae275d7f3a82c3a6c9a1e7a351cafd98de2e2995c3a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526644, "uuid": "62eb013a-cff5-408e-909d-13ae54f6d4c2", "comment": "Malware payload (Gafgyt)", "value": "290181a587033db3ae6f29723148686ac85093c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526644, "uuid": "beccdb39-1c23-471c-bed3-c3f608da7b90", "comment": "Malware payload (Gafgyt)", "value": "fdb290bb03b9d88f36e1f7e3346e230799c18a66eec57895cbb82cb70f05b7d013d2a3180d1d148bff74957d1ba8580f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526644, "uuid": "e4cd1701-4d91-417c-873d-5bf76cfc836e", "value": "T12BC30A44F901475BC3D327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526644, "uuid": "33539dde-f994-4a7f-bb6f-639ca318209c", "value": "3072:H63VpNeuWDGeQf8sRCBt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCBt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526644, "uuid": "ff4ceac2-359b-4617-8b75-a01bc8102853", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526644, "uuid": "e201ce83-c88f-486f-b1ee-87cd947e8ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526644, "uuid": "75ef5a99-5bc3-49f0-9060-84fcd5431ace", "value": "e0b16d808bc94891b534bcb13e08ae48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e7dc4c-d220-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680527430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527430, "uuid": "b48e46b5-7e09-4008-b9a1-b0b08e1f8694", "comment": "Malware payload (RedLineStealer)", "value": "14fff14e7d39d4462284f368d2a38653", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527430, "uuid": "fbd016f4-61c6-4a7e-bf55-9863888fce2e", "comment": "Malware payload (RedLineStealer)", "value": "a3762c7852c46a46e63b3e0903d3319e4447a279b39127bb5f4bea7ea45fa59e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527430, "uuid": "e9dc61af-507a-4d18-9425-db9ba11f1317", "comment": "Malware payload (RedLineStealer)", "value": "ddb2437348240a9b85831d66e4fda1034ea63fb4", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527430, "uuid": "5e4d75f1-d1a1-41dc-815c-509654cf4845", "comment": "Malware payload (RedLineStealer)", "value": "8e5cd3ca8663cfdff051bb29363424fae50e95c6967f7133d76e23db896a12bfb46d32baead14a075a9c4c372384375b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527430, "uuid": "dded584f-ba0b-4e7e-a140-86eaa3ce78b5", "value": "T12D660389CAD33DEACA295E30E4873FB17200C920FD669A7707210ADA6FE7554CF13596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527430, "uuid": "097cb613-0fe6-4330-9ce4-3bac7357afdd", "value": "196608:D1i7fNYJyioulXrcGx91pSAtklc3Xm1NTGiSJ4+DFqM:D18KyiovGb1pSAocCCiuHhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527430, "uuid": "f37c21f7-7739-4a04-b516-f499d3f3bcf9", "value": 6740764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527430, "uuid": "5704bd5a-14eb-4736-9ed3-b97f46093c3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527430, "uuid": "6fb3ac05-b73a-437d-9444-d1431ca3a8a8", "value": "GTA_GHr98xW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa79a53-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525455, "uuid": "1d6db8d5-a08b-4e42-ba79-87cea6855a3b", "comment": "Malware payload (Rhadamanthys)", "value": "bd434864980824e06ced11bf2469e67a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525455, "uuid": "d5c9ca4d-8c13-4b12-b5a2-b535d3492dca", "comment": "Malware payload (Rhadamanthys)", "value": "a4b6a1619cf4ff65770be120cc415de1e8897c2378610171f3c48ff0fa38e9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525455, "uuid": "a09e52ec-2ff7-4555-bb37-b8c4d1460bf8", "comment": "Malware payload (Rhadamanthys)", "value": "7c37c4781fa6d44a4fc35a4d3cc78a35a13d8675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525455, "uuid": "3143cd38-9bcc-495e-b349-b707a23ebad3", "comment": "Malware payload (Rhadamanthys)", "value": "a31934d4c9fc27ccb67fe85239322e515babbb249e247d497d9e15e35f423cc8d07dcb8b1f5a32d2de54481410e3f46f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525455, "uuid": "6766d1f0-cd03-4b69-aa72-235184f6316c", "value": "T16B64C04227E16C70E1125B314E2EC7F4261FBC61AD257F9F2795BA3F0A341A1D2A271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525455, "uuid": "0e94950b-314a-4292-9c8a-b1fa13c565d0", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525455, "uuid": "51612dfc-82d4-4355-b8dd-cef780060a08", "value": "6144:ytp8XmnOMKz/+72bPefDqZuzsT43wE/6V6TIZtkjt:IyX8OMUxG+uz9gE/6cIGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525455, "uuid": "e147a14b-bca6-4d42-bd86-788d66227b2e", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525455, "uuid": "a9c15080-271a-4da9-9009-2cb4c93f3ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525455, "uuid": "c63f3f96-d1e2-4f5b-9f7e-c2d2c76fd64e", "value": "bd434864980824e06ced11bf2469e67a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb279de7-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680523085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523085, "uuid": "56de7d4a-b3c4-4a71-9387-85b8b605a994", "comment": "Malware payload (AgentTesla)", "value": "b6be1d349682bfc62dbf86e68ab8ec4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523085, "uuid": "31d02c9d-3151-47f1-be6c-353f8dd238dd", "comment": "Malware payload (AgentTesla)", "value": "a578c79ee5c97c543e2465e9740d3d827e61bddddbd9807a18a79c269e6cb37c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523085, "uuid": "101fd95b-0098-4f38-907b-fd3d1f660827", "comment": "Malware payload (AgentTesla)", "value": "98cbcf6d6d791f8520f8cf78629feac9e01d00fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523085, "uuid": "c11d3084-1b30-4671-bef6-5d066ec7da08", "comment": "Malware payload (AgentTesla)", "value": "9a31c2946d53d621afb131622978e594312d721c03503f371564e2c466c5e241bed4ee5d39d14bb0376d1e8b584c8447", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523085, "uuid": "13ca83a9-0c67-4e20-89cc-9948babc3526", "value": "T1FC225B2CC544F81ED221087ED01641F5E62E44AAE713BA6F2056B2DC4FA1AD7878EA69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523085, "uuid": "951ab758-e1f3-499b-afe3-ba117f5b7f17", "value": "192:ScIMmtPGT7G/bIwXOVO995SEzBC4vNq6sM63lb8p:SPXuT+xXOVOBhlqHhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523085, "uuid": "1affad51-e0ed-41c4-a6b9-8cdc77a2cde0", "value": 10359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523085, "uuid": "608e4922-e4c0-45b1-83a7-b76164d7fb99", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523085, "uuid": "5ad5ca55-980d-4e6f-a5c0-cd25df68137e", "value": "TTXSWIFTXCOPYXX37,000.00.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7bac98-d1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680488298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488298, "uuid": "d612a468-ae83-46ee-b173-38b27b6a6186", "comment": "Malware payload (RedLineStealer)", "value": "1341d2f2a20a89c43039bfe5315a65de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488298, "uuid": "92575108-9021-4d87-990e-ed3e6bf8305e", "comment": "Malware payload (RedLineStealer)", "value": "a5fd24e4a0759a16999d948a588ccf043bd0989516d96464be9ca1c2469828ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488298, "uuid": "3031a791-8e6e-48ff-96e4-00fb3d4da365", "comment": "Malware payload (RedLineStealer)", "value": "84ad69d51e4be441ecedfe1af51d9deb33e5b07a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488298, "uuid": "b15a451a-6142-415d-b5b3-0de8db3eae09", "comment": "Malware payload (RedLineStealer)", "value": "c6449973fe444c0c54c6e9ae5d44f03a92bb43a2dcb67ca671003f65c3ecfda11e7938e4990b0b9737c1d3d7075a2a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488298, "uuid": "23d40191-a29b-4fb3-b6bf-b53b61230f69", "value": "T135C41216A6D56037DCB52BB019FA07E31F357DA26E7487272345A88A1C73AC4983237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488298, "uuid": "4978f9c9-5036-4e53-9978-c5688a1e77b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488298, "uuid": "a60bc35d-dfac-4a3a-9971-ebb3ef8d8600", "value": "12288:DMrOy90/Z9e8Myv8CWZXUYiH0wstpFwiCwXzmL:JyL8ZvvWZXYUw0sUjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680488298, "uuid": "362ce034-97b5-44c4-b136-d558393d22fe", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680488298, "uuid": "c72a4950-3ff2-4124-aa35-45a76888608b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488298, "uuid": "c54ecc16-3857-4ffe-91cf-a4e1dcb40f1f", "value": "1341d2f2a20a89c43039bfe5315a65de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0939d5af-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501285, "uuid": "99ba1df5-0fc3-4efa-996f-2a0cc9ee4585", "comment": "Malware payload (GuLoader)", "value": "dfa4b593fe66e1a03e8a107ecf3469b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501285, "uuid": "d33ef341-7807-4ec3-804c-04c8fca265ef", "comment": "Malware payload (GuLoader)", "value": "a6ba0d72e3dd957fd8d17ca1c34bf5568b12c8d5a25684843b936be1e77e15a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501285, "uuid": "836de1e4-6243-4b02-909a-5a2af7c40c7e", "comment": "Malware payload (GuLoader)", "value": "68557fe13fb70bcfdd27e4ae891cd6b8578cee1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501285, "uuid": "da3002f6-0cd9-4fec-b036-cf7e511c90c2", "comment": "Malware payload (GuLoader)", "value": "4853b5160236fed2a49b07298e7bc75e59416ad5adb07ece798fae83014c14aa5df18755daa0462bc3795ac06c281774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501285, "uuid": "80135848-29a6-4677-a323-e0d464ecb24a", "value": "T1E024021521E0D473D2760AB05A3A4B51EFD2D302646E731F23A09F9CBD6AEE3C127867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501285, "uuid": "2eb92d11-ccf7-4e6c-89b0-0ec6fd27ba86", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501285, "uuid": "07309c0b-8cd7-4003-8e9c-c3252cf015e0", "value": "6144:+qjIdW5as26uB+6EsGGThp0NojOwFKWZ+Vhf:/YWd26S+/MT35jOwFyVhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501285, "uuid": "0e5da0db-9ada-4d12-aeee-b3c763251855", "value": 217722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501285, "uuid": "5883e6ea-0e88-4cb1-b117-376331e14e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501285, "uuid": "11145550-2c01-4864-8259-8d1567d35a85", "value": "0987654457008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaadad3-d1e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680503140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503140, "uuid": "98546e7d-a08c-4618-b8ec-7f6633772e70", "comment": "Malware payload (Mirai)", "value": "c506b9ac1d2c55f04dea6c7d4d284cf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503140, "uuid": "ae21be18-8a61-4f70-b603-c13e2e16c802", "comment": "Malware payload (Mirai)", "value": "a6f2ddaaf5c9d1e60d2949945212a7429fd51f4e139a9d58f1c880942fc99f12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503140, "uuid": "ed337d7b-323e-4a7d-ae9d-6a6f243c10e2", "comment": "Malware payload (Mirai)", "value": "c0dacafe20c8e82b0e2006636c2b63f613000312", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680503140, "uuid": "c4f2bb4f-971f-4d13-8ccb-e8522bbf00e4", "comment": "Malware payload (Mirai)", "value": "32771e5a68c67b1baec80711869048a642b573f9657948d83b42ab3f53e27bdac1d419e6b8340ee63712645027ede08a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503140, "uuid": "771607b4-df73-429e-941b-e68cc475c1c3", "value": "T161632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503140, "uuid": "1ca9eb1d-738f-448b-95ee-ddb5e53b4117", "value": "1536:lGBVg7AOotXhGIAsQXt3AYQbQm75YH/tatGV:lSCzxBoQmVNYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680503140, "uuid": "09182d89-713a-4ab9-9a54-130044d9da67", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680503140, "uuid": "fced12db-7853-4ac4-a531-7a81ee87371b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680503140, "uuid": "01a93534-9866-4703-97b8-d0fa22407fdf", "value": "c506b9ac1d2c55f04dea6c7d4d284cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63dbb39-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680523480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523480, "uuid": "92f86dd9-a603-46dd-a86a-5dd3f059eb59", "comment": "Malware payload (Guildma)", "value": "97ba564ff0f5826696f9327c9b4e259e", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523480, "uuid": "576390a1-acba-41e6-a836-617d1ec2c033", "comment": "Malware payload (Guildma)", "value": "a75915335f7a48af8385b7911bb571f139658dbe3d5ed12eef11485f1f3a57fd", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523480, "uuid": "52110056-eda0-455c-b647-bdf3e96eb021", "comment": "Malware payload (Guildma)", "value": "bf3701aef0768dae7daa65ab9f6d65d8e0539bfa", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523480, "uuid": "5660df7c-00ba-4253-82b9-fd0382900f07", "comment": "Malware payload (Guildma)", "value": "b57e9de83c474ea055dc84badcfa0a501e07cd5629143aca294aaf79762d9d849cf5baf4246655d281d6800afc816d63", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523480, "uuid": "8b3ec3db-0f8c-4f86-a7ca-4a38a42c61e2", "value": "T19D42FFBD112DB478FBC8792198A9C17DBBD8543E0288DDD55A122B0713CB1AC4CD6FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523480, "uuid": "657f2d2e-5db1-4329-af81-c861c60e8c86", "value": "192:3lURJBurRcMp7Yv933EkilifXAhKZS2w7tvnFd3rNFsCK0UnncOKX:1URvurRdp7A933ETi9ZS20YCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523480, "uuid": "2a1aace7-b0f8-4fac-920a-7026c0f2ed7c", "value": 12047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523480, "uuid": "cb8e6e99-9512-4f82-b564-1e546d80b163", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523480, "uuid": "d258f942-fa14-4981-9086-74c5d41835b0", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb92949-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680526606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "0f7b31ec-2eb9-4918-9033-b138294db6b1", "comment": "Malware payload (Mirai)", "value": "5ae1892504cefe4841a53b28be7ab505", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "50635804-dffd-406b-a45b-cdee5d47e963", "comment": "Malware payload (Mirai)", "value": "a8526de8f9c98cc5a6a8d9e34661e1a1d721fd506e2628b819f3973981a3a935", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "90c6ce29-9d42-4ee0-bb50-02c9641005bb", "comment": "Malware payload (Mirai)", "value": "9ebce32beb2a25f3152179c2e31e16d5ca48f315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526606, "uuid": "dbbf3d0c-db53-439e-9e81-a34d4a8a1232", "comment": "Malware payload (Mirai)", "value": "c020e2a6ea137a68672304ee5434437de846c68df6b0a05cf8b9d12dde45146eab06dffc06322e9508ac16384725b9ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "86cd140e-e5e3-4ac9-b320-d3bf25b77a0d", "value": "T14EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "9d2cf4c3-612d-48a9-b91b-4db871b24def", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1S/LWy:c9sSyzz36YaWWgg1Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526606, "uuid": "21b1cd8e-e67c-44db-9bb4-5f468fbe428b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526606, "uuid": "d0990810-754c-40d4-9293-44aee6f23a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526606, "uuid": "2e4208ee-d365-4d05-a063-f96d8a0afacc", "value": "5ae1892504cefe4841a53b28be7ab505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edd7970-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496141, "uuid": "17ea6970-3115-4798-b80e-9e582bdfba31", "comment": "Malware payload", "value": "bedbae9dda47455d60a15f1b810c6386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496141, "uuid": "f4f7250a-3296-4218-abdf-b2af1ea1e33e", "comment": "Malware payload", "value": "a85d8783173ede8885f34205b5f2bd0bf32af21eb1d6c9a4d51adf63d8760add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496141, "uuid": "d3d24a94-f2a5-4db5-b3a6-b765adc4f738", "comment": "Malware payload", "value": "10bdeaa57935ece9170ca11ae42e8f6470b2c52a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496141, "uuid": "fec06bd5-998c-48fd-9f8d-e6afbe253488", "comment": "Malware payload", "value": "fb8e33e83163900929938101709082d508cb0e305a37f68773150696ce6e1a359cb87b55b031fd9294c04b0f8ba88776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496141, "uuid": "ff3ace1e-0a4b-45d5-90fe-3864ad70c95c", "value": "T1AD854C12B395793BD03A2B364D7BC6925C377D202F56CC5B2FF48A0C0E796416C3AA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496141, "uuid": "6fa3bdd6-ed60-4900-ae36-119eb1f52b96", "value": "24576:S/+2KS3cG/wKK/Y6rgKiDdJ2kmABiS9nmAPlQ+FwUlJ2gET:SVz4Z6bb8SwAzlJ2ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496141, "uuid": "ea0e79bc-fb8c-4c9b-8a5f-ac4c1e544b89", "value": 1811456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496141, "uuid": "7d1b88d5-c29f-413f-ae61-3839405862c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496141, "uuid": "fe4cb96b-462a-4406-86a1-06680ecbe6f3", "value": "SecuriteInfo.com.W32.PossibleThreat.22814.3401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3180e64f-d266-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680557187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557187, "uuid": "8be211de-6761-43cf-bc6b-58c6ec356200", "comment": "Malware payload", "value": "ae72a6d540f0205e82c94fe700cc47c4", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557187, "uuid": "035b19db-051e-426b-a40c-c669f122a97a", "comment": "Malware payload", "value": "a9038e14caa45be813f4a558f99b6b409b0d5d7c530c4ad74119afff42b4ad8d", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557187, "uuid": "81580690-1c33-4761-a250-2814f37dd241", "comment": "Malware payload", "value": "51bb32d6ec6786045c915328c581dbe84c503ca8", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557187, "uuid": "e0ec8fcc-52f2-4b9f-838d-63e5a33a85e4", "comment": "Malware payload", "value": "e28b20f2e66375a8cc998afb9e0b057617ece24b9390148b5f4f98b3cd8497f7e33c0713f4f387f147c90dc81d43266d", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557187, "uuid": "20e5dab6-0571-4bb0-916d-0593451dffe2", "value": "T1DD76338122972800F6DB98459EF1768EB53F9B929CE6B7E5FFCC124ED40EBD50224781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557187, "uuid": "146589ff-e3c1-42b4-9395-1ba14af5d179", "value": "196608:TB9Ho7ef06MfjOqhFHtkZexVSj4TgLPydgR:DHoif06MfjOWiTj4TgLKdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680557187, "uuid": "1d4f849f-f988-40c2-9af8-2ea2349d06e8", "value": 7434410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680557187, "uuid": "d3df8d46-59ef-459b-af00-98abdcff9115", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557187, "uuid": "533d9184-16f7-465d-b838-a7d41f53aaa1", "value": "AFWQ5EX5KXOEKJSKN2MI_FQW6O9.ZIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4501894-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680522161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522161, "uuid": "347175bb-b6e9-4f11-ad7d-f7fbabe9fc9b", "comment": "Malware payload (Amadey)", "value": "f95f81d6c7882f7877954e9b6f5040a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522161, "uuid": "45d571c3-4d0e-4926-9e17-d86bce63ea95", "comment": "Malware payload (Amadey)", "value": "a92fd92373495563a700b28906bb7ae0f8a727bbc4b440ead8ea8471db73c2fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522161, "uuid": "ec8e42b1-e401-4ab5-87ed-899815b34b8f", "comment": "Malware payload (Amadey)", "value": "e65a3321e0fecf7b6fd4cfe4d4ffbd4072ffb5af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522161, "uuid": "8d05db42-7afc-44e0-a177-4a0ad8da7500", "comment": "Malware payload (Amadey)", "value": "8aec5e243dfa81356ef9d35d9fa649d741cc0788ac2ab791b0728f413935b715aa54e1275d0e0a06ab107a5a88e9e964", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522161, "uuid": "330c14db-2932-40f6-91d4-930658ab778a", "value": "T1F414C021BFA1C0B3D4278D745566CAB06A2F78B1D7A584DBF3441B7F0E312D05ABA326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522161, "uuid": "7e4fd658-8b6f-4d15-aef6-585b476f96c0", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522161, "uuid": "f7e65a8d-0570-401b-ab42-c66dd50ca22e", "value": "3072:9YgwECNPpTcAyAxc62/EF3snmKGVD+pokE95vSCG:SrBtncOF+G1jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522161, "uuid": "2bb70f97-f27f-4c1d-8de6-c590c285ff4a", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522161, "uuid": "e9a93753-a40a-4b61-8f1f-86b7011ab13f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522161, "uuid": "2f1d3650-500a-4a3f-be5e-04f3eb8461ec", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca7f04a-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680512297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512297, "uuid": "aa644bca-2095-4582-9aab-d8b577c1f58e", "comment": "Malware payload (Stealc)", "value": "e2f39784711ffb87807a4b2e98620445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512297, "uuid": "4de10168-ad01-4822-95f9-773b4b134887", "comment": "Malware payload (Stealc)", "value": "a99d2aa4e7ee4cd0126e92c3d55a4b1e59321c9e421b0cb87294bc1fc6c78604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512297, "uuid": "4b2b74f6-f0af-4556-8788-d14dc1d2106b", "comment": "Malware payload (Stealc)", "value": "602b933bd2c0f1908e2cfef6ad24643ef356487a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512297, "uuid": "199b08d1-bbd4-4bd9-a1a1-fd62cc8d01aa", "comment": "Malware payload (Stealc)", "value": "bee9d6f1f419e41b2ed0e66076167271819f78b5aef675a64ebf10b3a131a18d6704904a2dac90f6916368534da9da55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512297, "uuid": "de697d9e-361d-4d9f-a4d6-846188829a54", "value": "T10AD6339F2899E0EDCFCB56308247FBCA35F602E54EA089187DC4D4C578F3FA96192199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512297, "uuid": "f47ac85c-b41b-4e79-9f99-8c14f4a6af3b", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512297, "uuid": "9bff1ff9-74e0-42cb-a83a-1c19e094110c", "value": "196608:BsfjuaOd6pWSMdG4Q0WEgACGD+lNrYHMACxCBSIKbKaFwLWaw8m1HQD7VF9pS2P4:qjyd6p9MdGV2ilZYsAC7ImFa08m1w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512297, "uuid": "3270f37f-6380-43db-a032-524bfab0de9b", "value": 13048656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512297, "uuid": "5d62e017-6e77-4153-ae5f-96264c07b4f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512297, "uuid": "958ef49c-2078-4170-bff6-9331bfea2e31", "value": "e2f39784711ffb87807a4b2e98620445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40845085-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545616, "uuid": "c8f32c86-be2d-4172-a08a-b7493ccc501e", "comment": "Malware payload (Mirai)", "value": "c82ffa31d3890c3fde2b767eb656bfdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545616, "uuid": "cb72700a-9ab0-4db0-afff-4ce4ed30756f", "comment": "Malware payload (Mirai)", "value": "aa70d672916c1a8a994ad9a86bec482e234381914b188bcc6b8923f488e23492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545616, "uuid": "ed1aa547-2872-4bce-9c97-30a88d4e7475", "comment": "Malware payload (Mirai)", "value": "a1f18c9aa61f98f5011befd5c3653dead64c06d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545616, "uuid": "39fafbfd-b4d4-43cb-99e4-5b2752e594b9", "comment": "Malware payload (Mirai)", "value": "6c4369bcf6dfb359386aa87cdf2ac571cda5cf033f125b007998af3c19fdec1039f316323a718de45e1f10474f0a8c54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545616, "uuid": "fed938e2-ee69-4701-93d6-1e59b34d9721", "value": "T149633BDAF801DD7DF81BD77A4457090AB630B3D502831B3B6397B9A7BC721A81E12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545616, "uuid": "055943b5-0808-42ae-9602-cade497f6e5a", "value": "1536:vAgV/fxEhaLDY7Dm8VJyyE1sxQWbxdJ3rWNzE+VQPy:vAQ/fOhAE7DiyE1GQSx/B+VGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545616, "uuid": "22b59543-27ef-4446-985a-54de4a0d5a44", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545616, "uuid": "1a55e35f-e54e-4aac-baa9-588d75acef64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545616, "uuid": "536c4981-6ab8-47e1-91c7-e77b94302a8f", "value": "c82ffa31d3890c3fde2b767eb656bfdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc7b8be-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1680528725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528725, "uuid": "442d21c5-6c1d-4673-993c-f5a00522a1eb", "comment": "Malware payload (Guildma)", "value": "0ef27bfefe5279bf0d50edbb15759f8b", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528725, "uuid": "25314791-03cf-493f-b014-69f6cddedf72", "comment": "Malware payload (Guildma)", "value": "aaa39e0fb3cecb35b0686ba21e6ed4082ae8aeef2bf6951d226f56e017327c8c", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528725, "uuid": "79dcf8a0-f63b-4666-9c5e-f048868a54b0", "comment": "Malware payload (Guildma)", "value": "7eae4761f77de97234b190a644f2337065864268", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528725, "uuid": "b942de3a-ed4a-4d6b-bb47-c8078df94efb", "comment": "Malware payload (Guildma)", "value": "e325bfa7f8a7fb500cd004337d03c17ecbc5d5f48e6e6b0578b9981eb248df880d70897228af5cdddda77a4c7ae40aa6", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528725, "uuid": "cb8f818c-68c6-4151-84a9-88ed0fe2409f", "value": "T169E07D2EF2B06D02505C10401DB63B7B099C59674F913417CAC7D7104AADD17E53D608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528725, "uuid": "0fa9d4ce-bc12-447e-a32f-5bf91c8551ff", "value": "6:SGIfGlkGsncUiggdIjdjLE2zKOmBmsXezNBhVjZLSQolQr4WgBAz6qVbXv:QgkGoBRjdjLEsKOmBm7zNBhJ/r1p3Vbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528725, "uuid": "31d77714-1037-4fe1-9cc8-0f96b4eef525", "value": 309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528725, "uuid": "e225cbb0-cec7-4c67-8236-2a4be280f849", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528725, "uuid": "d17ff794-a990-4df5-bc7a-5c5b830e9821", "value": "49_CONTRATO.Zipa__734.49328642.487626.71106.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19434cc2-d20b-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680518062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518062, "uuid": "17473882-cbd1-4bbd-aa58-4d00e5285d84", "comment": "Malware payload (QuasarRAT)", "value": "c1a3b6012424b44a5c9e900a972900df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518062, "uuid": "49296385-4b2e-43fd-a275-060d1dc74a62", "comment": "Malware payload (QuasarRAT)", "value": "aadbce9709297233303ae47d178234785598e1fd7f95e3d7366e7912a772986d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518062, "uuid": "46e38c87-2241-4018-b550-e8b25a291f90", "comment": "Malware payload (QuasarRAT)", "value": "c05570a3504b13b2ce460e303b9d2009a905d04a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680518062, "uuid": "9f5aacce-e4c5-47bb-b659-0c5aa19db701", "comment": "Malware payload (QuasarRAT)", "value": "4d4e6712e837e714a475aba7d322940ad7d6fa2d009cd20881f3fd3b12969fb0b6c5387a7c12c9ddd9dd7ddcb1ae3a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518062, "uuid": "6c4e225c-d52f-4a03-a674-c0139134da27", "value": "T1A2749D5773A8D53BD1FE1736E03246154BB4D8837616F38B5A6C42B9AC233868D923B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518062, "uuid": "37b0d272-51ab-46ed-b23c-189f060ec748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518062, "uuid": "7640fc32-c2a2-4463-ad9c-449cd76d4059", "value": "6144:5+2NHXf500MmOSPSS/xOvZboMI07dGTla:Ld50kSCS3I07dGTla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680518062, "uuid": "3b24c348-271a-4a1e-b887-022b6abbdab4", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680518062, "uuid": "2e8a696e-3f7f-4283-98ac-91f6ed9cb11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680518062, "uuid": "d4245b1f-0cbf-42af-8104-e0ddfe259bd7", "value": "xBZPckUxW4B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16db2d23-d221-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680527507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527507, "uuid": "3472e323-1c5a-47f1-9565-4f4b17498f84", "comment": "Malware payload (AgentTesla)", "value": "edbfe9219e5b53f41d49c61d42a83935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527507, "uuid": "59511791-564c-437a-8fed-42b451012e69", "comment": "Malware payload (AgentTesla)", "value": "aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527507, "uuid": "98468ab9-ef91-4b31-9fda-d382119c41a7", "comment": "Malware payload (AgentTesla)", "value": "6449461451d38ee4786c3c25721eba354456b684", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527507, "uuid": "b3dc436a-2f3a-42ec-bd5d-fe9504ebd3ee", "comment": "Malware payload (AgentTesla)", "value": "634a8a872e9b83b5aa5efa96118b27cf39b234414459f6dc1114ce4165b4877f3ff0713ee656e7cc773a59f607154d54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527507, "uuid": "3c5be28f-b40c-4d03-a256-754a5f7f5d57", "value": "T19FF402742FEA5235F8B62BBE90E43991977E63B32753C94D08B520C54B23B035AD193B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527507, "uuid": "e52617d7-9aba-4de4-8a4c-b03d6ef94ad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527507, "uuid": "9a509082-9369-41ba-ab06-af9e713c2289", "value": "12288:f0tmYMUnFW/NobMbGWcSZ0nMMLjsjneNwfIttZvoERDSTnF42LrzrI:f0tU+zWHScKwCvRD6nF42Lrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527507, "uuid": "aaa76228-70a8-4534-98e5-f8d5eeab7866", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527507, "uuid": "d206c256-c896-4f51-87d2-b3b53d6c9fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527507, "uuid": "af4156bd-aad6-4e8d-8119-41624c5b7fb5", "value": "aadd267ebc7dde803f8d0486df95ad9eb6db7f1600fb7fcc0bbba70cd26bfcd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc366b1-d227-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680530443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530443, "uuid": "584b0d64-d781-4840-8af6-6d53e63825a8", "comment": "Malware payload (SnakeKeylogger)", "value": "a3ccecf14c52d5e7485f090d41f4c40f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530443, "uuid": "87943d3f-3593-4203-9c8c-1634da3fd224", "comment": "Malware payload (SnakeKeylogger)", "value": "ab01f57433e7c5f9246c1bac8fc6f2711faa773210201b6478d9fc420b298896", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530443, "uuid": "d5044cd4-bebf-44b7-976b-e55b4cd2cb1e", "comment": "Malware payload (SnakeKeylogger)", "value": "ca73c7eb0da3e21312da661309e1e7cd8074611e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680530443, "uuid": "3e44a49f-72e8-4fac-8391-d9d96731955d", "comment": "Malware payload (SnakeKeylogger)", "value": "049a2fc43e0338549ce77c9c99355fe42d92b40d676f055e618978e33abadfe9589d099a74871bd4b3d109de8de1b688", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530443, "uuid": "789e01ad-4633-4566-8c84-7ea0308e6b0d", "value": "T1C7B4237F9CB21192990CB734251192C98776010E569CF27FB0EAAF3ACC42153F5AABD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530443, "uuid": "6ba5f193-bf1b-4dae-b260-5e84f3e86e76", "value": "12288:5Omg/slBOyfpinOREFK2LKrxwTAB3W6VTc8bpX0g7bcXoeoNDWprQhryZ:vUsOyfpiO7oCxXvXE+cXoeoN4rOuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680530443, "uuid": "1a64fd01-a695-45e9-8f16-d399d1a5ae59", "value": 535140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680530443, "uuid": "482e449d-a5a1-4eaf-9612-37c2db3a450c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680530443, "uuid": "c6a8dc38-5837-4803-8ce8-a02ac33a67f4", "value": "Inquiry_03042023.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91349967-d1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680501943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501943, "uuid": "be3b38e8-af6a-46c4-be3a-899de55f54a4", "comment": "Malware payload (Mirai)", "value": "5971887b796224a46d55faf235c642f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501943, "uuid": "a28c2482-fa37-47d5-bbcd-0415991ce107", "comment": "Malware payload (Mirai)", "value": "ab2e21c310b9f0d048c0a49d0675a798dc1e574ea1a35ea9178dbd8fc1900667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501943, "uuid": "5cc1b384-466d-4bab-9107-99f4975640ba", "comment": "Malware payload (Mirai)", "value": "d274e7cb79471b14814b5c9eb50a686f16ebc3a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501943, "uuid": "94f1d6f8-68e6-45cf-8a16-be7ce2aa77e2", "comment": "Malware payload (Mirai)", "value": "92704fbf54db1a85616b5cf9aae5c073a1132e6fdd7d5b085bf9f6a20b72e082db6d8161c2f330151da7ad7a41611949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501943, "uuid": "3538e41d-8acd-48c7-b6ca-35425f84e338", "value": "T12D633851BC819A13C6D1127BFA6E028D3B2623E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501943, "uuid": "c136de44-402f-4553-a36e-246944a26056", "value": "1536:iNSlxAmiik110lOO//kWUjicisI3AA8PNRu5AvbWW:iN/Cbkd2cisI3/+Vbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501943, "uuid": "3d976870-6f8d-4488-80d1-8649dd189acd", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501943, "uuid": "e8228aaf-9727-4a55-9602-a0abefa492bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501943, "uuid": "c13f3bf4-9b92-4b5b-8e6e-5ef382dd103d", "value": "5971887b796224a46d55faf235c642f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd25b0e2-d1c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680487440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487440, "uuid": "c7aff663-06c4-4220-8bda-acce7602b20c", "comment": "Malware payload (RedLineStealer)", "value": "9b125319bc46f6eb974762e6271ec720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487440, "uuid": "7bc64ae6-ddf8-496f-8f3a-dcfb4805e6b8", "comment": "Malware payload (RedLineStealer)", "value": "abbecf934dca91df9531edeea501ecec70552222ab5cba7d16140afdbf8f546a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487440, "uuid": "33469930-3a4c-4669-ad96-f080f1007263", "comment": "Malware payload (RedLineStealer)", "value": "17d40fac9292397c56a5d15c2fc12bc2f8094447", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680487440, "uuid": "15d7b4c5-0795-4063-953e-39a12c3fc214", "comment": "Malware payload (RedLineStealer)", "value": "be9c35a6304a03b882a60a84bc0c659c35db412201b0caf6dae13be44136339c1825af22ea480bc61b6a4357de0ba021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487440, "uuid": "d23633cf-e458-4863-b934-0ceba7ee91b8", "value": "T13AE412036BE86163CAB137B018FB03930B367C71AEB8D77A2395595F08B2594A472777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487440, "uuid": "77c854f3-cc10-416b-9f7b-1d44ae3bd5ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487440, "uuid": "dde560b9-ae71-48ea-99a5-e748b243e728", "value": "12288:jMrgy90dJbQ8TC0HMw2k69BGvVpXC/vfUVRpLrUL1b/wRhANRlvbC7ek:DyK28v1qBGDsELLrUjwkNzG7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680487440, "uuid": "ffba3477-ad92-4c25-86e3-8739b55dae09", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680487440, "uuid": "3aed66cf-3c09-4b7e-b1c1-08195167300e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680487440, "uuid": "f3971198-1f6d-4315-9a3c-ba9d838841f5", "value": "9b125319bc46f6eb974762e6271ec720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fcbe82-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680527028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527028, "uuid": "f7aa7bb3-2108-446c-b753-d570b22214db", "comment": "Malware payload", "value": "4c68cdcee61b7ca978a44574724776e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527028, "uuid": "082e3be4-6372-4b0c-860c-15b566f35f88", "comment": "Malware payload", "value": "abc8dc742c2779dfa76c418f3871e6172ebbf66fa4fbd4c86fadccafeebd2c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527028, "uuid": "a3be4810-f7d5-403e-818d-3c8aeb148e6a", "comment": "Malware payload", "value": "ce11d2ceebe6ed03c67f0e6ea9b8fe416f2b571d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527028, "uuid": "95b64687-af9d-4d09-b5d3-31beb1d7dcdb", "comment": "Malware payload", "value": "49d7d1ba3f332ec18adba31585e8ed0f1b53c38b0a6a3dea5e107f40046d9e66aa7cd7560ea2c06a77a266811b7f19e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527028, "uuid": "9556efcb-af3f-483b-9172-dc098b0debd8", "value": "T1C2240269AEE4381FC80F9BB9A8E455186771E2D57F43C2D62485C0E50F933E2F5AA360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527028, "uuid": "e5bd9e05-eea7-41c3-b31a-2ada4964fd2e", "value": "6144:rQCvwJVT3DWFg3jgTzWGtTgpiRiKP2klSI:aJVLLg/lUprKP2xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527028, "uuid": "806cf02c-1a3d-40d8-9061-9fdb408d03a9", "value": 219368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527028, "uuid": "a57d6195-f784-43ff-88ea-942ea3321bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527028, "uuid": "afe3fc95-07de-4307-8624-79ade5ab00f1", "value": "Order nr 220489 (#E83308).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39eb9a0-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680519717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519717, "uuid": "619c57f2-44bc-430f-8766-29261d5ad27e", "comment": "Malware payload (Vidar)", "value": "281953dc6f8ef4f67b2f5653fcbc2bc7", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519717, "uuid": "60a277c7-da72-4bac-8cc5-00f33cefec98", "comment": "Malware payload (Vidar)", "value": "acb4d0a5a18430c1ae3208055d80f0b887d23e49b1c11460b9ed1f0f44d74e96", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519717, "uuid": "ea1a160b-63f5-4d55-835e-3f251899fd40", "comment": "Malware payload (Vidar)", "value": "fbeb6f41e9158c27dde1529488d95bb4fc806089", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519717, "uuid": "b2775f9d-efc5-4976-b229-b5606fb983ed", "comment": "Malware payload (Vidar)", "value": "6a5bdc13f5abcdb46a07c129b8644e45f90231bd358732262b552366e061eda5287071becebdcfd0336b9f074984e7ed", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519717, "uuid": "fe4fd07f-1e9f-454e-ae00-32d6ba9b847d", "value": "T177C6336B91FE0401068DF72DCEF97242E5AE05CB7A343B74A084D17DEA80647F26A5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519717, "uuid": "a86e38da-25a0-42ef-b9ff-042eabeca0cf", "value": "196608:WlilJs7inD8F7Mju5HLAO9XMih6ROhNsygaFIJy7/whvnVmsC3gJVihCZcsuG02P:lsGD8F7Mi50mRhbNsZaFaAY/VmNgjihy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519717, "uuid": "3f280a2a-1a6b-4c1c-9607-90ebc38a3870", "value": 12217998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519717, "uuid": "9035497b-bd5c-4267-877a-02cb2e90c899", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519717, "uuid": "118bf01e-9a9e-4145-95f1-ef4ee4195c8a", "value": "GTA5 Mod Menu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b63513d-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496135, "uuid": "cdc4e987-c3b2-4aff-be62-d87dfc5f69ec", "comment": "Malware payload", "value": "8b7de5d5007c3b153357189f49f421ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496135, "uuid": "4fdbfd76-de07-4334-b506-4fa8d1b9ce17", "comment": "Malware payload", "value": "aee70e4294c47b9cbe681db4b3660ee65ca4275a4311a1240b57696bb537095e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496135, "uuid": "cd314ab4-268a-45ef-ad4e-0640b2853c42", "comment": "Malware payload", "value": "60ad0a8071186698354e8389fcdc0dcf6ea0fbae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496135, "uuid": "ad903a5d-230a-4edc-bdbc-9069b348eb76", "comment": "Malware payload", "value": "44dcce760d479f1957d3a64a66d99361b30be2a553e289738dea7dd007fe759835a6656d3e60c8c3350a987bf1e3e6eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496135, "uuid": "00676973-adde-458d-9580-76da7190109b", "value": "T1CE257DA27BD740C5D4D23DB10577D225AF3AE93A53138ACBFB501DB28B21930AE64772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496135, "uuid": "006d106c-4811-447e-88c8-8efc86bd35ef", "value": "6144:5pqHatM6HfHCikx6xcHTEMI2cumYYhhHx4zgvoxm5bGDdMXK3iZ5TEvfHlpxExYF:5pe6fHCDx6+khR4dxUCmovfFEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496135, "uuid": "86a50444-fae5-4f5f-9c14-dc1be649f712", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496135, "uuid": "cf35fba4-9afd-4813-bb70-e28869585ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496135, "uuid": "deaa4bd6-3d5d-47ec-b53f-2a5cf3217282", "value": "SecuriteInfo.com.Trojan.Crypt.7492.31894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917ae14f-d218-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680523848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523848, "uuid": "a9afb46a-6ddd-46c6-a0eb-a9e1bd6edc52", "comment": "Malware payload (SnakeKeylogger)", "value": "7072f279352be22947b388415b341214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523848, "uuid": "4c9f5fae-1868-4d11-89a7-e72f33982d0f", "comment": "Malware payload (SnakeKeylogger)", "value": "af6fb4c1ccf63b051ee34879d049105a0cc2226cb6f0f03c2d1efa7a67c62a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523848, "uuid": "2f809f39-dbe5-4b26-afdd-747be8cb67ef", "comment": "Malware payload (SnakeKeylogger)", "value": "1feca8e41d1554fb24ab24878bbf387c5f13ab07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523848, "uuid": "56efa89e-83b6-46fe-b3c3-929558230ec8", "comment": "Malware payload (SnakeKeylogger)", "value": "0f2322f972ab901fa945b8286bab527aff7a5a9c233adf6b82ef11b0d273a0d9e2d14732f8172926c2523aebaf942ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523848, "uuid": "c1b71d13-9f03-4b98-b8b3-d0dc4f60a8f8", "value": "T144257ED1F150CC9AED6B06F2AD2BA53024A7BE9D54A4810C559E7B1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523848, "uuid": "889596c1-392f-4ffb-bffa-b95f2bf5ca87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523848, "uuid": "213e2c2c-c822-4685-adae-1d91a3fc918d", "value": "12288:U5CBWKdq1FbwwJLwriPRVyVYivDRHQJSWWv86VIEIVgcLwHpxkiaNPJZ:Pfrp2PRV43RwJSWWUjVVgSwHpxoNPJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523848, "uuid": "77119eaf-5771-4d0d-a579-ae537de67133", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523848, "uuid": "da685baa-2161-43ba-b6f9-3a6759474d89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523848, "uuid": "b35fd1e6-172f-40be-ab89-2713087f5262", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a8a014-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524586, "uuid": "1077ef03-544c-44bf-ab50-83c7945b5348", "comment": "Malware payload (SnakeKeylogger)", "value": "c2a405a843478d20e33c99387dbf9ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524586, "uuid": "a4608451-8271-4c75-b380-4e1219719831", "comment": "Malware payload (SnakeKeylogger)", "value": "af7df67e68a7dc19f08d1c34f663be0febbbf4fab6f7a204dc1571a00a9cb224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524586, "uuid": "dec0dfb0-0d71-4c33-86de-6106845b9afd", "comment": "Malware payload (SnakeKeylogger)", "value": "79e9d7cbc999f186ad370848596ae2ceaaa7f08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524586, "uuid": "46182a12-ff7f-4a21-88e7-79fcb9ccb040", "comment": "Malware payload (SnakeKeylogger)", "value": "f2f9106da048e6a9e09ce75a6bfc915feea60c62b248216b55ef004d8995e3f2c7d083b5039699ced467b0be5c123c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524586, "uuid": "0ee90ae9-58ab-48c9-ab83-fbe0855fd361", "value": "T1E2C4CF826FC0F7B5F6874A7465BE8314D2E66C986E37BCCB642277916573343883288D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524586, "uuid": "d2031a33-eee2-4f9c-81c8-9d596660c9fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524586, "uuid": "202cba77-0669-40cb-b322-9e3bb6a5e2f0", "value": "12288:DsEpt7Gzo1MU2ihjCAK5a8scUhqzAY9aappEo1e:lTCs1N2i4Ra8shczAYTv1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524586, "uuid": "4c1a092e-b662-4119-814a-ec384e9fac6e", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524586, "uuid": "0e8491cf-336c-4535-aed8-7c0df12c3dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524586, "uuid": "ab6c90af-dbd3-48a1-ba0a-c21de0708d76", "value": "NEW PO QT # 301123.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88f3fff-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680523135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523135, "uuid": "c27863e3-0c34-456c-a779-044bef10d427", "comment": "Malware payload (Smoke Loader)", "value": "eb0aebaaf7d3bb15ca0559c1d0f391b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523135, "uuid": "bde7a6fb-b9e4-4371-b8e6-ee01a726ec5a", "comment": "Malware payload (Smoke Loader)", "value": "b0c7bfc7a0d8d84d6a6da448df96005271ed283ab8286b3e4a2676eb5782b910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523135, "uuid": "601e98e6-7198-4d90-8216-1e39557ce5dc", "comment": "Malware payload (Smoke Loader)", "value": "f9fe21e17293cb93236780c80bacce80d6200858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523135, "uuid": "ca3b19b4-b3a3-43a5-9afa-5e1ebbf7dc2d", "comment": "Malware payload (Smoke Loader)", "value": "1b14043edeaf1824b17c668a8a4cfda3acf05f0bbd30e271855e6627b07101ae795ab27188b2134e750e018835e675c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523135, "uuid": "56c04dad-808f-49de-9505-89f243e63c96", "value": "T18564AE4257E1A871E6134B318E1EC3F4262EFCA1AF257E9E2745BE3F09341A2D261717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523135, "uuid": "7eb1d3c1-791b-400c-baf4-855856c8a516", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523135, "uuid": "9ce6b1d3-4321-410f-8e8c-7ac5e6f62435", "value": "6144:pbrAy52IrQ4e8D5GIdpRGn9hjq4OaZtkjt:Frp5b8yI7jdbGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523135, "uuid": "18d05cf3-8920-4d0e-b4f3-5e3f233be818", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523135, "uuid": "b9629040-f549-4222-858c-ed45e96f14c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523135, "uuid": "be7821d8-f4c0-40c7-a76d-0b9ffe62dd58", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7813af2-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680502490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502490, "uuid": "c4b0031d-ff25-4b02-8a0e-4706d5ba9dbd", "comment": "Malware payload (Amadey)", "value": "1f45186b6549a60a00f5a300b60d70fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502490, "uuid": "2ea43251-437f-4940-846b-96e9bd7e4ba3", "comment": "Malware payload (Amadey)", "value": "b1078c2284ec4b387c9550fc700b48647754d55959cba26a5f51fe86cb37c7aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502490, "uuid": "96c3bf87-74fa-4f92-b1f4-1a36190015a7", "comment": "Malware payload (Amadey)", "value": "ff350fa94aed81618c02ad9646f93dccd812056e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502490, "uuid": "2e1fbd85-00a7-481b-9cc9-6dc5a2ad98fd", "comment": "Malware payload (Amadey)", "value": "afd7d27c9cefda8254585b32dbf6ddf79104e20fb8d7ce491fe5af6ae8220d066cc5a7b2ad9e937746b4109190259287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502490, "uuid": "6fe1b381-e88d-4bb7-ac54-0ddad9230918", "value": "T199936C1030D2C071D97E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502490, "uuid": "29e5e3b0-e7e8-4a75-8837-5c46b59ca5a4", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502490, "uuid": "6e04b034-1bf2-4151-914e-0b46cdcc79a8", "value": "1536:dgYNPCKLbqoYkbpplW9YoUsxXbbcouNh72ZszsWuKcdJUgjaB89p:dg0CWbBNpplToUsNuNh725LJU2aB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502490, "uuid": "08647ca2-6bf9-4a67-a2d4-c2ef5a7eaeba", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502490, "uuid": "5366340b-eae2-48fb-9968-ae76f9a34518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502490, "uuid": "151784ec-8680-40ca-a27d-354f7414276f", "value": "1f45186b6549a60a00f5a300b60d70fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed47c7c2-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680523143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523143, "uuid": "3d6e7cae-39d0-4ae9-97c2-6ef66684d340", "comment": "Malware payload (GuLoader)", "value": "9e991025a92ccbe69abe8712f711807d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523143, "uuid": "1d49258c-daa4-414f-a526-a1731a2387b8", "comment": "Malware payload (GuLoader)", "value": "b24f7c42e0a6a3a4a95868fc259140674e39d6b208fdee00ad3c772c0fd9cb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523143, "uuid": "66ffd0e8-828b-4163-9ac2-47e35836d2b0", "comment": "Malware payload (GuLoader)", "value": "7ca98b35333ba53f4a4bf27d1f2e21f01cab117e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523143, "uuid": "7b6461bc-941c-476d-9bfe-10ed4c8b35e4", "comment": "Malware payload (GuLoader)", "value": "80ce24ee0ab26d6110f2158ec7e7bc3c496ca05cb34fd0796d4e6edb83b6e85305129d66aab6812a76a9da2489eaf1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523143, "uuid": "7be09782-85c0-4f9f-8e54-7579aae61d7a", "value": "T13DD3F111BFD4C05BE6D34F324D7AC73AD3B57A101839520F2BA46E62BE31B479A19293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523143, "uuid": "1f5a6135-22d6-4fff-88fe-074e93cd2eff", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523143, "uuid": "8e1ddb09-8ec5-44d1-a789-27fa18532bdc", "value": "3072:jqTUdySBaLvYzIf/MtcBEb6Pltfj5lgJhE1SOg3/OtBYVNWEjvj2j:jkyacbREr5laE1c3mtmNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523143, "uuid": "a2cedb55-df8e-407c-8499-9bc0f1d7e750", "value": 140880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523143, "uuid": "1b8f8606-6905-4ea7-8440-ea6a30ea3921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523143, "uuid": "c85e3aa7-3b20-41b7-9f9a-6e9dc246d99c", "value": "rHovednringsvejene.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee777a76-d211-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680520997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520997, "uuid": "11b5c5a0-8d5a-4dd6-baf3-52d30ba8e4b8", "comment": "Malware payload (Formbook)", "value": "589529d14e40581a71b2e64391df1cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520997, "uuid": "da9ad6ad-0183-4510-8eba-c56c2112c8b2", "comment": "Malware payload (Formbook)", "value": "b40dee218b4a54e4882c90f15a62a58dfbd216432ebaf9becca6a3bd6adc46ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520997, "uuid": "821ba1ab-f292-4b8e-9fe1-8e196d4d851f", "comment": "Malware payload (Formbook)", "value": "e168487e2ed9ce48d6c732da05e40b095f9b918b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520997, "uuid": "de8c1db1-d668-4e79-8508-32add33194b2", "comment": "Malware payload (Formbook)", "value": "daec88fd495469db188402a66e51fc4fae11f60043caf25995e4f8f96d839154407efcaf10b995c9faf155218f9bc7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520997, "uuid": "95584d0b-de9d-4077-9207-5068ff64082e", "value": "T1EA541248AD81E077D8925BB04B3BEB23AEBEB5061068564F1730DFED7C19680EB1D761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520997, "uuid": "3e106956-d2ca-4da3-a067-d344b3e47695", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520997, "uuid": "26375231-fffc-44a1-ba28-4db699b3cb5e", "value": "6144:vYa6xvFi+XZ19Zbb997tpYNLKKE57OpCCe2KzdxB/SXdHALvQM:vYjvw+XFZbZ9t95JVxxBSXdHAL4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680520997, "uuid": "59680ac5-2132-481d-93bb-478a13efcab5", "value": 296552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680520997, "uuid": "c636a212-f2b6-46ae-9eae-26f53e70ca4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520997, "uuid": "5fb1d836-0f3e-45ed-b94e-d58a2677fb9f", "value": "swift 5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b9b292-d1c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680488309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488309, "uuid": "87c11ec9-9f02-46e7-aa89-b342cd0c19bc", "comment": "Malware payload (RedLineStealer)", "value": "9f5765d98cb7578cbe0e338b6c005898", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488309, "uuid": "f9cfbf93-ba78-455b-b99b-7a9e5c0cf1fe", "comment": "Malware payload (RedLineStealer)", "value": "b4835983dc314ea866f55cc1978c30849410f067c897f2e13e1212e87c35c5b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488309, "uuid": "89bc11d1-bc92-4513-8f41-94ab8a04a34f", "comment": "Malware payload (RedLineStealer)", "value": "cd53eb24729f0d5282d2ffc31b5314e5d24ae748", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680488309, "uuid": "2bd1b315-807d-423d-a518-449913e33efc", "comment": "Malware payload (RedLineStealer)", "value": "29357ffbd02fbf61d1c2a983f43a6dfaa61dbdeb741bc2d1e466cccea6af890ce9031d850938a62eba2615ae8ebcaa32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488309, "uuid": "5450df60-68f8-4298-8353-b73f4449025d", "value": "T180E41242E7E440A3DE751BB058FB07C31F33BC616DB4526B2795A48E2CB26D0597236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488309, "uuid": "20d037bb-4d6e-4334-a0f4-49469233a646", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488309, "uuid": "98243b75-30af-41a9-9967-9f5cbb6d86ba", "value": "12288:XMr2y90a2uYnem5W0z5j8K6W3SGSvSorUBHO/wg1nX1puZ8a3aaZr:xy5q7F5J33SproYwKFQZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680488309, "uuid": "b1468143-e9d0-490c-a8f7-7d7919afe953", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680488309, "uuid": "a11b663d-b2bd-4927-901c-25b411e7874c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680488309, "uuid": "54e8060d-62c1-4607-9167-f1eea04becb0", "value": "9f5765d98cb7578cbe0e338b6c005898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691a9c91-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680533658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533658, "uuid": "777a43fc-ca26-4430-8775-a6e43ee0e4d4", "comment": "Malware payload", "value": "bfdf9d56d879eaf8b1491fafcb1dd955", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533658, "uuid": "c0f3b721-b096-4a9e-ae89-a94fae94e9d9", "comment": "Malware payload", "value": "b528578f2df721005ce08f7bf31deee74ec06cd40b65a329218a61419dba26d4", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533658, "uuid": "5dff4e01-2b3a-43e9-850f-10e367cb55ca", "comment": "Malware payload", "value": "e3ff85e2ba02453ddac1848a09de77002e47d205", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533658, "uuid": "2c08078c-38f2-428a-bb9a-72e47b71afd0", "comment": "Malware payload", "value": "4510a863c7dc189cada7e6dc6194dd8253baf58f29e67d6f84b47fd683ea7f319a9cc994baaffb99ffff6ddc366103ef", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533658, "uuid": "ec092025-d3ff-4459-891f-3b9df0e6a96c", "value": "T16DA5BE51F223DA44C2295375CA81DAF017B1BC09EE129E1B7999BF5A7E733C03B21792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533658, "uuid": "17b172bd-d34d-46fa-aba1-c64ae5dd3ae3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533658, "uuid": "b754ac9d-931b-4e94-aac8-2cd535e59f90", "value": "49152:/ry1jIylGC+wzZAElWCaPbGZfkuR6C3bLQt+HObUJJGy:zyCPC3A2WCaPusuLQt+ubUHGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533658, "uuid": "4c8bbebf-a4ed-422d-a195-e285fde6d004", "value": 2070528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533658, "uuid": "23980ccf-afb6-4b88-880e-f9e135eb56a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533658, "uuid": "13377db5-2028-44b0-9a55-0ab911177061", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d0df5e-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680512421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512421, "uuid": "343603d0-c7e2-4b52-a53d-2f1dcab0b738", "comment": "Malware payload (Loki)", "value": "d2deb56068a634cbdeba53fdbf87e304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512421, "uuid": "14695a50-263e-49d0-9af8-820f6fd009c8", "comment": "Malware payload (Loki)", "value": "b60a61055f6eff67c01b3642c484232082912df964e1a3354e7aba28d80d2d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512421, "uuid": "8d0845ba-bea9-46c9-8666-93e29c4d0c2d", "comment": "Malware payload (Loki)", "value": "27012fbc39c15ec4dc7e2a90e9020f1ad7bba636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512421, "uuid": "14ebc71a-cd30-41d6-89f3-0e3bbab9e50d", "comment": "Malware payload (Loki)", "value": "d0c3fdeaa405d0c644325d94c2760f3be550a893168ee303b97571285c258cce035e6685c3f13be9a7f7c83850655710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512421, "uuid": "50acfa0f-7978-499d-8483-1fac8af65cd9", "value": "T12814024052E1C47BF9B306308DB463A37AF9E51321A8438B1361AF6EBDA1481EA0D777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512421, "uuid": "ff072150-fe2e-4619-8299-36973bac4a87", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512421, "uuid": "1ea7ac7e-f8aa-45ad-ba2e-462363b754a1", "value": "6144:/Ya6FB7ABSJVS7Qoc3U4xKoYWVfVvQhc0:/Yn5rJVSVc3U4xDfVYhc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512421, "uuid": "8537beca-93de-45f0-8c18-c0124288ee5a", "value": 203800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512421, "uuid": "61f8d305-9fa5-4c3d-bb40-7625a8860ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512421, "uuid": "492f7c3b-8a7e-420c-9dd1-52f0633d3756", "value": "scanattachedfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a056257-d279-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680565523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565523, "uuid": "6d703cbb-7ada-4c02-9ed1-0ddf20878043", "comment": "Malware payload (AveMariaRAT)", "value": "3ab24aa99a56dc74f96fb324a8223a21", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565523, "uuid": "34b180d7-80b3-40ac-a3c6-284a3302f841", "comment": "Malware payload (AveMariaRAT)", "value": "b65180d1894153d56a13fdc5148d9aadb1e68f086ad4b97e8e4a1df2217aeb7d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565523, "uuid": "08a60179-050d-4b66-927a-c7c99864cde8", "comment": "Malware payload (AveMariaRAT)", "value": "a65704be67f79bbcdd2f6c991ea60733273bc0b2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565523, "uuid": "efb34629-005d-4e53-a8ba-f8d7cdd2ea4d", "comment": "Malware payload (AveMariaRAT)", "value": "021711023811a32126cd621421b20eb5410923ae5938c9d40260bb78ff1feecd897904849420067f224ef03ffe8b2df7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565523, "uuid": "736287d4-71cc-4693-a170-eb94ff5a2ee8", "value": "T1BA25D22562E8CFD1C09F2475DC56B1F40227EE11DC259FCB3D89BE9A38B2295A93118F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565523, "uuid": "b67f0e54-540c-44e7-8d2b-fbdac07c9bc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565523, "uuid": "5c1d482e-8bca-4bf7-9752-3b370fa56481", "value": "6144:wXLHjcMVlqPGlVjPnBemyAjOYSfocnCzmcIBZVyF:wbHo1qjPkmlefdnrcKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680565523, "uuid": "9bfa0c77-7315-480e-8f8d-b747a935e215", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680565523, "uuid": "dacdb2af-9320-46e7-a738-cfeb76139d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565523, "uuid": "ea1ad917-c72e-4ab4-8826-19285852058f", "value": "Company Profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f947b763-d218-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680524022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524022, "uuid": "81ac7e32-3d73-4585-8708-9c4ddda3ab83", "comment": "Malware payload", "value": "399dcf10d7b8402de658ba17f5e0fc33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524022, "uuid": "59705cef-049c-4c56-9553-b4cd33c0d046", "comment": "Malware payload", "value": "b69d37715413ae073792d625df4726294a9214b21a1bc0608474e7396b4b6e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524022, "uuid": "7aa32cf4-eb68-4a98-89e1-1905c1329460", "comment": "Malware payload", "value": "00c18430048497225c0bbd3add8e88c8e2f3461b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524022, "uuid": "7705091f-79b3-4575-afd9-321bbdd8f9b2", "comment": "Malware payload", "value": "e7b10834926b204eda799f7bd361f31fba5dec4c7dc36c5375996532db7b708cfbca9e4c62d71c35589886c376595e43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524022, "uuid": "b7de9a5f-5f62-4b92-a86c-ac99a792922f", "value": "T15D84E191F150DCDEE86252F24C2EDD2411A2A55E90718B1F229B7F3E7AF335310A7A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524022, "uuid": "bba19363-1a9d-4c71-8dcc-772a5da167ce", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524022, "uuid": "050d2b89-3217-4544-b228-2fca59bca762", "value": "6144:8GemqA3P3EHqzqBOLgQ5U0uDpGlIoWe5ge0MdmOe9TcOhl0Zp5bwjrWEM4W:ImP3vxzqALgQOBpGlIoWe5gRM2nlQXyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524022, "uuid": "2b0212a4-2134-40b8-b56a-88f231dc352f", "value": 383644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524022, "uuid": "f24e471e-283b-49b7-bb4e-1cc7cabdab4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524022, "uuid": "93da3bc7-f4dc-4bd8-a68a-94592a4996be", "value": "b69d37715413ae073792d625df4726294a9214b21a1bc0608474e7396b4b6e3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8eec1a-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524858, "uuid": "b9216d33-b7db-46f3-a8a6-fc1b0253babb", "comment": "Malware payload (SnakeKeylogger)", "value": "7b51e016d9a67c86583c1cd345cf20b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524858, "uuid": "fddc540a-e7ec-4e2c-9cff-8b26299ed87e", "comment": "Malware payload (SnakeKeylogger)", "value": "b6a43c7e7e920c85e8d0228a483f4f06173c89a512f32ff0f36de6da64411d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524858, "uuid": "5942bca7-5100-4a37-b365-7d3e7084bb22", "comment": "Malware payload (SnakeKeylogger)", "value": "2387479d9b695dc14bdea2f4e2082b9b4405650d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524858, "uuid": "fdad6e25-8236-4d2b-b2ed-bc108c119545", "comment": "Malware payload (SnakeKeylogger)", "value": "920ffe46cd66f753449f4cefec5e21aa5c868e433d5c058c529cd0d0106724d3fa5ec9c19e15080051ce53508a7374e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524858, "uuid": "a9440555-2955-4f4d-8fcf-ba11d963802a", "value": "T1C1E412057616D633C9BE4FFB6062A60503FA5A07A412D37F2CE62CEB5C36F548D41A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524858, "uuid": "efdbaffb-6ba7-4d13-b8d2-dee14d5739e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524858, "uuid": "5e9ca967-61f0-486c-90d6-81d270b2fb2d", "value": "12288:M5CBWKdq1FbwwJLwrld5lgeL0nkwQM6azEKuPLxf+OcDNdSR4wggvtBOlS:3frpjcIhwQja4K6x5cDNde4q1IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524858, "uuid": "23989de6-c5e9-4d17-b209-7ed38de78a3d", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524858, "uuid": "9d14802a-4e5a-4386-a1f6-43c9d5cd0ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524858, "uuid": "ac6170bd-5900-4f3d-88ca-a62b1edef749", "value": "Maersk BL 208268807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1b3f15-d1fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680511517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511517, "uuid": "247f7b0a-c980-4e7a-a6c3-4b1ccdc5fb41", "comment": "Malware payload (CryptBot)", "value": "599521240e6a427b72e4f6a2568a3aef", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511517, "uuid": "e0897711-f19e-4262-8804-ef1c9dd66fbc", "comment": "Malware payload (CryptBot)", "value": "b73d6d65ce2752dfd87d6f2c6e2577241d38ab680bd7f67aa33ea6a481fb1411", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511517, "uuid": "0b7826fd-8f31-4b51-ac26-eb9c313f4d92", "comment": "Malware payload (CryptBot)", "value": "62afee0eab76bd7ec060ffcc8d8dc6d6b146f1d5", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680511517, "uuid": "9622bf7f-5fcd-4dbc-8314-53b39d29fd0e", "comment": "Malware payload (CryptBot)", "value": "8dc26c12fb0d15674ef54ac367695dc32620c9dd335416dfa4b3fb74738976e2110d4606b25dbbedffcdf8052f4b261c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511517, "uuid": "11ae357f-005b-4480-9526-ad4b90ba1b35", "value": "T1B77633F332655086D4F9C83A8437BCB630F3366686C1EC3D74E96DCA1629591EA27B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511517, "uuid": "b9497b19-0735-4022-a599-bc3a33eec15c", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511517, "uuid": "70b72a40-c3c0-4f85-a55a-9ec08154a556", "value": "196608:gWX4aiabu+SDBntpo4zZTfySW26SoX2fAk2wVn/YTajlH6iuaSL:p4X+SHpo4zZDdW26SoX62wJYWjlH6NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680511517, "uuid": "ccf74721-d599-4912-b3f5-3913102c9661", "value": 7738880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680511517, "uuid": "12182ca3-3cf6-47f4-b70c-9375c2ed1cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680511517, "uuid": "fe4ff601-ad92-4e1f-9611-ae1123f8d9aa", "value": "599521240e6a427b72e4f6a2568a3aef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdfeb8e-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680528752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528752, "uuid": "f07abfd5-c84f-4a3b-a350-87fceb3852fa", "comment": "Malware payload (AgentTesla)", "value": "fb38700722d5ce220466a7456cfdacc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528752, "uuid": "bc1d9298-38ff-4ec8-a369-91bb3daef7c7", "comment": "Malware payload (AgentTesla)", "value": "b7c76bb110b35e6e68b673ecfd89bc402869141c9b12fd7d37087958eea97950", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528752, "uuid": "0929606b-42c2-4336-9290-4fea46717380", "comment": "Malware payload (AgentTesla)", "value": "476cff62f11dcefa1ed1383b69c488ee602ebe6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528752, "uuid": "c1db7e93-69dc-4d38-8baa-ebbbf37fcd2d", "comment": "Malware payload (AgentTesla)", "value": "a758c98f868a69b5164f04c2f2248529e57799782d234aebadce26a40fd08fe06f41b6972e03377d8e86a3c9bfea271b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528752, "uuid": "93f28901-f479-427d-8937-9a4d3dde3943", "value": "T14BF412382B9B6238F5735B7EA4E02695576EB3A32717C84D58B501CE1737B038AD062F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528752, "uuid": "f13d2fda-f09e-4778-a8fb-28cadcdf7ba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528752, "uuid": "fb798567-4175-4bb7-858c-ba374932bceb", "value": "12288:pvWmYMUnFW/NMbNkuRIkYR5TITnKk4lnEJo82/yh2al637IH2QCPXB4oEQEm+fT:pvWUGBL65UTnBenuoKhmrG2dPXB40E3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528752, "uuid": "59222034-a737-40cb-bf9d-d113d8c077fa", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528752, "uuid": "53527038-de80-4da6-8424-6fcf462e6d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528752, "uuid": "c65845a8-12de-4ff5-99f1-1c4f798de8f0", "value": "b7c76bb110b35e6e68b673ecfd89bc402869141c9b12fd7d37087958eea97950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9745e8-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680523005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523005, "uuid": "5305e583-8c52-4c20-843a-346ac3dc8269", "comment": "Malware payload (Gafgyt)", "value": "1bebeae48e862ca9d961d49c4d3bfc76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523005, "uuid": "e7968ec9-1230-4ed2-9503-f7a22a597242", "comment": "Malware payload (Gafgyt)", "value": "b8f37111f7a08f73bfdb407741548b67547d136f5773a94ced656b0b3ba884d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523005, "uuid": "44dc88d5-35e0-4b9b-9043-afa9b9d3c4c9", "comment": "Malware payload (Gafgyt)", "value": "be4356b2887572d3dd2ed4c946ce41b8611911fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523005, "uuid": "210985ea-90bc-4b2d-bce5-f68916e85c74", "comment": "Malware payload (Gafgyt)", "value": "0dfae16baeb59d0366c55814647fe70a3eb604a26ceb9af4b22aa01433e5ff9376322f8aab15b9663f14612cb93d6d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523005, "uuid": "0fc747fb-9f32-437c-bd31-4f5380d6455a", "value": "T1D0B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D92D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523005, "uuid": "3f92f47d-3157-4d4b-9e46-4d50b6a71d3f", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aP+JmDk1c8xF6KjW:jfO8IBfJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523005, "uuid": "4228fff2-8b2b-4f28-9c43-00bf0ae529cb", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523005, "uuid": "095c7bf4-0f3d-43b5-aa78-189a7ae0c2da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523005, "uuid": "336ee852-4de3-44e3-b875-919f8d40094b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b5db06-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525301, "uuid": "1381d514-4899-47e6-a701-bdb0d2569dd4", "comment": "Malware payload (Rhadamanthys)", "value": "80d8683fe17f94d581e3e8f9b20c88c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525301, "uuid": "e135715e-0f75-421f-b9cc-8c9569690dba", "comment": "Malware payload (Rhadamanthys)", "value": "b982e332530e0860f1c0f510ff94a47975455ce4fcee08a5bb82413645a21854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525301, "uuid": "7dd735af-6c79-4f62-b165-d5030fa0cb4c", "comment": "Malware payload (Rhadamanthys)", "value": "5338c34f0f7819434c4a12dd24f27602cac50bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525301, "uuid": "6c6521b6-f26e-4556-a3b6-01da92692258", "comment": "Malware payload (Rhadamanthys)", "value": "07ac2769bbd3796406994b49f1ae9ffb5904d2516bff42c4dd07cba450f8f2ecca0519c2862134b57d2cb9fc2cff6d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525301, "uuid": "c0d8ef90-d2b2-49c4-a7fb-7503c2ed0911", "value": "T1C964AE0257E87830E23E5B328F2EC2F4261EBC629D157B9F2678BE3F09741A6D561705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525301, "uuid": "d076602a-a642-45ab-aa0f-9219f5c95201", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525301, "uuid": "7491c2ed-851c-4592-9855-2df14b10c430", "value": "3072:vL899GbwhF8Cnsj1hkCoJxks+i/X39ddF25Ak4sw5NCkgJwfmRZNbTbFU2rF4+Cr:j9bkigsjIXntd25Oj+bTRN4+I+yRSlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525301, "uuid": "4f666153-3e8f-4efc-99c4-7eb227d23b21", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525301, "uuid": "097b11a9-ce1e-47d6-afb0-8ae4d4196747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525301, "uuid": "a856f857-1ffe-4a5a-82a0-b97b012a0c09", "value": "80d8683fe17f94d581e3e8f9b20c88c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dce6615-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680521962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521962, "uuid": "ae39089c-3c1a-4cbe-bfb6-57f89fdc0bfb", "comment": "Malware payload (Stop)", "value": "f2ce45cda08cefde3dd8fd99d142ab21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521962, "uuid": "8d98c8f7-5670-4c00-8981-70b518744f17", "comment": "Malware payload (Stop)", "value": "b9d3baecec2bc332785de9bb940c6ec3c28a3aa077af7ff9c1e7f3dee7a39223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521962, "uuid": "7d18f92c-3793-453e-98e7-931223c2d533", "comment": "Malware payload (Stop)", "value": "9249efe6e10b5c202f12349afd57f2011089ebff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521962, "uuid": "bc314ce0-fab6-4d3b-96eb-0dec221e9886", "comment": "Malware payload (Stop)", "value": "0e573a0819ce436742bbb578b11cacf26c87ae814a16757a17632668b829c6596b0dc7e1a136caa707b11eb6ee99437f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521962, "uuid": "3467d14e-b934-4f53-b190-bf382ee73d7e", "value": "T17DE41221BAF0C0B7E423C8B86436E675A67FF92187AAE5D7331807695E321C17E71319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521962, "uuid": "e49ab65b-1b96-4b1f-97ad-4fd3345b4be2", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521962, "uuid": "89baa18e-1a0f-4902-bdac-d172e856e366", "value": "12288:GiNsiC8NdT28cri9g/d4zHWug9v6ZdSDDD1YRkt4+Ne:GiNsihSriq14u+QvDeRIvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521962, "uuid": "daacbe5a-ea28-4d1b-9e0f-c718b1a2462a", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521962, "uuid": "49b806db-3d68-4261-8355-2f5e56e133b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521962, "uuid": "665a0f2d-cdce-41bc-bf5e-6d88577a4d8b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077490c3-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496128, "uuid": "22acc478-668c-4592-b818-fce7d46e1fe6", "comment": "Malware payload", "value": "5fb88454a90b8cf64754d661d8da7fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496128, "uuid": "56aa27c3-7336-4a59-9fa7-5b807cb0675b", "comment": "Malware payload", "value": "ba02d2b6f5d6b94438819484a57e216233caca0a296c2400b94ac1fbd4756c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496128, "uuid": "0d672b46-6b88-474a-96b1-2fb29c1a4b93", "comment": "Malware payload", "value": "40d82e8e6fb5a9420c07649f3b8ae90dc0bed330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496128, "uuid": "5d46afbe-b88b-41ac-aef1-4f05abaef958", "comment": "Malware payload", "value": "3402e1b3208d17f240598d4bd84b72dfbb7fa2b8cfcda6d50e41962de60ca9622bdfb5b6d4ca15176858ac52e9b51620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496128, "uuid": "38fcc19f-8cf8-441e-a929-2cab5f44e0a4", "value": "T127055BC6BA70D063DB83CC717F5C9A9062266567C93B0F5275BCEAE00F61AD2C56B123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496128, "uuid": "e7161df8-ebb7-4ba5-b6b4-d7ea3339a644", "value": "6144:MeI55Nzohv8y5SADmsWT2k3jxoJPNaAtozS:i5vMXwADuQh4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496128, "uuid": "b822b793-8f9d-4a7c-b32e-9c5c37ad91da", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496128, "uuid": "186bcb20-ff73-40c1-9cdc-9e64635f5c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496128, "uuid": "5f225fb6-900a-4ee7-87e7-fc8b1a875710", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.24344.30528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387e7fb3-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525416, "uuid": "61854c00-d429-4afe-a1ad-7abd8f83d87a", "comment": "Malware payload", "value": "af2142e18f617481abe65aebe05bf10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525416, "uuid": "137a4f46-e1ba-411c-b194-17fbd9086413", "comment": "Malware payload", "value": "bae1a017cd159d6167cce106db5cec27c83a221faa3d13d633dfc3ce10bed973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525416, "uuid": "0b70efc4-1ba8-4d49-a750-8c48f4c78904", "comment": "Malware payload", "value": "7f724efa26ba65fb73a4dda8b9306e81cf9570dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525416, "uuid": "7e748076-f24f-4223-9f06-fbd707c2a302", "comment": "Malware payload", "value": "d9750a2310918d2fc4e5fe6073ec584f6f3d702238c8de95645191c1ab8b9c72b96fb34a28ff62771f9592d9c12e7fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525416, "uuid": "390e064f-98de-42d5-afa5-ee9322a7acc8", "value": "T18A75125863900DE5EC67833D88828542FA277D161320FE8B4364B56A1E3F6E36D7AF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525416, "uuid": "714083cf-0575-4122-98fc-7f64f476e4d2", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525416, "uuid": "a714833c-a297-47bd-9920-d6f8e0342639", "value": "24576:4fXq5aG/oWN1nRoFWv0R6TGOyfc2MUT7UjL74MWEKTtEzAzkNn0+/:4fGX5MWsR6TGS2zT7KL0NEoEzAzC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525416, "uuid": "2c48e25a-fcc0-4328-8714-12c8a73d6b25", "value": 1597312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525416, "uuid": "c66f5f0a-c2b2-4071-8ae4-498d74a2318c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525416, "uuid": "645b957f-f157-4bb0-993f-08ac40ed68f4", "value": "af2142e18f617481abe65aebe05bf10f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4fafbd-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525503, "uuid": "f496c234-fdb1-447e-961f-5f54b7ba82eb", "comment": "Malware payload (DanaBot)", "value": "aa47a1da533e49e5a6e86b122997dbfb", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525503, "uuid": "ff98db6f-0b7f-4059-9917-584426dea62f", "comment": "Malware payload (DanaBot)", "value": "baef6734027364f96bca1362fe2ca5663732f74af4e3fcff1abb8f661cf69f47", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525503, "uuid": "ad8f39f4-d5bc-4abf-b489-290902c53e39", "comment": "Malware payload (DanaBot)", "value": "94423965199caf99110f9d3b4589f8d1f3de4216", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525503, "uuid": "123b3111-ed80-4435-8c9d-501a48f3c98e", "comment": "Malware payload (DanaBot)", "value": "3ee11ad17c55084156793c4a597d00fa4dc4ad96077839de86ef5eefe1468a782b066b42c5cf267ebb1c038a96d43244", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525503, "uuid": "ed29be5b-13ee-4e1e-9b8c-83742c17a82b", "value": "T1CE363382FBB19530C10247728E2FC3F56A2FBDC11A5DAE5E7A05BD2704328E5E216B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525503, "uuid": "b550c394-31d0-4329-ac06-50df0f67b0f1", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525503, "uuid": "7f2f617d-9e83-48a8-92cb-92810f536501", "value": "98304:xik4avhFx8yLnRRQaiaXiRwwXYfjjmtoZhGmZgUX7OBRDBDsW8vSYoGt:xiGKernRyawXGjKtpy7OzBgWM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525503, "uuid": "a262c04d-10d5-41d9-a257-1f2c6e8438b9", "value": 4947968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525503, "uuid": "f1f4841f-4b8e-40e7-aa50-e3e2f093221e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525503, "uuid": "79163a8e-03e7-44ff-b6c4-b2d31da0fb21", "value": "aa47a1da533e49e5a6e86b122997dbfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828486d9-d272-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680562477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680562477, "uuid": "cf8d765b-f852-4a40-bc9f-5732c0b299e2", "comment": "Malware payload", "value": "aea6585be1b8ed83061e13b72e2f21d7", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680562477, "uuid": "484f85ae-6319-415b-b083-231156fe808a", "comment": "Malware payload", "value": "bb3d35cba3434f053280fc2887a7e6be703505385e184da4960e8db533cf4428", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680562477, "uuid": "74fa45cc-39e2-4559-b559-c4ea689b284f", "comment": "Malware payload", "value": "42ae87079f73f4fa3513b0febb288e3860be061f", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680562477, "uuid": "0be52cf8-b299-4947-9840-28b279966e2d", "comment": "Malware payload", "value": "4fb78148a019f573916ea8b9fe6f25d8317f9b0c203f4098297ae0eaabd6e5f49fc781d5d56c2eb5d686f5938c35e9a6", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680562477, "uuid": "9a260cd4-a927-4f63-a5a5-32d251803c5b", "value": "T188438C227990C1B3C44504750964E751AB6FB9324AB5C787BBD816BEAF313D0AF3E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680562477, "uuid": "e7088b0b-c517-474b-b57a-9f88953a67d8", "value": "b241af31925d8f6ae53fca14aa14a03e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680562477, "uuid": "1ba7215d-b3e6-4b17-8632-95b5ee2545e7", "value": "768:fauBAEAsP2ysspQ4gIBngqPEsDVN4Z6rk6bkkDUrpuaWj5:J20pQ4gIBnXPEsZN7kUfDep7E5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680562477, "uuid": "c426cb16-0e24-409c-9be7-3b8e6b0efcf4", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680562477, "uuid": "2ddc14ef-ed97-4b5f-89ed-95593e623abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680562477, "uuid": "0928820c-ef66-4b39-8779-ca63aab7bc06", "value": "Dysm.decoded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb35f8f6-d25a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680552372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680552372, "uuid": "128d6a57-e32f-4c95-ab8b-f24203757537", "comment": "Malware payload", "value": "d75acf3032eaf99bc8e710bb651edf66", "object_relation": "md5", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680552372, "uuid": "bc95186b-f43d-4cc1-ac99-4a42ec9fcc2c", "comment": "Malware payload", "value": "bb652b9b5873ffc46508dcfaa5874160aca382bbec5fb25cf349bc68eff62155", "object_relation": "sha256", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680552372, "uuid": "b2a7dd2a-70f9-4d5d-ba4b-2cde840ea43e", "comment": "Malware payload", "value": "b77b95a4a634948c56026986873dbd293c9f53b6", "object_relation": "sha1", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680552372, "uuid": "304102e6-ba1c-4606-bce1-8e9b971bb61a", "comment": "Malware payload", "value": "1eee54ca5b50d8eb8b4ec200a969c9109c4ed0d2dcc4b0a75ca0862c30d57f7e37b3dd26e99ffc5fb726d8695b1f2dec", "object_relation": "sha3-384", "Tag": [ { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680552372, "uuid": "617769e2-5d6c-4b4f-8f50-318336bb4975", "value": "T134A328874584D7E8CB6FF45D924B6C0AC6EB929E291C94B0629B1DC4F333C5DA867CC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680552372, "uuid": "b7f8909f-4bf7-48b3-a2e9-c93a1696380f", "value": "384:ckYI6GwNZuZBlkLn9e7AH+ul3nyhiUbvb42q4CpSJgVNuYMTuv5c8Ca+WNR4FWex:a718IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680552372, "uuid": "4c583e43-d336-401c-bd85-42356a452d1c", "value": 106578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680552372, "uuid": "09860a3f-49bd-4221-90c3-40da4703fb56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680552372, "uuid": "ca1daa47-ee8c-43d0-82f9-ff37447dc7db", "value": "nBJ3KWjg.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9080d2-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680525294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525294, "uuid": "87c5cdc6-3e12-49eb-ab76-4b3ef711f2d3", "comment": "Malware payload", "value": "31ddb114ed122651db300fd1d7a1e591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525294, "uuid": "33db98d2-c928-4c67-8968-50a1a874b3bd", "comment": "Malware payload", "value": "bb8ff9c2a85e5fa7698e50fcc840f769feffa1a9d735c37be242972fdfb6e348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525294, "uuid": "29d9b933-f512-47b1-b70c-31bcc947fbb2", "comment": "Malware payload", "value": "c00f2787b182641be2bf7674d25275a1964a6cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525294, "uuid": "67537391-6024-4a76-9d64-202270135553", "comment": "Malware payload", "value": "1aeaba428cc3c757172646b0ef663129b835db4ed99080281daf4646a8ce767952d32690203507c41e96a549a1f7beb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525294, "uuid": "81688c71-fa7c-482a-b791-3f2b852cce1f", "value": "T1EC2523011E4C507FD1BBE67FE71AD40A46ACA4A39BD53F80E5D27FC252822C67944F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525294, "uuid": "8a9b7137-4a92-4ee8-bd84-05d2be8f5da7", "value": "12288:/tGm/VHhbsASpX/2nkqLxKT1ZdV4rHenX9QkMua/1e3DxNjd0lVBaMsAxuvOMxRh:Ym/35M+nkqL0DvXikGk3dNj6lVn8JitI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525294, "uuid": "471df0d1-0459-435f-bd8a-0889945102a6", "value": 1035140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525294, "uuid": "7d55a355-4268-4dea-acf7-c8f751fd7a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525294, "uuid": "76273f9f-e3e4-40f0-9608-4c2c2bbab17b", "value": "31ddb114ed122651db300fd1d7a1e591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074c37d9-d1e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502570, "uuid": "54f0d8ff-b53d-4184-896b-24221dc3bb9f", "comment": "Malware payload (Mirai)", "value": "1cff1daa0ff91cde62eb277028068e46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502570, "uuid": "36f1f94c-819b-4e0c-bd16-4190d5194902", "comment": "Malware payload (Mirai)", "value": "bdc85dfb2ecad8920c304031ba91db6dec9eb4fcab36f68f0d025ab502e30264", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502570, "uuid": "a247bb4c-9d9e-469f-82e9-05500c7af840", "comment": "Malware payload (Mirai)", "value": "49f002bbef51a7b6d30c5fbb6227cb2645803503", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502570, "uuid": "c92a70ae-4fcf-4737-8846-96b330159de2", "comment": "Malware payload (Mirai)", "value": "f67235b90557bec0189c5d6ac1232f6586ba34146a7ee01568770c0fefd47b9dadbae5a6b1c2a4fb2ede1a7660990ece", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502570, "uuid": "61d11d38-b0d6-4c38-b927-cd2437b9f3c7", "value": "T167632BDAF801DD7DF81BD77A4453090AB530F3D512831B3B63A7B9A7BC721A81912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502570, "uuid": "1d849fa3-c953-4bcd-9c7e-89f138935c29", "value": "1536:fAgVFwxEYQEDYrly8VhyCO1sxyWbxdJiLU11i+VQ8K:fAQFwOYpErlWCO1GySx/o+VtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502570, "uuid": "900931db-d096-4ee7-b73f-5df6edd6cbf2", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502570, "uuid": "b5affa94-74d7-48b2-937d-4f1ecbf21bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502570, "uuid": "7a8e11c5-ada9-4c41-95a3-160f4afc07da", "value": "1cff1daa0ff91cde62eb277028068e46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85777c1c-d1de-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680498917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680498917, "uuid": "d8b259f1-6f35-40db-977b-1811cf80d5c1", "comment": "Malware payload (RedLineStealer)", "value": "aed153c31920d0fc2beabacf701ca89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680498917, "uuid": "85faaedf-5bcc-403a-89ec-836d227d6d7c", "comment": "Malware payload (RedLineStealer)", "value": "be609a1f3cc3779db212790b2984ecfdda8788c508ff8dbc14c6b26b7070d333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680498917, "uuid": "d78d61d7-7a35-4359-8913-7db847851fe6", "comment": "Malware payload (RedLineStealer)", "value": "575705f18168c0b270d10179cf1d9f851adb8a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680498917, "uuid": "d2fbcbff-0315-4865-9e50-e442d1622670", "comment": "Malware payload (RedLineStealer)", "value": "9c16680f29ff9998941a38c839725309abd1640acf4f029930ec6f3a84f56ad3a043ed12f73a3600161b7f8ead6440e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680498917, "uuid": "526310b5-005f-4631-a608-ad1e4f3c98fa", "value": "T19E84820F57854F6BECCDDA78415A4650DE9F78A2AFE6C28F1B5CA8131A5132C213AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680498917, "uuid": "86a5a463-9ccd-4145-b67e-d6206ea0bdeb", "value": "67a13e475a7159590c30461a3c5d1a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680498917, "uuid": "5eaa80bb-2096-4475-ad10-856c774c27ca", "value": "3072:cU1xvrLHEqaGRV45yNGaVUNyN52zawGxWU89IINq4riVvWL2AfxV:tUqaGvVUNCaNUinrRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680498917, "uuid": "2de21ad9-5fbe-4989-a5a6-2ced60240896", "value": 381704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680498917, "uuid": "06b825d9-381b-4a91-aba8-20d4ec412362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680498917, "uuid": "2b47364b-273d-4449-a85d-c9e913e0cd5e", "value": "aed153c31920d0fc2beabacf701ca89f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d302aab6-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680524816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524816, "uuid": "db386f31-9330-4d21-a599-4e9262f05c56", "comment": "Malware payload", "value": "5f02f9237ea6831523861955d1183ee2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524816, "uuid": "3b73da44-e4f5-4d23-a7ad-b410090f682a", "comment": "Malware payload", "value": "c00b4a34013abf136f76182788933d3e11c4c210cf9ea99a38c5b54043460eb3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524816, "uuid": "b30568fb-28a9-481a-9df4-f5b927f04f10", "comment": "Malware payload", "value": "6b8c645c46656abd19fcffb4bcff5e9223ced7e5", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524816, "uuid": "3c865a28-86de-4331-997d-d2b62b6d1cd8", "comment": "Malware payload", "value": "a26625fe0196f0e207f31064cb528e4fc0f5a9abbc617d108f6f74349c52050e1fdc615b507b19e31ebf273cb4b8f0da", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524816, "uuid": "79f9ef60-1393-4466-99de-4d63a3bdd2e3", "value": "T1EE451207D6848D4ED8824BB87BA779CC121E7C523ADEB1C32140771F2F76EAAE617149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524816, "uuid": "cf28fbb3-d3f0-42e3-81fa-96fe4de3cdb3", "value": "24576:aLKoWQmmav30xJu9VEu9Vs+MXUZu9VF+MXUdwOVwxi32:aLK9QmmQ30jusuk+MXcud+MX3Yyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524816, "uuid": "d93e09e0-2724-42df-bb86-9f147734ab29", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524816, "uuid": "0acc3104-b1e6-40ff-9cdd-7f639dfe7dc8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524816, "uuid": "e6ee6e27-ee0c-4b6f-aa33-38e649e310b9", "value": "\u03bb\u03af\u03c3\u03c4\u03b5\u03c2 \u03c0\u03c1\u03bf\u03ca\u03cc\u03bd\u03c4\u03c9\u03bd 1,2,3,4,5.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3abfb7-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680525052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525052, "uuid": "3d44f30a-7341-4a1d-8db9-2aebb64f323e", "comment": "Malware payload (GuLoader)", "value": "3e48abfe23308598b5d28818832fcc8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525052, "uuid": "c19605b2-12d7-43f5-a301-4b3b70909de5", "comment": "Malware payload (GuLoader)", "value": "c0303022c1e2e014df91a6ff93d540d2e734a938f93e16649941c418d54e5a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525052, "uuid": "d4754a2b-0ee6-408f-ab55-3df4130ea45e", "comment": "Malware payload (GuLoader)", "value": "16261e05483a7fe8ac03b130a8c86267777b621d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525052, "uuid": "2ee48933-b257-414e-bbc2-9e257e66d75e", "comment": "Malware payload (GuLoader)", "value": "1deadd1398f32e7b3044541c131870ebc796f1ab7f39b697b592a62fb2536f37329122bea7da2c4cc16f98c261a153fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525052, "uuid": "cc3769d7-b064-46da-a32c-e78645dfb872", "value": "T12DD4F10B7D01110BDD659A3748639BE32EB37D3C8AF41A2113F9BA5F88366C6799D183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525052, "uuid": "57658f1d-0d01-4387-bafe-f5e2836f21ed", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525052, "uuid": "a3d6012d-91e2-42cd-9c18-62a3b6e91bdc", "value": "12288:Xh+G1bV2HMwHjvsYAEYDwjP2ISdkfRChEa+CeKdF:Xh+G1bcHbE1E2uWhhEjs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525052, "uuid": "0c86e28c-dc5c-473c-9d3a-4f01607331ed", "value": 614568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525052, "uuid": "1708857d-e00d-4599-bd62-0b33495dc055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525052, "uuid": "33594339-bedb-4707-bbf5-800bd287c9e6", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02891254-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1680525755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525755, "uuid": "3629172d-6fc2-4c36-aaab-5ff6564a2f04", "comment": "Malware payload (Socelars)", "value": "3f4720a45daf4ae876e3934299a4e9f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525755, "uuid": "9e85b63f-4312-4347-8bce-74773febc8d8", "comment": "Malware payload (Socelars)", "value": "c0e2ed5e076a15cd0058bc9cc4fd2fd45b9f2fcdd9d121960ee9c18eba81e29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525755, "uuid": "db4fd003-af94-4820-91e2-188cdf024adf", "comment": "Malware payload (Socelars)", "value": "c89f6153a4ce73ed26c58f7cd00c6c86ab41652d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525755, "uuid": "51f1a888-ab87-44bc-8fc5-746525dc00c6", "comment": "Malware payload (Socelars)", "value": "bffc0dfba621b9325e6f387a8bdeafe9ff521f2d88f055c6f3412620f2f4317bc9537a37140ae2c5851cd2ac21254d47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525755, "uuid": "9d67b103-6a9f-4da5-bded-dfe16e350437", "value": "T18E658D21F7C26032E8E310B745FF5ABE9D3C6A114708A4D7D3C81C999B615E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525755, "uuid": "2bc89299-ce5f-4b77-a309-fa49026cc9d2", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525755, "uuid": "688cd41b-1462-433c-9995-c89c79a1bad4", "value": "24576:1GU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRnj5hMSQ:opEUIvU0N9jkpjweXt77j5+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525755, "uuid": "fd1525d7-8470-4104-898a-884bcfba69f6", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525755, "uuid": "2e92576b-9939-4162-9a07-601f2aec81de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525755, "uuid": "da4fcf4b-2457-476c-b321-9d9786748776", "value": "3f4720a45daf4ae876e3934299a4e9f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7476b39e-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680525517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525517, "uuid": "a0b95715-3699-4c37-a151-42c4e25d882c", "comment": "Malware payload (EternityStealer)", "value": "ddc68c1c486514e24da7b3dc6217fae0", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525517, "uuid": "05a7ea87-2873-4aa6-9e1c-612c982855ae", "comment": "Malware payload (EternityStealer)", "value": "c1147a4f1f5430a49b73a9c0d7c86f5b47f6040eea6fa7e62f1fabbc54d65ef8", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525517, "uuid": "b759d6c6-8d00-4f2a-8af5-ef437c3e9f04", "comment": "Malware payload (EternityStealer)", "value": "0cdaa3ac9305ca6e99ae88219f7b385c156582e8", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525517, "uuid": "f18636ef-b241-441e-8a50-3c4c0aae5474", "comment": "Malware payload (EternityStealer)", "value": "eb0a81a7135063fe8bbc79840375c5d308989ef14d592e714c828ffbd8ed05e9ecf105eafb109a46a1432f4af50a21c7", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525517, "uuid": "02a2ee4d-0ba3-4a36-8070-d475fc4d11d9", "value": "T15695F12806BD67B2E079DF70DE708110F7E1A85BB761D95D2DEE009D0616E426AE333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525517, "uuid": "c6df2f21-6c31-429b-ad55-0b1197d44043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525517, "uuid": "5f9b5e69-29e9-49ed-a151-2cb1e6bedd23", "value": "49152:sr8VO67v8QPwr/TIK9Zal6yckXt9U+AHH3NW+vT7Bv7W:sr8P7vdPwjcl6yNDUVn3zrF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525517, "uuid": "6cbee64c-6dc3-43a6-b49c-9a96d0282cfc", "value": 2029056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525517, "uuid": "a7a1b45a-b7c8-494e-b650-377e4e0d2df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525517, "uuid": "0921ba65-786d-4cc8-ab6e-d5fd779b6013", "value": "ddc68c1c486514e24da7b3dc6217fae0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f77ff7-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680524763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524763, "uuid": "b3935f93-0919-4968-b82a-76dc60c9ccdd", "comment": "Malware payload (AgentTesla)", "value": "7105b90fb38cbfb87c81324292b69102", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524763, "uuid": "40dcc235-4bdf-480c-8ef6-fcf67b882ce3", "comment": "Malware payload (AgentTesla)", "value": "c1fea3070e2c0836fee930ce393a597e18a4c383a4ba007700d638f6a956da2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524763, "uuid": "6641312d-bd1d-4e2c-b2a1-0e29b161d4fe", "comment": "Malware payload (AgentTesla)", "value": "9b6347e063466a4cb98745a12322597dbb3fc089", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524763, "uuid": "ab01d0e6-c8af-440c-bbe8-9fb28d428b5e", "comment": "Malware payload (AgentTesla)", "value": "1953563ec88df274abe9ffca644525749f6b06deeeaae843fd4a9b8b00cd5873436a9c6dc7effc95831a3bbd96c2b01b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524763, "uuid": "4dd7d434-cf05-452f-9d24-e631af01ab0c", "value": "T146641200B2758867E4720B312EB11A96AFF6B90514B8C30777B077D5397A2938E2F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524763, "uuid": "ab472f43-54cb-4f29-95e0-d3afcd5c662b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524763, "uuid": "51eb9b25-19a2-4427-8d69-02d2b5624569", "value": "6144:/Ya6rJVwps42oP2koYyBKxcUu+oR7KavJ33iyKg/fJC8mD7sKdLthJXYeVpdA8zi:/YBspseXZXxcvUaRnIGfJ0zphJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524763, "uuid": "c2dedab6-ee65-4b39-ae04-7c34e92fb102", "value": 330179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524763, "uuid": "da37634f-6dac-4fbc-990f-68d805206ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524763, "uuid": "8b802993-569e-4ff9-b6db-cf1c85f19a88", "value": "rNewPOSPL036570_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a083bd69-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680522584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522584, "uuid": "90b8b572-7b28-4f24-a5fd-a7632349d268", "comment": "Malware payload (Gafgyt)", "value": "f9ff07530840878f285576ab26ae13af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522584, "uuid": "a3bef1c1-542b-463f-a1a1-f791e60f2d03", "comment": "Malware payload (Gafgyt)", "value": "c285a69d65af1e7f2fee4c586c86e17ed4560133843012b8332c1e92826dd372", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522584, "uuid": "bc5b2f90-c7d4-44eb-8888-562fb9afd0cf", "comment": "Malware payload (Gafgyt)", "value": "8f64fdf4672ef63e7974a8b1084dc9a81929d136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522584, "uuid": "bf2356a3-1a88-45c1-b398-51a6973a4063", "comment": "Malware payload (Gafgyt)", "value": "06bde770a7d52d02b5a1813453b1e2e54598ae01412b53a218c12cdd3fd62322955a3b673390381d749975c0f7b6f145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522584, "uuid": "95ffd510-dc06-4a53-a04b-9e85ab6267ca", "value": "T15CB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522584, "uuid": "2be4da9d-91ff-4a1b-95ee-88a217835ca7", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPoJmDk1c8xF6KjW:jfO8IB1JmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522584, "uuid": "59bc89a7-2d6b-4326-be4f-9d47254e9b5d", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522584, "uuid": "931db813-cc8d-4db1-905b-c61d920aa161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522584, "uuid": "70eecb7b-d6d3-4a2b-bd89-85acc8ebbf0e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18bd63-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496133, "uuid": "dfd0eacc-35b8-4cab-954b-29b121c3e2bc", "comment": "Malware payload", "value": "ca43bd6f46216f9039f91022e740a74b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496133, "uuid": "4d9f464f-4421-4576-b680-532031a5fe64", "comment": "Malware payload", "value": "c2b45baf7cf12097cc2ecaab0f6674769658d99d0a32d69dbfa76480108eb2bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496133, "uuid": "c979934b-4023-4902-8294-746aa1ba5a68", "comment": "Malware payload", "value": "596d9b570466dc8074f59970ce6672228e5c1511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496133, "uuid": "4c0c5255-8d32-4bd4-8ba2-cce20d9b283b", "comment": "Malware payload", "value": "76c038c1495c809a5f81bbb615e5497a00a27acde8a09c2063c62cdb4f9ff981cd9af8e385a084cd4d0be154d6f32feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496133, "uuid": "be3ea9c4-cf08-4e67-8a12-393e60ce7652", "value": "T1B7C48F32F3E14537C1671A399C1B96A99D35FF512E28B9866BF82C0C9F397813835292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496133, "uuid": "dd1cb2aa-9bcf-4ff1-a058-c612d0030776", "value": "12288:jv198F6wQ9HtyK1oL1LVz5GvJnlgf67aArwcFD4ET:bDVwQ9+LDz5UJB7a6Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496133, "uuid": "9967b845-d70a-4556-8528-52cafd93ce6a", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496133, "uuid": "2cd81b9c-f740-48aa-8917-2384f9a2b2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496133, "uuid": "74062260-0aa0-4bd9-b1cc-d07e6e525fa6", "value": "SecuriteInfo.com.W32.PossibleThreat.11780.9778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e26262b-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496166, "uuid": "c6692f9e-ed3f-4780-9e92-73c71dd95c17", "comment": "Malware payload", "value": "7a2e2a967c8f29e7908a3bf0cfc31852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496166, "uuid": "20672fdc-d5f0-48b6-ab15-219d976b8d40", "comment": "Malware payload", "value": "c38e29ee8b478f1df62dfd4fa9086d8d539f2d094af9671c9535394fbc47ccab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496166, "uuid": "64049cb7-0426-4556-96b9-da4c9dfebed5", "comment": "Malware payload", "value": "d8dfef91f5edb416184eccba9e02114a3c1ebed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496166, "uuid": "438e85dc-9242-4b2b-afcb-f14f031a1c80", "comment": "Malware payload", "value": "8545c1c5ebf613b8f0e6213f0d9d6cf9235dadcfd1f0643468d33caba0658ee09b52ab34ec25f33ea63a81dff00c478a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496166, "uuid": "8f5bb4f3-8334-4cdf-8952-8c9c8009674e", "value": "T165059D4AFAB3F8B5C32871B00277773669778E4A0B329FC35129DA2D9D235509A37235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496166, "uuid": "8e03b830-0053-4709-ac89-b8a0585ffa45", "value": "6144:fB/0xwxqaVm5BJeWIHWZWSrpr6nsTa2GpxNI2gi+p6YkhpV4:fB/lsNJeWI2n6sWVpxm2g76Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496166, "uuid": "0566e34f-0f14-49a7-8129-587ba44eb2e0", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496166, "uuid": "5d4c4d3d-ad2c-4136-ba26-ba5be639f983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496166, "uuid": "731d9710-8444-4032-8e82-c8225a1827f1", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.17277.3024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c349d8-d213-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680521461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521461, "uuid": "ef4b0ef5-2a3d-4ff5-99d1-4b46bffd0b31", "comment": "Malware payload (Formbook)", "value": "37d84ba2033aa60710db536a9b03f6e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521461, "uuid": "391df88a-d3df-49fd-b484-51fa72c9a075", "comment": "Malware payload (Formbook)", "value": "c3affae1546bd52cefac3b0692c5a2f66f72119d4b3fbb6d75afcd45e1ae6849", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521461, "uuid": "55a51400-0015-4be4-be50-e33203b34257", "comment": "Malware payload (Formbook)", "value": "346617349ccfec982f7e69b0d62790652bc2e0c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521461, "uuid": "eeb1c03c-3161-4f93-bb6e-a9d00975592d", "comment": "Malware payload (Formbook)", "value": "6b5dbc980ae4ce883457c6c2695350a1df795ec282e009cba6b1c7ebfde4c187d58212bc4b3b6205d3699b4f038a1825", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521461, "uuid": "8151c18a-b6a6-44ae-be48-561efa3a31bb", "value": "T1E6350217A6008E4ED5068B74AF67A8E9420F7E417D9EB48730067B5F2EF3E11B903E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521461, "uuid": "79541381-cf6c-40fd-abe8-f650b9f73b2e", "value": "12288:enaFiKXKAqUu9VnewqqDArDqUu9VneqqUu9Vneoq9PArgqUu9Vne6Ard1ehtARk:NLKeu9Vmu9V/u9Vuu9VmqWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521461, "uuid": "36f86fdb-38f2-41b0-b6bf-33d46b2011b6", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521461, "uuid": "714b4da7-87b8-4d73-8b11-4b3cb0ef7b79", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521461, "uuid": "019fdd63-1767-4e88-b431-8ef41391d93c", "value": "PSC_ A-230331.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ea26e9-d226-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680529628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529628, "uuid": "d51ae11b-8697-484d-b857-f36f1feac495", "comment": "Malware payload (AgentTesla)", "value": "f1cb3bd3d5c4bc99c20a7710a94f8de4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529628, "uuid": "af369839-1389-46a8-881b-749ac6cd21ea", "comment": "Malware payload (AgentTesla)", "value": "c3b33b93e157e6ddaae3f1ea24021fef617d7c33f555b76cb4eee4aa5cd39815", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529628, "uuid": "7a88485a-5e40-45dc-846f-2d803b534fdd", "comment": "Malware payload (AgentTesla)", "value": "70b2a52f900d81249e393f34347c5e4e1b72ce00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529628, "uuid": "e8805586-3971-4b52-b315-814fec37589d", "comment": "Malware payload (AgentTesla)", "value": "bbceada35901f7910f1997e8fb5678690f34354f8ca263fc1040accfd081c33089151cc13803e942286416c2afb67b51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529628, "uuid": "45157342-f6cb-4f56-8e54-97e3a1e35500", "value": "T16F84CF126B65CD03E391527C4056E7BC8E266F94B906CF2367F9ADCB7A14B23293D183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529628, "uuid": "10a9ece4-8c9d-432e-9f70-e8c4530213e5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529628, "uuid": "17e4d17f-d65e-4887-9c78-9d049b4ac366", "value": "6144:AspNjlsvCnvxZGVGGMrYfXcHQ25Cayuy2OIPCC0tEF4FU11hFRnRklpRK9i5Hp:AcBw255U2O2b0tEJj9i5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680529628, "uuid": "cef083e7-1384-4146-bf77-1d62dba1e440", "value": 384472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680529628, "uuid": "4c27af59-a3bc-4364-b072-32c668eef334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529628, "uuid": "fc40af73-4052-4ee7-923c-0d352018e47b", "value": "c3b33b93e157e6ddaae3f1ea24021fef617d7c33f555b76cb4eee4aa5cd39815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ac700e-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501311, "uuid": "19e390d1-7b84-449d-bcad-ef70dca8627b", "comment": "Malware payload (Formbook)", "value": "b21cc8aeb2fe02010f31d93d7e6e12c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501311, "uuid": "7ba46e4b-bd4a-4e7a-b517-b167eda465c7", "comment": "Malware payload (Formbook)", "value": "c3c4281831f463d7ee622d35ea584b893b99400c0dc7dda327557d48f10ec564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501311, "uuid": "6092f3c3-171b-4d56-ba55-2dd729a81150", "comment": "Malware payload (Formbook)", "value": "35998957140ec01707b1d63a3157644fbf67e836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501311, "uuid": "06732701-91b3-4e6a-9f73-ce3f8bbb5400", "comment": "Malware payload (Formbook)", "value": "e178680e5d6dcb03393d6425e9d982aba4939e1b94a3d7d44596da6c64c640f6e76257bdca1120e4683f7a497934255d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501311, "uuid": "e1831f0f-b67d-43a9-87e0-040e006e6f86", "value": "T1DFE41281362D6E2BCA6D41FEA423660A13789C76B106C7DF1CC438FA6AE7B549405FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501311, "uuid": "28c1e63a-6a11-466a-b74c-3566f0589c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501311, "uuid": "db76c99a-7434-4137-9083-78365a6933ec", "value": "12288:7+tzLwrrX9AgR7E+OxQCrz2Mp7wtRNx/mkWWXfsJL2jZk6SoIjWZTdw1Z:tXR7LO6C/ANBmkDXfMgZk0IjWZxw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501311, "uuid": "595c6dcc-be2f-4403-9e83-dfcf15e5f84b", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501311, "uuid": "1398ea34-8fea-49c1-86a8-36bef80deb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501311, "uuid": "280c91fa-13df-4215-bb12-d5a474c67ea6", "value": "ORDEN DE COMPRA 6547#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbee984-d24c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680546039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546039, "uuid": "509e1880-bf8c-4a02-a919-001e20b1ed2c", "comment": "Malware payload", "value": "ee33d3591694e6c77953264b778ae2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546039, "uuid": "bcae485e-dd69-4097-a34d-8ad6c68f0fc6", "comment": "Malware payload", "value": "c4696bab213507b524fecce34faa2c1594669a95593f6ff1abf76cfa329b7b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546039, "uuid": "c3484f30-8a9d-4953-8593-816af86958c9", "comment": "Malware payload", "value": "ed7fbdd813cb087a1656a092c86aa82ee898e0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680546039, "uuid": "cc58c499-2642-409f-958e-8236d5c4c8a3", "comment": "Malware payload", "value": "3e8c2aa949c8ed46e1156312d5befc87ebf5c3c7778c7b8f44e5df962f618fa37e7ca914da569cadb9f1af2753f9c7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546039, "uuid": "9d6f1f32-7a0c-440c-8b23-533ea701e2a4", "value": "T1DF2523149298A227C9290FFBF473E70813B1F52B2953D3BE5CCA24EB5F76B508551A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546039, "uuid": "e4791a7e-0c67-4c6b-a2e9-97c5fdecbfd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546039, "uuid": "92acd229-3eec-4305-a87e-e1c12ccb2229", "value": "24576:ifrpQgwOoqYJHi2nb0CxnH6IrsHEXk0F+HonDQkfd:ifrpBoqY1FZ0RkXki+KQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680546039, "uuid": "f529ee5a-91de-4c56-b3c3-6c6abb59a9da", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680546039, "uuid": "2130922f-841e-4d54-af99-8db101656fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680546039, "uuid": "c7e2e002-ef51-42f8-919d-f50f36d45625", "value": "Shipping Documents PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a6971e-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526718, "uuid": "65d5f3db-f176-457b-8670-cad9db69ac70", "comment": "Malware payload (Gafgyt)", "value": "b3a0fc932bbf517e748f3f98748f57fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526718, "uuid": "556d6bc3-2245-42b3-8268-6025dec1494e", "comment": "Malware payload (Gafgyt)", "value": "c4aad4a4e3ddde28dec489eadb43ab340c98aae03726337176b4044f9cc504eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526718, "uuid": "377bdb20-1a81-49ea-bd40-6546e0ab4aca", "comment": "Malware payload (Gafgyt)", "value": "b7b9c5f8a0283b7729103e1d0d8cbadbcf7f8c2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526718, "uuid": "28bc33b2-0833-41d4-975f-9fb3356ff4f5", "comment": "Malware payload (Gafgyt)", "value": "a6cbcd0467844358c958bc7b5e5683445612f36efc6f0bf93346edc499d33dc97f0bcfa4a61282f390ba4b20f655d68f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526718, "uuid": "cf4cb633-876a-4777-a8ed-646a56cb03c0", "value": "T1B4933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526718, "uuid": "0dde0388-7740-4157-896a-67ad326aebd3", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emvGMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8rpeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526718, "uuid": "5c5f8cd9-c5c9-4921-b0dc-833a02679009", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526718, "uuid": "b8f2ece5-3d19-48b6-b522-3ebfc436d705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526718, "uuid": "d6713100-e58f-41b5-b236-30adc5f42a80", "value": "b3a0fc932bbf517e748f3f98748f57fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fca1aee-d20f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680519952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519952, "uuid": "038fe47d-149f-47e9-a84a-4bd679028d14", "comment": "Malware payload (Formbook)", "value": "ebad0400cfa3bf5b33ff9871641d533a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519952, "uuid": "16bd3647-8ddb-43c3-bd59-a6b353ed1a20", "comment": "Malware payload (Formbook)", "value": "c4adaf7c7ffca014291d4f16c6ac3b5ac2d3816f4ac8572e78872cbd52440061", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519952, "uuid": "0f64c408-8573-448d-ba1b-88554f146e28", "comment": "Malware payload (Formbook)", "value": "095b09885fdc208e2765680cb1e7436ed1b4f501", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519952, "uuid": "e9a5a450-70d3-4497-a4d1-9fc1522f9770", "comment": "Malware payload (Formbook)", "value": "a74b92fec6e24ec38538f0ac27beac08bfd8d3e93be1574ac3fc77cb95746de69acc4d82db46fa2b9193134df938e954", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pw-2227", "colour": "#3348EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519952, "uuid": "b95b17af-d46d-492b-adfa-78d14427fd70", "value": "T18326333DD38C0962C2F59B36A3BBA56319661C84C5EAF517B52A68C20FD3C891F472CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519952, "uuid": "19073db7-de39-4f74-a38c-c20d4d80ec5c", "value": "98304:3fioND+IQgyWaU0bn3Phved6/MJdCLglwZ5l2wAjhmFm:qSfQbWaU43JevJdd42wA9cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519952, "uuid": "64d09cec-18b0-4a65-9d19-540c0028c441", "value": 4454410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519952, "uuid": "d2e6239a-755d-417d-8116-5009a4908de7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519952, "uuid": "6b8fb5b2-9944-4d8a-9b0e-ce67442a3a0b", "value": "newupdate_password_2227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecdf7fa-d1d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680493215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680493215, "uuid": "d57233f6-14ad-4466-8db9-6f7dec92c620", "comment": "Malware payload (RedLineStealer)", "value": "aa88205f54e976266816c4a4cf7b4f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680493215, "uuid": "5be86805-a7e5-4f22-86ef-f2d8f7645715", "comment": "Malware payload (RedLineStealer)", "value": "c4d4de77757f756c4956e3e75f13df9efeabfcc3da1d92b9ff0524db80c519c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680493215, "uuid": "35afe927-5b78-4c59-8ef3-835e4ef2a5e4", "comment": "Malware payload (RedLineStealer)", "value": "4412dad5de6dd53890eb9c44c5e7dae14d5b8e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680493215, "uuid": "318b103e-e215-4578-8a02-4e1c48c2ba0c", "comment": "Malware payload (RedLineStealer)", "value": "495d698873b85800eed1a69fd5696eb11f16f96b96ee27a0da438a93d3b2c27ad2ce04f2f8f549174ce09014c2cbc601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680493215, "uuid": "f258e814-95a2-4bb4-a3d8-654ec0a7638d", "value": "T18074E0127792C472F81B05759816CAB49E7FBC704B1286CB2B8817BE4F357E1CA36366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680493215, "uuid": "605e5b92-1d52-440e-922f-e7982e8d5f2b", "value": "131680c2cabbac9aaecb70167d143fcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680493215, "uuid": "0e6f20d9-ce0e-4579-9445-a56727b8ebac", "value": "6144:mE7LceAw/MGTN7ZTPSK0RMPmBhyosjoamTUc:37tAQMw7h6KHCojoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680493215, "uuid": "2b65f41c-5957-45fa-90bb-a6d676d54165", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680493215, "uuid": "9d17aba7-f10f-4e2c-902d-6f0eae244646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680493215, "uuid": "ef4b7a86-c9d2-4fe6-bb03-f5155e142049", "value": "aa88205f54e976266816c4a4cf7b4f54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d54694-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525538, "uuid": "45ce5567-da50-4775-ba35-2dcc0f19796e", "comment": "Malware payload (DanaBot)", "value": "ddb4dfde76b491d603e003da4d78d994", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525538, "uuid": "f34f76b4-2b3d-44aa-a97f-b62e8c04f603", "comment": "Malware payload (DanaBot)", "value": "c535c0448c348958d31b41a49451fe0d15dd3def4ad929ff6a46c8346b2f4c73", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525538, "uuid": "abba8bf3-f1e8-4af3-8e75-55761fe53f15", "comment": "Malware payload (DanaBot)", "value": "f1a1bf91006dec4e990a6c8ca11a6376a4fad8d0", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525538, "uuid": "fa6e8357-e268-450a-899f-5ee861bb3ebc", "comment": "Malware payload (DanaBot)", "value": "5b6f4521f0ac2eaa892187c0648ea990b9ec8d8e3e14ccaca8099a43ad2ec735d30914f554e8c3e19d05be3024309b11", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525538, "uuid": "1eb0232f-c98e-415e-8396-8d34b0dc9050", "value": "T143363382175A58F4EC435376AF2EC2E0462CBC426EA2FD9D2B83B56F4D745D0C24B729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525538, "uuid": "58bf2930-9a85-4e2c-af16-15120754383b", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525538, "uuid": "22316a54-3cad-4af5-a267-52d7146dfa5e", "value": "98304:ATFV+rR0sKsx9o9VprGGGhCLfsFw8E+0kgJJZMESxUtBt:ATwSs7vo9i3hCQ4dJJZM7xUtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525538, "uuid": "7d2f3699-c2b8-4004-b41e-80a927118986", "value": 4947968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525538, "uuid": "ae35e9bd-4d10-406c-bd22-a2c91aa9690d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525538, "uuid": "3f02159c-73b6-4642-aa7d-626adfe34f00", "value": "ddb4dfde76b491d603e003da4d78d994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2ef4a5-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680522981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522981, "uuid": "e38faab5-84c2-46a3-853a-1f501eec907c", "comment": "Malware payload (RedLineStealer)", "value": "8cfd4a41ac09182a90b619b69f20f005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522981, "uuid": "f2906654-f380-4701-b5ce-2f5023448157", "comment": "Malware payload (RedLineStealer)", "value": "c611fbc800a3233c4455a1ce4d00b513e2a34bbb3108351f45d2db42c95d7261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522981, "uuid": "faca9245-d002-42b2-b421-7b71bb8840ec", "comment": "Malware payload (RedLineStealer)", "value": "429bdb6c79c1d5259741ce8a8a6359b8a1cf1fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522981, "uuid": "85853e96-56c1-49ab-a62c-cff8aceeacb7", "comment": "Malware payload (RedLineStealer)", "value": "65a980bb31570f78221b3bb129a879af1d3955369dc5afa5f764a3962f32901b81234e8670ffeb12245603af16849adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522981, "uuid": "5658c9e1-3119-46f8-b611-be8b0c56a2df", "value": "T186B40257B7F45632ECF027F059FA13970B32BCA19838C27A2759695A0CB2780A536737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522981, "uuid": "b834bfb1-848c-40e0-a488-f2114e9b1384", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522981, "uuid": "c02f8125-0fec-4e3c-b431-6b3be8ad364c", "value": "12288:XMrQy90GlksLHIEUTgaGEgW5k9L3U32fec665rhWPrD:vyV9DqZGEPkh3U32fecLgPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522981, "uuid": "7568eb7c-b72f-4ae3-869f-5de318cc6883", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522981, "uuid": "eef3737d-5f9c-4377-840c-f7efe2fbe74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522981, "uuid": "28a6cf93-2517-4cbe-aa7c-fe4e6925b76b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabd153f-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680523514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523514, "uuid": "6ab94a31-6b7b-48b8-bc12-c289d59630a1", "comment": "Malware payload (TeamBot)", "value": "944de242edf61a6e46c7093f987ff9e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523514, "uuid": "f4ba6ea8-2c0a-47f6-91c9-982ab4700ae4", "comment": "Malware payload (TeamBot)", "value": "c698e1f35a88d35dc3272504786cd78be39e106d53ddc41d8226a6c5e60a42df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523514, "uuid": "79135be8-cab4-4770-9812-6e8d673997b6", "comment": "Malware payload (TeamBot)", "value": "5b83070153c6b7882f63a524d6e200620c7dfebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523514, "uuid": "638d4462-fa75-47e4-bbe3-d7bfaee7a55b", "comment": "Malware payload (TeamBot)", "value": "1d23c6a084c9023bc562a009380aedfcaef239ea878de4621a576626405eac256155772eb9b87d0ef97fa368ef60cba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523514, "uuid": "ee4bdee2-7118-4be6-9173-a5b49efbeb21", "value": "T117646C825AD4A830E13F47328F2EC2F4261EBC629E197E9F2675FE3F0934161D962715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523514, "uuid": "812575c3-044a-4073-a4cd-fc77ceb0ea7e", "value": "5ca6a4f926acaf79e41109061c7e5b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523514, "uuid": "585f856c-4a31-4874-a2b6-34c9b050e350", "value": "3072:n2+A5n/FEpN5GsK5UcrHqOJ22pXI8SKBiJTOYktVuR1UrB9pujkEPS:295/FE4a2NI8XAbkJjujd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523514, "uuid": "474a6dff-d7c5-4009-869a-a5e2bc077591", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523514, "uuid": "e80f36a9-6506-4e8e-9b40-b88da61d5d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523514, "uuid": "3d816400-5eec-4ff2-960d-cbbca11f40f8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc9b662-d249-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680544940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544940, "uuid": "01e70d44-8f02-4dcf-915e-300dba64d3d2", "comment": "Malware payload (Mirai)", "value": "53e910f5fa1ecaf936e9ee4586402552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544940, "uuid": "75362d7c-b773-415b-a41c-8fbb7051c6f0", "comment": "Malware payload (Mirai)", "value": "c8b5750c4dacfc606be5ce538f2e2844f33d70f3495dc1290c9224b78e024c47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544940, "uuid": "3af56b0c-6749-41c4-9b0f-461c4e41968f", "comment": "Malware payload (Mirai)", "value": "9a998b969377aecbfd16a7985183a1c407395e9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544940, "uuid": "f18e6c58-6b27-4ad2-bac9-3e78bed601ce", "comment": "Malware payload (Mirai)", "value": "282e996b9365bb39299beaa8ee91ce5bec8383235c80edbdca12a9b6d8b419e34ed007cfcfbff0e7cd645f798838bf0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544940, "uuid": "dd2d1fe7-e2c6-4e17-9d25-7cc0c407cb30", "value": "T1DE632851FC819A23C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544940, "uuid": "22a26baa-a43e-4cba-b727-f7cb6fbe3a1a", "value": "1536:ONKlxkmiig51kRmO//kWUztRiAsDwY8rNRuVAvvWF:ONDWzk1JRiAsDHaJvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544940, "uuid": "3f3027b3-ae69-4ff3-83a5-b414ee51d122", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544940, "uuid": "db1bc05b-ac4b-42c2-8f46-1e04bb3af315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544940, "uuid": "398efe4d-1392-46ca-94f0-cd0d98cbfbd2", "value": "53e910f5fa1ecaf936e9ee4586402552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df40dee-d225-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680529237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529237, "uuid": "f59ac948-744c-41a6-b15e-ebff523fc082", "comment": "Malware payload (AgentTesla)", "value": "0aa7526a87d723ef44760f584ca44cba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529237, "uuid": "f4513fd8-87d4-4438-902a-f166dfc2518c", "comment": "Malware payload (AgentTesla)", "value": "c926c9812327ced09a6279f86abce7caecb49c8d53abd7c901d5267b8d07b487", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529237, "uuid": "f8fb5353-7672-4666-b0fc-a33494844be9", "comment": "Malware payload (AgentTesla)", "value": "1e24b3a2ee21c9797962114d53d9c90e2d77b6f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529237, "uuid": "a5f5b415-6ef3-491e-b820-092a097fdaba", "comment": "Malware payload (AgentTesla)", "value": "2936a43fbe3d4774ef0eb60894ca25ebbac5c25e09ff6a42c093206ff375d202d992205e236362b4146b8dd69383ca94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529237, "uuid": "537ce3c8-8756-4515-bf75-8ba55916fe30", "value": "T178F402346B9A5634F532177C89B862C5A77EB7622717D94E08F111CE4B63B038EC1A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529237, "uuid": "523b10a3-6ac9-41d6-a778-427a176d1e46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529237, "uuid": "50c0cabf-9448-4277-b211-b8397e5acbe5", "value": "12288:ZsQmYMUnFW/NybLDYCrmRUwl2wu6a/nErnoSslVZXlW66gqmTe0oEmpInOwW7yzf:ZsQUEvDY1Uwl2pL/nenoSIVZA/gcHEJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680529237, "uuid": "fd423ca8-b7c0-4128-8f7c-534766e40d82", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680529237, "uuid": "cc092f52-11a9-492c-87a1-108754e2a81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529237, "uuid": "b3676061-0deb-4e3e-a437-5e55fcd27907", "value": "c926c9812327ced09a6279f86abce7caecb49c8d53abd7c901d5267b8d07b487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c194889-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680501317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501317, "uuid": "9b564e93-48cc-408c-b7b0-d89e401d5417", "comment": "Malware payload (AgentTesla)", "value": "17f10da48f408784b89b99b63c03c86f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501317, "uuid": "0bc7b31b-b556-4068-a21c-9d31b3f86c5b", "comment": "Malware payload (AgentTesla)", "value": "c92700f557efbce3d2bdde80abfe0397c6816f4df90487f2fae25d05ecdb1581", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501317, "uuid": "4e7463f4-95cb-466a-8ab8-dc21f8620954", "comment": "Malware payload (AgentTesla)", "value": "716060ed46ff43fa9d34dc549175182d1780425b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501317, "uuid": "e5c84c45-6b88-4ad0-8d5e-817a11fa0a87", "comment": "Malware payload (AgentTesla)", "value": "9777d43d06b4f2dab5eb51bb2a0da5d3c21b5efcfcedcd056b5e3405dc86ae85031ba7cb28febe2fb6d724e9356eab14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501317, "uuid": "f956c6e7-b4f0-4107-b70b-ab28e9768cc4", "value": "T1F494020479B1F427C3A605352D3EDEB3ABADEC2254D24B7B27973B4E2D700D15A4B2A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501317, "uuid": "8bb0e379-b45a-4f17-9ffe-32e581219752", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501317, "uuid": "d2d61614-9671-4f54-b939-5b0ef0c2297f", "value": "6144:mT4DtVDc8/gxCuWcaUJSjqGV5+tgiTIF15HSUDsBeavld1RQsdlYMnkxaz5T:mTuSt3J6qsisSysLvld1X8Mncs5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501317, "uuid": "8496ffa3-e38c-48e9-9d28-2ec029082eee", "value": 433592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501317, "uuid": "4d8f0ee8-7246-4c73-93dc-996f5b35ee4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501317, "uuid": "f777be1a-4120-4501-997a-6a8171a131bb", "value": "PRICE REQUEST FOR PO#017897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d81abc8-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "0321e8a2-14de-441b-8f8d-fd6117451890", "comment": "Malware payload (Rhadamanthys)", "value": "a3dc7bc486875187109ab0dac462520c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "7dfaf6d0-bb28-4798-a281-2dcdb7e27cc2", "comment": "Malware payload (Rhadamanthys)", "value": "c973c87d98a07bf9142fcdcb4a2b647db3e17ddf20b3fcdfffe00892d3a2bbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "cf0a8396-638f-4361-a254-fec283e24d1d", "comment": "Malware payload (Rhadamanthys)", "value": "00957b6b261f58ca6a6a5accc497a763751ea750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "ac9887d8-564c-4e7c-94ae-6ff41aa4f2da", "comment": "Malware payload (Rhadamanthys)", "value": "c28765a07a738a3ebe3cfda4dd37bf3aa697281e5e4a1399b040a12a0045c51065c089d217e44a4527b9367b19d0eb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "f2216feb-ad34-49e5-a504-c495385be0e3", "value": "T16E64CF4267E0A830F61246324E1EC3F4AA5EBC61AE257E9E2755BE3F0D351B1D326317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "116b28e7-b2c1-4eeb-beef-c3bac339f4d9", "value": "5859c059bd1a01b909084ca1cc7531a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "faa045db-5174-4d8c-926c-fd69b27faeef", "value": "6144:u3pZadXkyaVar38YhT/kc32/eRVP7yOHZtkjt:u5ZYXkwPhT5Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525425, "uuid": "0c33db1d-3fb2-47e3-a032-eda1e210f228", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525425, "uuid": "67f2c227-b4a6-4242-8c0d-642be4b5fd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "05d4981b-582b-404f-8cb9-2b8c0b0ab7fa", "value": "a3dc7bc486875187109ab0dac462520c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b0a700-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680524920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524920, "uuid": "c98ca212-84e3-40ff-8cd1-fe1b175c1e03", "comment": "Malware payload (AveMariaRAT)", "value": "ec5df44a36001e9f2200fd7fff14924f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524920, "uuid": "4df472cf-1d71-4d5d-a992-79011bb6d739", "comment": "Malware payload (AveMariaRAT)", "value": "caf7cfc2d3a76c442c36aa41e192ade5c4da13e51000b8f2746cc0ced8f4e0a1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524920, "uuid": "adf1f769-9b33-4bc1-ae73-f7f5c9affc2f", "comment": "Malware payload (AveMariaRAT)", "value": "8d2022e732d1e5f6ac485b5109126bb36bc84e23", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524920, "uuid": "b08e74d4-8f88-4b45-8508-37b43d9607a6", "comment": "Malware payload (AveMariaRAT)", "value": "b41200533dff542801bbc3e4dd6a1ff1f1a633f1f6aa1957ef760b5450c51858d2dfc78e1ccc9ba4354ce3335bc2a8d7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524920, "uuid": "2f571b11-15fc-406c-8e29-02a93a3a2a0e", "value": "T17264BE9C318377CFCB0B87F1A6AF5C24A67065AAD20E4E175093D1E88A9F5428F1D0ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524920, "uuid": "471e2f29-b500-429f-a3de-ab3d36aa3be8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524920, "uuid": "9d482add-42f0-4dfc-869c-e1f5223cb80e", "value": "6144:+OGfqDye3NCT8yGjm04y0O12udoEUAybGMVxI:+OmiCgD4wldEKMVxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524920, "uuid": "93cca5c7-16f4-4229-975e-80ab2a09e97a", "value": 309992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524920, "uuid": "be069396-0f99-4714-9713-281dde5adff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524920, "uuid": "d7d62fba-eeec-45ac-b8a5-76e9d56b0d0a", "value": "HSBC payment receipt confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15476e90-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680501305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501305, "uuid": "78c3b0f9-809c-47f0-9691-f4bb22e96ab8", "comment": "Malware payload (Loki)", "value": "46a27ecc0227dd1be80461ff1e0c25a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501305, "uuid": "1cecaae4-d568-4715-85d6-c0c1b008cd19", "comment": "Malware payload (Loki)", "value": "cb23dac6962dc6d636391d6648e37371d6f5d54a45bb5194693004c3b47ef87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501305, "uuid": "8300c46c-4eb0-4303-a0fa-e549f6b4a7e8", "comment": "Malware payload (Loki)", "value": "1a1fc2b74349e24e75951c18c74c9a233342efd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501305, "uuid": "31592a59-2bf8-4dff-96ae-61089e823c6b", "comment": "Malware payload (Loki)", "value": "3f1881420e997082fc5d04b9c36ede88a9068f81e8d4774c1c9e0d1dfa3678c73a18f7e1cc5721b8fe84b630db3ed4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501305, "uuid": "a49e9f17-fb9e-4579-85a9-0198e1337ca4", "value": "T140C4124A335C5D1BC63D46FB9062610B43798876FA16C7E62CC898EF5AE2F844901FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501305, "uuid": "1402aa10-8ee0-4376-a7f7-0f2dabc72978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501305, "uuid": "083af0f0-0a1d-4af6-9100-ef34717733e2", "value": "12288:GitzLwrEBUf2WzdGCep0wMZd8/P6AiMqyGb0RqwHkjb:KgaeWpGCiD/PTiMt7RVEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501305, "uuid": "5cc9c6fb-d1d9-4e73-9e3d-7db93977182b", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501305, "uuid": "18099fb7-492d-46f2-8234-c47cb12451cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501305, "uuid": "c86c4e7a-53ed-42cd-ad30-f9958c690a8d", "value": "FedEx Shipping Documents..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22312215-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525808, "uuid": "9d597c04-12a7-4f43-a0b6-33907bc9c4ec", "comment": "Malware payload (DanaBot)", "value": "e7b8808cf0ff7e5faa7bb2df6c68f03c", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525808, "uuid": "abaef06b-d9e5-4704-853e-c7152fba38b4", "comment": "Malware payload (DanaBot)", "value": "cb6e209a194cff5858929f256feacfd2ef85acf825b222487b0ba26ba34b1b0f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525808, "uuid": "49b6a3f9-499b-4a7d-9f1e-86b055964dd4", "comment": "Malware payload (DanaBot)", "value": "688cfa3840e5d375fd0a4816e1ed91c27607441d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525808, "uuid": "e295a511-0ed9-425a-b637-eb859df4ca31", "comment": "Malware payload (DanaBot)", "value": "1ed066b96ca4ad01999e38cc48c61406b1aab5d4ca85b0fd1f32c7d544878ff90846ea4d0f2bb292e5bb7dff2c622c62", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525808, "uuid": "39509869-d10c-4d61-b5ed-dc59e79f13c4", "value": "T1F4363336724584F9F45E4A30257AE5A2280FF4A88FC28773BE8023BD54726D4D753ABD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525808, "uuid": "ac4de0a7-8344-429f-a6b4-82ae514f8bdf", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525808, "uuid": "2b67edfe-0a2f-433c-9e60-4e3c857f4a39", "value": "98304:pJpQkt+zkVCSu1NHbHUuVcYIwBTQlOZmYe+waWTIY7ANP8v4:5+kVU1VjhVhIDOZz3waWTMR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525808, "uuid": "4bcf59bb-ee88-4572-b959-0a5ae1fd782e", "value": 4899328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525808, "uuid": "8b39df5d-9aec-4f7c-a8ee-ab5fbb8bdbbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525808, "uuid": "c8c83e99-7255-4453-9acd-d8c3e150453b", "value": "e7b8808cf0ff7e5faa7bb2df6c68f03c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620c9ba6-d259-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680551685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551685, "uuid": "5cddd129-ea80-4d2b-ab51-6b3fa250f889", "comment": "Malware payload (RedLineStealer)", "value": "8b7dbfdfb4d91e679d3403f6a07d4295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551685, "uuid": "1a635fe5-0e60-4b7b-9c14-277f794fae8e", "comment": "Malware payload (RedLineStealer)", "value": "cc76e4a6588fd6111f4cbfb48dec471ffd035fb68c9ea97e15ee98442dda4813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551685, "uuid": "b240a93d-3e31-4bab-8efb-5f6786def330", "comment": "Malware payload (RedLineStealer)", "value": "f121eae2c813eed61c3a6beeb16d044b9c89aac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551685, "uuid": "1294793d-ec7b-4d29-8c74-a9df2f61d158", "comment": "Malware payload (RedLineStealer)", "value": "752fb4e1119c9b82d2b930b69bbb3bed69f86ee79a83f8435732ec10e30f833e4c4dd214228c9a68eb1d0ab6a5b5aac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551685, "uuid": "d9ce573c-76d8-4ac4-b874-115e0b36d094", "value": "T186746466F1E52444E6CA86BB01EFEAF8CC366963EBE21391A25C5707450B01D52FF0B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551685, "uuid": "c7126a96-10a5-4abc-bb12-26766f489d5a", "value": "2ec1e43fddcd7fe383eaa8dbeb0dd6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551685, "uuid": "577b3d7f-8225-4cc8-9da5-de2f67b5b96c", "value": "6144:GovWQQ2OfagCFUdP2NocZR5s9TiXQr2zIcz3v:JbQ2cCFUMN3ZST0QAIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551685, "uuid": "e82eab27-e3ab-4e34-8ad1-3efe28879e02", "value": 363680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551685, "uuid": "46504fa7-26e9-49aa-95e6-9a1ee26ad554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551685, "uuid": "c0b74870-e581-4f3e-87ef-ea529a01a6aa", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da57530-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "addc45b2-4727-4d8f-82bc-f8763a02ab40", "comment": "Malware payload (Gafgyt)", "value": "b767a94dced489731db51e99e6ec8621", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "ac7d0486-210e-47d3-b687-cca301ceb6d6", "comment": "Malware payload (Gafgyt)", "value": "cd7f708c7708787fdffbfac30e8a3116daf37748d2217cca159a40e0fa3ebe10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "174114db-ba71-4eaf-b0c2-592358e70473", "comment": "Malware payload (Gafgyt)", "value": "870d9596fa87372caefddf998f0dd9f5dac3105b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525425, "uuid": "5507291d-2ea8-4e06-9323-33006b37ef1a", "comment": "Malware payload (Gafgyt)", "value": "23aefa1e53d37a1ed5835abbf5f39695da815a98689af94e2162789a8875a2f9cddca1497112391cd3727c06b7b8fdae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "925fbb10-126a-4bef-ac44-f4f9f38d9656", "value": "T125735C176991CB7BC4C747F92FDB952144A3F83E1B32620A73D8BDA92B1A9C82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "19eada67-3ee6-4d90-a122-d5c0a8d69da0", "value": "1536:47IZuSaH+1iDnD+Q8bQ8O32Ls0FnswNjzvmA+JbOm/coZ3ymj:eCae1ItqQH2LDnsEjzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525425, "uuid": "28c447c4-f0ff-4586-ba6d-234cd46f04d0", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525425, "uuid": "624d7abd-5f66-48e7-a949-b49bdc98b1e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525425, "uuid": "550a45a0-639b-4a24-a8bc-ffc8e22404d0", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069fd61e-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680521897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521897, "uuid": "afa4829f-8228-4526-a0b1-b4a239ce6ec0", "comment": "Malware payload (Amadey)", "value": "0ad8c6e4e95a63ea641dea518d5e8c07", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521897, "uuid": "62928f30-965b-43d1-98e0-2f6f48222947", "comment": "Malware payload (Amadey)", "value": "cdeb88c4512515456fddd617fb88a6033a552801d5e6e28b577395a21287e638", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521897, "uuid": "29b918c5-88c5-40f4-b092-9d3dfce01c7c", "comment": "Malware payload (Amadey)", "value": "ff34b1d8af03aee9be2403f4c6c60ce1ae361b15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521897, "uuid": "8c436323-562c-45b8-bc9b-ca0fa39ce14b", "comment": "Malware payload (Amadey)", "value": "4e246be1fcdc64c0d906b714f4ab027b817110d999d39df79615c0d3bac8de39c3e90d2c5f7be16173d2edd1381c626e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521897, "uuid": "51290a68-eb14-40ec-bde4-16fe1087440f", "value": "T171646C0257E56870E53E47328F1EC3F8260EFC629E16BE9B2679BE3F09741A1D522705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521897, "uuid": "d31b963d-5438-46e8-8448-1b9421119dcc", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521897, "uuid": "20b1821f-fd05-4e71-abfd-5ba932fc8efe", "value": "3072:s8kSd+qs9XK0vx08/OGE9lyhotT9sAXM4sZVHr1kYeOnQEP:dz8qkXKddyitT9LmZ5iYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521897, "uuid": "04cae816-3894-422a-a719-c6327cc56b91", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521897, "uuid": "172909d6-53fa-4549-bce6-85d09773bea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521897, "uuid": "28093cc3-62d9-445b-8d56-b5c3e8cb0dd4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c2a1b7-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496130, "uuid": "0f5ff551-5574-402c-b5a5-d5cdc79ac88b", "comment": "Malware payload", "value": "efff23d4cf0636e1b33983e68728769f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496130, "uuid": "3988e53e-1c41-43c4-a533-bfce15e006cb", "comment": "Malware payload", "value": "cecbecd1b0dabc124b363f26525dceff5e6dce0bd9c4e26c7764b82aa6cfa6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496130, "uuid": "f6967463-a92a-4f57-8efe-f1a1dcdbab6d", "comment": "Malware payload", "value": "167ef9d885724aaa7f6f7dddfe4cf42d3392a0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496130, "uuid": "51967c93-337a-4244-97aa-1233b63efce5", "comment": "Malware payload", "value": "14d9481ae142c4208827dc96926e4e55e66e2ca9511c9bbefedd6fcc5256fcf1de33e68fa3bf994194d2c9162acb31a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496130, "uuid": "f29e43fa-dbf8-46c5-a16c-9ec5484d1721", "value": "T1ABC4F923DA602145D527043218A96B75183A7C35A00ABD5BFBC1FF092675AD3AEF633F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496130, "uuid": "36f5611a-cfb3-4b1f-97f0-0ffcf84c1e9f", "value": "6144:DMxZfkjCo+jo379WSJeIBJvUb1gKNTIii9czYV/zNA:DM/kGrjy3JD4NUi1YV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496130, "uuid": "0bb680e7-ea73-4ec7-aa0e-36997a0b6a20", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496130, "uuid": "e78ec31d-9894-4d87-9acf-47770e92ea02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496130, "uuid": "72abec80-b07e-43af-b6dc-887b4a71726c", "value": "SecuriteInfo.com.W32.Agent.CC.gen.Eldorado.3878.6911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025b68ce-d217-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680523178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523178, "uuid": "7bd8774a-5f04-4d6e-968d-fb16fcc45cb9", "comment": "Malware payload (Smoke Loader)", "value": "3b57ae6edadafc18bc17d565f176c60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523178, "uuid": "640c1ceb-7f19-48a0-9497-729331e02ca2", "comment": "Malware payload (Smoke Loader)", "value": "ceeafd79c72d8467978b71cee2599beb64a4f72ca422f03367d38043c4bbff91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523178, "uuid": "e1faa686-6412-404a-97ab-f00fd2d0c4d2", "comment": "Malware payload (Smoke Loader)", "value": "e58934f6c8f6e4ce65bde363ee1b95c20a20b00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523178, "uuid": "b7e30efe-735d-4516-8216-aa9a906397e2", "comment": "Malware payload (Smoke Loader)", "value": "dcc1bb8cfbcca8371a9cfa7555143fd9f942fbb1948948554a27af865f4d8b2affc45a143c22453589bcfa4c0954b370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523178, "uuid": "3ae57c56-e024-48ba-9cdd-930f9ae9f233", "value": "T1F2649E4257E1A830E6134B714F1EC3F4269EBC62AF257E9E2745BA3F0D341A2D226717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523178, "uuid": "781aabed-c2bf-4575-9322-e926fa782f5f", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523178, "uuid": "4ca287b9-9615-40e2-9b1f-c177b8d6676d", "value": "3072:3sk4NnDWQ4wyNTxkwWsWEt/LIc36RzES1vyP0CFlmqT6SPZtkjc86:8pRD/zy9/LARBs0CFl5Ztkjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523178, "uuid": "77137bc8-7757-4d76-b8b8-5e6126d71ed3", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523178, "uuid": "1d4cfa9b-9eb0-4fab-b093-7c97b9a35fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523178, "uuid": "c2a507c7-9162-4051-a29b-a14c90a90bd5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2aaac1-d27a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680565824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565824, "uuid": "2a595a00-78c3-419d-ace5-938835d25097", "comment": "Malware payload (RedLineStealer)", "value": "df9649300dd628007699a5c4bfae20c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565824, "uuid": "fe26e962-b09e-46b9-8e86-e73224d3b759", "comment": "Malware payload (RedLineStealer)", "value": "d049ebe05f964d72e0159d8974c11fb176dc61d91e531b1afc7081884ecafbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565824, "uuid": "a59f8416-cd4b-41b4-ae0f-13917646d3a9", "comment": "Malware payload (RedLineStealer)", "value": "c142ee44bc983bc249ebfcc2db8775948c058c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565824, "uuid": "8724218a-a0a4-4e07-9e11-1951229674cf", "comment": "Malware payload (RedLineStealer)", "value": "c5a2dbc9e28028b2619d2736685a7c3f0111f454398ea4a5dc2115f4a05b1947245b386732e7d9fabd33cdc93e3c2a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565824, "uuid": "12988313-11fc-444a-8181-2f445e5b1dce", "value": "T17094480E6A847073D4623D721A715711563B69200AF58D8B6FB82B2D8B337F39E3176E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565824, "uuid": "e28433a0-3571-4494-8145-8198d825af31", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565824, "uuid": "28a064ee-59e0-4d1f-9183-26a28e149906", "value": "6144:5TouKrWBEu3/Z2lpGDHU3ykJYdKD/3Y4x5blr1HDsNJLdSa:5ToPWBv/cpGrU3yhdKz3lJsNJ4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680565824, "uuid": "6995a5d4-45d0-4e0b-8373-d2529219b76c", "value": 422565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680565824, "uuid": "d2f392d2-9dbf-454e-93fd-84e58cce27bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565824, "uuid": "49a9cb56-8f6a-475a-a411-f19ce5e913ec", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe19496-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525617, "uuid": "61077c64-9efb-4e1f-8844-a57095e6cd74", "comment": "Malware payload (Gafgyt)", "value": "04f0ce5e604167b2833059ebf606d7f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525617, "uuid": "bb46fa64-1bc0-4c6b-93fd-47dd8402ce75", "comment": "Malware payload (Gafgyt)", "value": "d0d2ca0cd067218352efdf58e5269dfd6d1f99593a46671d85e1a974f4dc2a2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525617, "uuid": "3549d16b-aa24-48a3-99ca-5ac9ca3a8e41", "comment": "Malware payload (Gafgyt)", "value": "1f5307cdd669332c3fbd694e68dc336de3b3fbf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525617, "uuid": "06838a37-1b63-42f9-a5bb-b8bb79609bc1", "comment": "Malware payload (Gafgyt)", "value": "c42b47f46c894acc4c7131668b3187eb02bc6759fab2efcf305c849b071314327907adb2294074c34026c8b7c2b279dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525617, "uuid": "29d45568-69f3-426a-af7d-c44aa36252d0", "value": "T141D31905F460875BC2D217BAB64A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525617, "uuid": "024f3cf8-8e33-4f03-9217-07430d91e89d", "value": "3072:Sdf+fvEqa9FazYA7IboRhVe391CErktmCQA9FX9aH:ifWEqa9FaNhVe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525617, "uuid": "7a9bb738-0aac-424b-99d1-6ccddae38788", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525617, "uuid": "8ca806e0-75fc-4390-b871-db8aa17d8275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525617, "uuid": "0d5e15ed-8f88-47d3-8e94-1e68050ebffc", "value": "04f0ce5e604167b2833059ebf606d7f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bc8926-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680524989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524989, "uuid": "2b9fec9b-70b0-474d-a47b-aff59b95a3f2", "comment": "Malware payload", "value": "908e71bc84ee8e35b54f2fcc6abbe5a7", "object_relation": "md5", "Tag": [ { "name": "Purchase Order J0400T03Y23E", "colour": "#E3D4C8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524989, "uuid": "3e0c2e08-ab39-478e-9cf3-abb4567bd439", "comment": "Malware payload", "value": "d157aef192c72d86025c289e990b5a522acca01d294155ad68e5f03d496cec10", "object_relation": "sha256", "Tag": [ { "name": "Purchase Order J0400T03Y23E", "colour": "#E3D4C8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524989, "uuid": "0d66fbf4-f4bb-4d34-9ea3-50b0a8fb3869", "comment": "Malware payload", "value": "b50cf8490aa3c4523981619d69de876841666d5c", "object_relation": "sha1", "Tag": [ { "name": "Purchase Order J0400T03Y23E", "colour": "#E3D4C8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524989, "uuid": "d8a11bdc-04f9-4c60-92a8-b7b64f3da50e", "comment": "Malware payload", "value": "ebc0d4cf05c4bbb7c503599b39641adeeb55daf1ad233d8bc58a838562f72f5fdbef0a6623afe23c210c41b33da14a22", "object_relation": "sha3-384", "Tag": [ { "name": "Purchase Order J0400T03Y23E", "colour": "#E3D4C8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524989, "uuid": "4f7326b5-b8ab-4075-a111-b27d4c214233", "value": "T1E534DE137228CF57E048C7F4BFC38D9A6B1AAF05A95679EB3001778F6F34152589AA0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524989, "uuid": "4836be78-f0b3-4893-ade7-881c716a32da", "value": "6144:paFJkKXiDU7w5BpxH3diRba4WXJMrZL1yV:paFiKXKnHNiVZrZLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524989, "uuid": "43c17160-297a-4b00-9633-596a65eae9e8", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524989, "uuid": "8e1296af-0ca5-487c-b3cf-a10c7eccb3e3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524989, "uuid": "8717f76d-f934-4bce-b3e3-2e8267f38ac4", "value": "Purchase Order J0400T03Y23E", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312d7cd6-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524545, "uuid": "2c9a6e6d-dfc6-4e16-9450-64946f691d5e", "comment": "Malware payload (SnakeKeylogger)", "value": "1b5885adfade648440e841f23c616b56", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524545, "uuid": "9fc84457-72ff-4b66-b276-04da1384c62e", "comment": "Malware payload (SnakeKeylogger)", "value": "d1a3a5f08d4e2b628880dc9982113a3c502ac26d377b0e7aa527cae7fe67a2d5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524545, "uuid": "0faa7b65-ad0a-463a-9a95-16a915e6402f", "comment": "Malware payload (SnakeKeylogger)", "value": "f2a1ffb81e2a04859c8e7126c4bfc25c5f0054fb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524545, "uuid": "fd86bbfb-bde5-416e-8081-5ffcbcf21042", "comment": "Malware payload (SnakeKeylogger)", "value": "7d78fbe981d2a56e0b8e477a8d207883afc3e01891da4bed5f3534dbc2d5e803b4f3f2627dfc4a21f2a1cc60cd434076", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524545, "uuid": "73f04a53-0be4-48c7-bfcd-6b425929ff07", "value": "T18BE4120C7A68EB23CE6A0FF79053501D37BA6A2B5052E32D1CDA58DF9D63F14C65098B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524545, "uuid": "a9ce52d4-0162-4b65-ac14-1de2f9d5a2a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524545, "uuid": "0213c517-af54-405c-a213-d054e0c7c34e", "value": "12288:w5CBWKdq1FbwwJLwraSZqKESrSp5OBMG8B+8xa6NF2yYCOwT2D8Cc2/j7riF4E:TfrphqJRQBMG8fxa6XrZOw28n2/jPiFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524545, "uuid": "d1757860-9f57-4d44-8c6f-ec23597daf4a", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524545, "uuid": "2b01abd8-92b2-4f78-bf4b-f5121b6b2ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524545, "uuid": "80b5b108-2b10-40d0-a239-e8732e58805b", "value": "DHL-AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103e325b-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680525778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525778, "uuid": "e7a435ee-e7fa-480f-bd3f-af085ea8377f", "comment": "Malware payload (Formbook)", "value": "42eff0c99f1958d55601dd9a74cd8d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525778, "uuid": "58a4c742-4dff-4c96-86bb-4945fe6d01b6", "comment": "Malware payload (Formbook)", "value": "d346f44b099d0aa4226f6a6340e660e003d5293ee68c4d4fe38b301754c271fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525778, "uuid": "ede729f9-13ae-4be4-a4c3-e83b7ae8684a", "comment": "Malware payload (Formbook)", "value": "b84298118dc2bc1018c6e28d305bbbc05e290242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525778, "uuid": "fc6a2d48-9047-4acc-99d3-0ae2ee1db9c2", "comment": "Malware payload (Formbook)", "value": "e36b45c92c3c440eda1bbfc53865b86b2ad22f804599765f0e405765b3618b57b761b5e6bd6a91e9373f91c076331e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525778, "uuid": "75fe0e0d-4307-4b69-b698-630584b0bbf7", "value": "T1ED745C416FE88177E5EF1BB7747203008BB5F58AA18AE34E89DA14F90C73B045D19A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525778, "uuid": "2d66081e-d8e1-4441-985c-b0941dd785d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525778, "uuid": "c1ee490b-a673-4f2f-8817-10bde7ac8f37", "value": "6144:roOkslvBbpfrk74RHJ/Yy9aup7dfSNWIjBG6dkEr9N:4ibZkURHJwy9aAx6BGoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525778, "uuid": "1235f65d-990a-4ca0-b590-fd886c64e7a3", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525778, "uuid": "a12003d6-1656-473b-a922-b9b936ae4b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525778, "uuid": "a9f3c2d1-7315-4a38-b399-8525d1e61c7b", "value": "42eff0c99f1958d55601dd9a74cd8d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c150db-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496124, "uuid": "d608f910-a0cc-4a29-a938-1b9197b797ae", "comment": "Malware payload", "value": "3885d300ca8bc0cc1e91582e86c4a6ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496124, "uuid": "55f6440c-3ff5-4254-9870-d3d587306f56", "comment": "Malware payload", "value": "d3567aaddb031bb379905f9b1f904c182747213a135aa6b252a9fc4dec7bde5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496124, "uuid": "59fbe056-4813-4a50-a2ea-cc58e17e7415", "comment": "Malware payload", "value": "b7a96485243b9576515a7d1ff2ae4a8d79847795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496124, "uuid": "ee6f76fd-4507-451f-b5da-074ecd8a4dab", "comment": "Malware payload", "value": "482533e63ca221c5e68d952a149aa958192ab42f4170b8e67b67ab45f3d3b590e3c717f4fc957a5bf7a7026025b21f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496124, "uuid": "ba4127c6-891b-4b09-8a61-6d4c2acb7d28", "value": "T17FA4AE06B8E24874E8AAC0B03CDD9616BBEEDEB4812A7512CDD4D5CA75DD4F12E0B317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496124, "uuid": "c63882af-21f0-4443-a5c2-4ab8bdbe0f1e", "value": "12288:SDYWBABwzfGqWk22kfvnmTtDcBABlr8KjzH:SMUAuzfEH72Rjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496124, "uuid": "05e0d4a4-e056-4132-bcf4-f34fbce95684", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496124, "uuid": "629dfd00-a3e2-4057-88a9-757c9b175b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496124, "uuid": "1b73f546-89ac-4e0c-bb81-c1271b3ef502", "value": "SecuriteInfo.com.Win32.Evo-gen.21154.16159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168f0527-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496153, "uuid": "2067d69f-c25a-4a05-94ed-15d27da81733", "comment": "Malware payload", "value": "acdd6a215658cf603757f79a5f009aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496153, "uuid": "580b9b98-48a6-40aa-9629-f65717417321", "comment": "Malware payload", "value": "d556b9963a64dc0163d842ef4a190aa9f008d2288a2931124ba77633fa80a9f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496153, "uuid": "24db3847-3bfe-4ac4-bdb3-499145743b0d", "comment": "Malware payload", "value": "19b7d1a0fc433b2a1af1ad41116a2b896ded5b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496153, "uuid": "73a21f77-aac7-4199-a3de-8f2269c676f0", "comment": "Malware payload", "value": "8a2157927e10162754fe9f4b2b526689b074992d6f668b6de78f3a967f53bb393c066c26f13b5caf2a81cda8a4452a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496153, "uuid": "8c6678a6-3bbe-44ec-92cd-c2723096769e", "value": "T13BC32912BB2C2551D95A09331656ABB42A26BC292150DF17B346BD5C3DB0AC3BDFE30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496153, "uuid": "c4e84159-51a2-4cd6-b9af-4f952201e7cb", "value": "1536:kd9aeeo3hpXL74SWKMrd0ACGDMA+yP2VR+W/4FLg7PeAPOC9s4+aECwRgMdhbxaT:OA5+D4SWKMraACOMxyORor3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496153, "uuid": "f3e26b20-5ce6-4521-9e48-fc773de94721", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496153, "uuid": "a805acb3-5978-46e2-af46-f333d65eca11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496153, "uuid": "8c0295ef-0edf-47bc-a015-78fd06d329b5", "value": "SecuriteInfo.com.Win32.Evo-gen.2069.28702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d516553-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501319, "uuid": "c6e528e4-e055-41a7-9f63-b2db12195a32", "comment": "Malware payload (Formbook)", "value": "f22d31337659a931cc02f8b0000bbf8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501319, "uuid": "c0c6f5bb-e22e-4f14-80d5-4195e645362f", "comment": "Malware payload (Formbook)", "value": "d5fc5fba51a492858f45d0f86b010ac6ab2bc68be94fc2c8a776b7eaf3acaac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501319, "uuid": "b2ef04c9-64ea-4de1-8a83-707ade1d63e6", "comment": "Malware payload (Formbook)", "value": "22b98e378b0ecd97f518077b232d3e6ecd800f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501319, "uuid": "9e74e5a4-db5c-409e-9220-a43398e3118e", "comment": "Malware payload (Formbook)", "value": "e28d2f6b191395660f9d18a192e9f4b074637c8dbefe5fc92a8655304e0aa71362fd0692e2ebfc31aa1f28ebed6a1e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501319, "uuid": "e3d024d1-d4c1-4e32-8d0b-8c75feaa4db1", "value": "T145E41249362C592FCD9D85FEB1F1014A47BAC931762BC7E51CC8A8EE6EE3F444406A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501319, "uuid": "db2eeea5-ceb4-4ac9-a43a-00c787cff61e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501319, "uuid": "cc927f26-9ec8-40ab-a244-6aa35e9264e6", "value": "12288:Xv+tzLwrqWuJ5lv9cYtvlovOtgVAJ8TTM4eJJEh+RBsANL/vyhIoPOYFW:ZHG5lFteOyjXM4eJJEKNLXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501319, "uuid": "a51f2e97-1ac1-471c-a8e8-cd42c9ab1d18", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501319, "uuid": "05cabd9e-abd9-4c9e-af8b-249e439bf563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501319, "uuid": "a54786e5-d052-474b-9a55-19d43dcaed95", "value": "Project UAE_UNIVERSITY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec82709-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680512086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512086, "uuid": "a2f2e701-46c9-4982-90ec-a1c9b04134cf", "comment": "Malware payload (EternityStealer)", "value": "f3acc599e815e2d12bcbc3b81356ba97", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512086, "uuid": "0bffd257-4e9c-46d0-be55-a3cf33fe7c11", "comment": "Malware payload (EternityStealer)", "value": "d6674af0eeb02b8fd4723c1d79aef8e84541da7460b49ae7ad4f89d7d49c4000", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512086, "uuid": "e336033d-9d0a-439e-b131-5a001ac79f8d", "comment": "Malware payload (EternityStealer)", "value": "68680269abce563e57f7565d5b27a0f9b4b6f8bb", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512086, "uuid": "aba25d35-df06-4237-ba10-39d3020ebba1", "comment": "Malware payload (EternityStealer)", "value": "97b174e617cbf53533c939f986b7f4e63acd4c67d5a82b765a3ad31ec6c95d84baca808cafb623ee4cff02169d920cf0", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512086, "uuid": "439900d7-c0be-4721-8170-22c0942d7243", "value": "T17CF4F112F9C1A872D2E21C356A75AB107979BD201F788EDF77804559DA339C0A733BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512086, "uuid": "76a7a36f-84ac-4e81-98b3-d3eabc78c170", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512086, "uuid": "7bc706a5-28c5-4fec-b74c-532322876c2b", "value": "12288:AToPWBv/cpGrU3y4lzgJvDuzuY0moi5mRHXXSt3ZOmUwcopVKy:ATbBv5rUVzglsn0xvRg3ZO/ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512086, "uuid": "7e028ab9-bc67-467f-a444-2890bbfa2b39", "value": 724568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512086, "uuid": "b8c59bbf-ae45-49cb-bdab-271f8653fa99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512086, "uuid": "a96ee61f-5a09-47cd-946c-b75cae1d0696", "value": "f3acc599e815e2d12bcbc3b81356ba97.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e68d024-d220-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680527117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527117, "uuid": "368ad35c-ebf4-4b44-a209-9cc35acaf871", "comment": "Malware payload (AgentTesla)", "value": "5c1393c9b7e4283108f4fbb93d375271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527117, "uuid": "481c7ae4-2d6a-422a-8b11-36c79e929b83", "comment": "Malware payload (AgentTesla)", "value": "d6db2fcf47febfec45cffbe8bb6ff254974492e8785812478407e979dddd5902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527117, "uuid": "617cccda-ca1e-4786-bc72-b3fc1c014421", "comment": "Malware payload (AgentTesla)", "value": "9a435b7ebfbcd6603a6f15b18bd8c6c2a421eb1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527117, "uuid": "97785662-35c7-44fa-b82f-066bac75a3a5", "comment": "Malware payload (AgentTesla)", "value": "d1342d304cbd4a265eeb5e461feb27059405d4c9b4e0b41e8b91e1a6b0163997016535f26916c79395ef9025dda85af7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527117, "uuid": "f0897611-4f7f-4ce9-97bf-f3b524a4f7ff", "value": "T15104BE9C75A439DFCC67C8B1A9E81C28BF6070B7531B8293A01745E99B4DA97CF181F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527117, "uuid": "6a77abcc-f0d5-4116-987d-603e23025e41", "value": "3072:EBd1rYw6nDIy7LJV0wg/LrbYMsJ3wh21VaqeEeTjurIVG3ExjEV5bL2C0gAm6:EBvteISIwg/LrkbwhtqeTnWIVhxjc5b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527117, "uuid": "7ff1a515-ea40-42b0-a548-21652feb8d93", "value": 188648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527117, "uuid": "f44d13cc-30b8-4238-a879-5d8c1438022d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527117, "uuid": "2252524c-68c8-4831-99a7-46d1de78226c", "value": "SWIFTMT103-00391MBAP2308101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743427db-d25f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680554293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554293, "uuid": "35562081-578c-4b20-8fb2-259601e3862d", "comment": "Malware payload", "value": "5154c419d3d37dd4252e85ad32b8f8fd", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554293, "uuid": "a49cffd2-4035-473e-9b82-02f8d06480a6", "comment": "Malware payload", "value": "d6e6057aa34bd16c3a7a00300e40c4f6da47f65d6d4f000e20dd34e503860917", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554293, "uuid": "75f66009-e446-4c65-9b94-679753c9b59b", "comment": "Malware payload", "value": "8e87ef2610cbe78b35cf10e8deab74c3c8fd7ad5", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680554293, "uuid": "9b17d286-a6ec-4751-8dda-f226bbb0c6e4", "comment": "Malware payload", "value": "b2089f0a47220116ee2bbb17cd9c46ee844844f1e816c02a1fae35edfc22f9c2143152bb5f7a56f428eb08d34a257a6a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680554293, "uuid": "fdcbc8de-1c09-4f92-bc6b-8e0694b4a37a", "value": "T1535633D3A75ABB3C31E774139541FECA46E032850B81BA373E15ED846D9F981D9E0AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680554293, "uuid": "1f94528b-ed75-419f-9db0-3536e2932abe", "value": "98304:mG4gljtK2qdtcd4q9j5DP9jtxSH6dvLSrC9Gi3UGWg3nviGFilxO7uHZWWRsGPI5:SgAdtcd4mj5DoaBSG9v3xW8nKGgUuoWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680554293, "uuid": "18f0d755-6e51-446a-ace6-cf0462bc890c", "value": 6162290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680554293, "uuid": "bd6ccbe2-7cb8-4478-a982-f469a0f543c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680554293, "uuid": "01715bb3-5735-46c1-a8fd-003d38455f00", "value": "Main_2023-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9b23f2-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496160, "uuid": "20c8886d-f128-4e61-93b0-f99d50ebb0cf", "comment": "Malware payload", "value": "e29c3ae239492076ef44283340d3347e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496160, "uuid": "8da8f9e5-ed1a-4ab5-9ca7-0c22814c226a", "comment": "Malware payload", "value": "d768ed68b7ab17cab91917e825c23eef56805f6b00b62d647211ef0b30e90435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496160, "uuid": "22fe84cd-12c4-4aa7-9d85-b195558f9ef8", "comment": "Malware payload", "value": "c2e4372a7c5773ff22d54625060c96cb787d3af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496160, "uuid": "3c8882a5-42c4-4f42-bf00-b95d1d1abcac", "comment": "Malware payload", "value": "5b73b184664158c0a523ec5f1c7b2ce84232ea265c8b447991974ddc5b6e41af2f4593feaa64b69d026b0bf36c9276e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496160, "uuid": "eb80477d-a681-40dc-a4e3-e9189ca74824", "value": "T140F48E06B9F290EECB2556B1087A33365F368B840F15EFC3B254DD38AA729506D372B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496160, "uuid": "d9788aa8-6131-431d-bbb8-c05312ed13a5", "value": "12288:khsGQJp2pB8CXz7IUCCMtS2p3xTZuYVPdttc3TLCT+0:keGQJp4B8CXzMUCCMU2p3dZuYV1ttc30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496160, "uuid": "a4d49784-5897-4f42-84f1-e15ef88e303e", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496160, "uuid": "0492b37d-0253-4eee-ae7a-87408ff9e72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496160, "uuid": "62938773-61a6-4b23-8182-2c1462246c16", "value": "SecuriteInfo.com.W32.PossibleThreat.24305.23567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13546622-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680496148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496148, "uuid": "0c3d02de-38c2-4791-91dd-d62c1d5a8ce8", "comment": "Malware payload (Loki)", "value": "1026933eb6d82c8758f97f1e73d7d577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496148, "uuid": "8a55b38c-f703-4543-86f2-b89a4bd52d4e", "comment": "Malware payload (Loki)", "value": "d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496148, "uuid": "e6494ee1-9f59-4a44-93bd-436c852164f7", "comment": "Malware payload (Loki)", "value": "81cc021d60a0eccfb8311dbee719a0c7b53bf4ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496148, "uuid": "9e3d076f-374f-4c78-8058-2a074a70ee05", "comment": "Malware payload (Loki)", "value": "5307a66ee2d5f0ae85633fa0444f02168d0c63b143f0394c87f4eae043bebceaf39a8d7b2f15f244808869b38c9e5069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496148, "uuid": "142547d5-38c3-4bbb-bb6e-b3607f6677e6", "value": "T162C4128937699D2FCA7E45FED031358503B5942AAB27C3D91CC8A8BD39E3B508146EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496148, "uuid": "ee991a5b-b445-493c-b3b6-177bc0c43521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496148, "uuid": "267c3bb4-b964-4823-a36e-2ff8d3736fea", "value": "12288:jqitzLwrEPYmKeJMvvrxuoasanTV00vPH:2OWjxuoasc5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496148, "uuid": "9340b3cc-3d70-4845-9a29-c56967e52e72", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496148, "uuid": "0160a183-eb71-4558-b55b-e62b979c61bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496148, "uuid": "a33c3f69-91b9-40c7-9c20-ac721d86654c", "value": "SecuriteInfo.com.Win32.CrypterX-gen.7467.5591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d7b15e-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1680524476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524476, "uuid": "f76a2daa-e14d-41cf-a1c7-d0a6e092bde5", "comment": "Malware payload (RemcosRAT)", "value": "2e31de3e3a3572d4b88c45a2f8d61859", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524476, "uuid": "139feec7-3763-42ea-a5ff-f927a8bfb650", "comment": "Malware payload (RemcosRAT)", "value": "d878b96dad5b242df04a937598ce6a20027ff414f2498e7c606116843d1c74f0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524476, "uuid": "958d7a0f-98cb-48f9-855d-a2a84b848848", "comment": "Malware payload (RemcosRAT)", "value": "f4d916e26cfc4d9ad75b402555dca157a273e4fd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524476, "uuid": "8ea6c406-1ba2-4c87-96ac-d639983532cb", "comment": "Malware payload (RemcosRAT)", "value": "1e221b7821e77314dcfb2449790debcdc81ccdbd6cab812718549501820a484c65dab48aa1de5699ff3350a397882bd7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524476, "uuid": "e746b231-2516-4e12-a6ad-133ee8718858", "value": "T19425234676B6F557E53A53B08CA2DF98A33AFE503C30433B3729375D98F238166581A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524476, "uuid": "eb48109f-ecc1-49f8-814f-e607ce95b0cf", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524476, "uuid": "ed069f24-e5c2-409e-8de4-61fa9abf3e27", "value": "24576:4rIN0rH/eYI8gPZWVp+Q+BMQfwgIfxwwcfaA:Cwgfe98gxWT+Q+9lyxHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524476, "uuid": "0d56d4ad-b4ab-4181-8b46-8ba621cdde45", "value": 979368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524476, "uuid": "25af9cfe-143c-48de-96d9-598c30d96e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524476, "uuid": "f73056e1-a032-4d12-9b0f-3039f9b49312", "value": "[DHL] \uc218\uc785\uc2e0\uace0\uc218\ub9ac\ub0b4\uc5ed\uc11c(\uc218\ub9ac\uc804\ub0a9\ubd80).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db454b9-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680524539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524539, "uuid": "dc7569dc-0173-4544-b91c-5c98aa6484e4", "comment": "Malware payload (njrat)", "value": "865ff8cad7b20655ee94d62739cf57b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524539, "uuid": "2459cd02-7f32-452b-abeb-638a2767dcb4", "comment": "Malware payload (njrat)", "value": "d8fe63a4499e084306ef0f303f69f53bbbe9902962ac8c2722f16da521983b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524539, "uuid": "3a4322a1-5add-44f4-ac1a-cb20de1a161a", "comment": "Malware payload (njrat)", "value": "5d91a0d58d8d5e2d88dddf2c9c5f0499fe61ba11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524539, "uuid": "51dbe717-73a1-4cea-9631-c75a3cae771e", "comment": "Malware payload (njrat)", "value": "79102297ffe2c941d468847fc2591015286490636480197237d062446366ffb530a28c268ad675df8447ce42f5a96d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524539, "uuid": "0979ad3e-c948-4e9f-b45d-7dd9ee8e4b53", "value": "T10D533A4977958A54D2BD6E7804F26751C630F50B6D03EB2E08D170EAABB3FC40A46BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524539, "uuid": "39705af8-22ef-4b47-9573-13a3c00b5c6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524539, "uuid": "650fb43d-cf6d-4050-80f1-80a63226bb16", "value": "1536:prEqKHoN36t+QViobt8hpuyBnvbKfIteKbN38LbB9z3nSaF9bmSRv8:prEqKHoN36t+QViobGhBn2f6mt9zCaFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524539, "uuid": "07190cce-9b88-4585-944f-f7acbdbe0104", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524539, "uuid": "4c965575-edd4-4ae4-b0ce-32c981659d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524539, "uuid": "3fc43f7a-7ac4-418a-8d64-edc6b522e97f", "value": "Runtime Broker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0696b4aa-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526621, "uuid": "57261068-7332-42d9-9b06-584cb0db6bfd", "comment": "Malware payload (Gafgyt)", "value": "eff895049bab66537c019c3ef11877c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526621, "uuid": "896c50c0-a7ea-4ca6-b6e5-d8b32e20d9f8", "comment": "Malware payload (Gafgyt)", "value": "daa02c66a7984da82ae2e96c1d8925a2d4fc31ed0f19ef4a0817e43be745b6b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526621, "uuid": "1458e5c5-50b5-4fbb-bef7-7feeb508d01e", "comment": "Malware payload (Gafgyt)", "value": "345d228714171aa5e20299bed7d17d4f62c7f106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526621, "uuid": "deb0b964-5597-487d-904a-a9a9e79b346e", "comment": "Malware payload (Gafgyt)", "value": "6a4f8361cc154e81bdbb68736120e822162d50eb5138c1323314b7ef95f16bf316dc6b747170fe871796a6204ffa8fee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526621, "uuid": "d740e84d-23b0-43b7-8ff8-3f7fe214c61b", "value": "T177E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526621, "uuid": "608a877c-494e-41fa-a5d4-2fed1e47f291", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hv:vY01ZkXAQT4Ni9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526621, "uuid": "8bd6cb46-6d7f-4500-9e78-0322641f4dc4", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526621, "uuid": "22fd3bb5-531f-41ee-82d3-85f9adcd2fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526621, "uuid": "b6e4b4aa-a0e5-46a2-ac3c-5e88814494b1", "value": "eff895049bab66537c019c3ef11877c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627970dd-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545673, "uuid": "2e6f56a7-009e-491d-aee1-933f3b17aaa9", "comment": "Malware payload (Mirai)", "value": "4fb2e97bb705d3063fb8cf8b3076e261", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545673, "uuid": "f3b9043c-acb8-4968-87b6-c14534f94de8", "comment": "Malware payload (Mirai)", "value": "dab8e2f6422749a3f27c23e3e571ba9b62616784af29fc8876ceed37a44d65f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545673, "uuid": "a939afaa-5660-463f-8023-61fdf9d9a996", "comment": "Malware payload (Mirai)", "value": "1fac36641e31e3ad5140c815027581f267a8e75e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545673, "uuid": "7b0c2121-f0a6-4475-a313-62c05fdf2fd6", "comment": "Malware payload (Mirai)", "value": "b75f617576201acd60056b68a43bfd0ccf3d9d245bccdddef0ef1ae267d8da1d8037a42ac01171219d9ab7f6aa3392d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545673, "uuid": "a7a78793-e1b8-4f7d-bf33-c9634e76fd4e", "value": "T160730756B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545673, "uuid": "276bbff5-919f-4b64-93a7-00f72dd8a6b8", "value": "1536:2ln25xPBXk1wnnkL7+KE007ItRMqai90DIyiUNbsvHTGcV5GYIWQ:7xpXCMkM/+TaFNbsvHqcVERZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545673, "uuid": "1c8f3115-b1e2-4522-b37c-6dba5eea5e76", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545673, "uuid": "6e45eb9b-a3b3-479a-a7e5-696e1ec4d70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545673, "uuid": "bd714c82-fa37-4d5b-b93a-ea5cac7cfb9c", "value": "4fb2e97bb705d3063fb8cf8b3076e261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599ba506-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680533632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533632, "uuid": "ec07bf47-ee8a-4fcc-aeb3-7ae46c75c76f", "comment": "Malware payload (RedLineStealer)", "value": "802c007fdaebe54d833b0bd716b5a15c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533632, "uuid": "fe9af1fc-83c3-42bd-ba48-414531da5f0f", "comment": "Malware payload (RedLineStealer)", "value": "dac4ee0e20f9a6b60b23b0d56a3b707d4cccd7031c4a45092f4b1adf36066f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533632, "uuid": "9a08fa6a-3699-4314-8785-d2b33edff9d5", "comment": "Malware payload (RedLineStealer)", "value": "da0183c33f107c80242afc87a58e62191a3fee9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533632, "uuid": "f270afa9-5736-4600-8cdb-eb645e273217", "comment": "Malware payload (RedLineStealer)", "value": "5bce51c8d9458c24cf5ff66658f5ba6f72602975044f5e7c149a0d4651dfd7ae55d5023b6e01a48b685ebdfe7369d208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533632, "uuid": "02fd184f-c98a-4d62-a96e-5b22830d043d", "value": "T14435598C7B809033D22F033F5FA49AA1153A7D110726497B67B7CB7E8BB82638635665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533632, "uuid": "9f20d21e-d098-4d89-8035-38a9348878d8", "value": "6006a64dc74ce041b99c2ab005455ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533632, "uuid": "30e5d784-f7e0-41ae-b5ab-bfdc96681da4", "value": "6144:2sLIku3qu5NlAOyvjdFaoY/m7WPDHS1GNiq:2sLczl8Da2MNiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533632, "uuid": "211c46ec-3d51-4667-92a8-b7f6a20b5560", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533632, "uuid": "0086d0cf-dcb0-48af-8392-0e34db6b81a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533632, "uuid": "7bda0a8c-3bc6-4ed8-8dd3-7ab908a74889", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27388037-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532259, "uuid": "9c09dcdd-27e9-4337-a859-a722f984d936", "comment": "Malware payload", "value": "3d753d95c80aa54cdfaaf4e24a6193f0", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532259, "uuid": "175e5d5b-cd7c-4d38-9259-f8f0a122b719", "comment": "Malware payload", "value": "dafa3aa86eadf472a53054a0079842676bd0956a5f0ca71018cd32dacf037403", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532259, "uuid": "e7f8e7a4-4205-4797-a744-9995ee5f1c4d", "comment": "Malware payload", "value": "9cfef2ea23f1a3c2c2ee6f4f98969ef1d16b731d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532259, "uuid": "86697b10-3558-4952-ae6c-0f82b5e469f5", "comment": "Malware payload", "value": "11a31f74a38b8f873d86b5c32e4e848d4b4a68a1a7e5fece2606997b34c721c65c560a749bd247a7033005a6896e0248", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532259, "uuid": "093cef19-8de6-4584-b9a7-d12c1850bb39", "value": "T1EB45BF508B9ACE1ED78DB2FDD0E909ED96B4D5519BC3E30A0881E9B23F1A39495131F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532259, "uuid": "bcc4b356-862c-441a-a127-dfdff939ecf9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532259, "uuid": "e60a6649-18cc-4d33-99e6-6da4090003b7", "value": "12288:SIwBaYLSZACAzg6gZV5cZ0x9kpyiL1PFXBLrXTZBbwkFruO1n4oKVtIIU88WVAbe:SVhL1Cbn5Q/pBLrX9eZfVt77LKVFV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532259, "uuid": "769c01b8-760d-4058-a072-5486b893f7cd", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532259, "uuid": "3ac3873d-9bac-45e4-b901-2c00e9c2e05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532259, "uuid": "65321840-38ec-4294-b4dd-7dd01fc30bb5", "value": "5ab7dbc6f34c70c742bc90ca221f9777e322770b54fbeedd3a9fa661ea358932.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b955c290-d1ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680505017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505017, "uuid": "ed82368d-9820-4ea8-9301-5ba66f5a15a0", "comment": "Malware payload (AgentTesla)", "value": "2cb87ffa452f6e2bb5949b39e243bad7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505017, "uuid": "cbcd31fd-ef09-4c79-a090-df5b4ca2701a", "comment": "Malware payload (AgentTesla)", "value": "db1081c1a75421b9b57add6984d4bc694fb160aa80a1657a43acb3810dc20a81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505017, "uuid": "326f9ad7-decc-42df-8f3d-c68bdbee7c86", "comment": "Malware payload (AgentTesla)", "value": "df0437f5ecf3da72a5c2509d51af086ced1f1bcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680505017, "uuid": "2a0e4892-2589-4358-895e-1fd110167f14", "comment": "Malware payload (AgentTesla)", "value": "ea686046948fa4d34913193bd97dd14e7970e2fd10c53dc1f1d8e9f908ba4fc6da93f60af832fbde2f9d2392cb33130f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505017, "uuid": "ea8b2365-e57a-44eb-bbef-cee8a231c278", "value": "T1DC942308EDF2E4F9586F9BA43E5C18282BB0FAE4E1B1EB118179D017E1C0DEB59C505B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505017, "uuid": "5bf3f250-818c-493d-8621-b3ddea9bcb85", "value": "12288:+Dmne+9VXCcetsvin49N5WmshLUV4GWMiXu9e+:ne+9VX/an8WmqL2iXuU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680505017, "uuid": "f350b1a9-828d-4a03-99df-15a11947d6fd", "value": 420084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680505017, "uuid": "c5f41f3b-6c63-475b-82e1-0bc757c94841", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680505017, "uuid": "2264f126-08cd-49cc-a8ef-fd2a02ae5c0b", "value": "payment.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7f5b38-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680533612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533612, "uuid": "0eca6ec8-0fcd-4b8d-9649-4c433d6503be", "comment": "Malware payload (Formbook)", "value": "8b817b79a103307dcd00a353e6bc13ac", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533612, "uuid": "87e7b729-dc77-4314-a587-9ed1c24f9ba5", "comment": "Malware payload (Formbook)", "value": "db1bb8073aee3e305bb82057150fc2ffba8b4a9e744b9635a75625618935b6fd", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533612, "uuid": "6b430cf0-c1de-4b95-8af1-50631ef1d3db", "comment": "Malware payload (Formbook)", "value": "4c1af9aa20635ee3bbe623f4f6848fe2672cea4b", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533612, "uuid": "1653d068-acaa-4338-893d-26dff343059a", "comment": "Malware payload (Formbook)", "value": "48a6dd9e2c5bdd266809d9aaf78a001b25f4d4c6f0db52e6139ecacbbf454007489469388c0ebd5564af4cf6be8168ca", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533612, "uuid": "3ca3fd5e-130b-41f1-a0dd-4762ea1fe5a6", "value": "T18645383439FA501AB173EFAA8BE479EADA6FB7733B07645D105003860723A81DDD153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533612, "uuid": "83f89017-f54b-40d4-ad5d-d84142bd319c", "value": "12288:vRqBDDAGkC0fP1QG7rVtzRHmApSBvSdK+OyxesV07YkWd56Q5XhnQLyhkwL0jiCP:0Pe/r1p3O2nvhLOiCMIWobWdwxl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533612, "uuid": "b8841076-74ed-467a-a908-6fd4d82bd6e7", "value": 1252352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533612, "uuid": "43f68921-674c-4df8-ac04-5583d441b22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533612, "uuid": "6e1e13b1-44ca-4234-ae85-548bf0820350", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af7edff-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532265, "uuid": "b14abc20-bb78-494a-98be-1f0dd091913b", "comment": "Malware payload", "value": "ba237c7fdc6c1837edc25a657dfe34c7", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532265, "uuid": "e8b37bed-43f8-43d7-8d21-3a1e063dfc87", "comment": "Malware payload", "value": "db265130a879347a816e50fb25212b17c7fbd6c6c82b3544c6e158a0c4dd9ed9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532265, "uuid": "2de8e3bc-1571-43a5-baea-c3d9d2457872", "comment": "Malware payload", "value": "421ea41a78e7b4601089dff06da3068667f80448", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532265, "uuid": "774e69ad-6592-4bfd-a165-7ceab9339c08", "comment": "Malware payload", "value": "bc97fccc05066c6d40baef2d130eb3346d3ac562229700d88e105b5eb09eb8587db7228fbda32411a9f014d2c23dbab1", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532265, "uuid": "f568b0d3-6da9-4adc-9589-cc3edebb62b7", "value": "T16D45BF744B9CCD5EEF9E4379F1A505B8AAB4D655DF83E30B088129A23F5F384A9006D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532265, "uuid": "a2589bae-d162-499d-a23f-e9e64ab95681", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532265, "uuid": "0260f3ff-f0a0-482b-9a4a-5231f624f11e", "value": "24576:tLmeQNuKDCeN6W4vC3Px8PHJ3EcBwIuJT9JFlgu3:tLmeQN1eeN6W4q3Px8qT9HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532265, "uuid": "a3375d44-531b-47ed-b842-ba2f86718d05", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532265, "uuid": "e978bb71-46bb-46c8-81eb-27c9ce7814bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532265, "uuid": "786e90ec-02a1-47d7-8b63-2a2b57f77b89", "value": "888cc56174b351d2cc60464648dfdf0f166069308ff9e880d63ba976613c44e8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a67842-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680532330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532330, "uuid": "d3aa0652-960c-4d6d-b44f-7dea5eed57eb", "comment": "Malware payload (GuLoader)", "value": "1cfbf2ea376d44938ee48af7cdfd4cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532330, "uuid": "f41a165e-611b-4b44-817a-006746e51cf6", "comment": "Malware payload (GuLoader)", "value": "db423f90dcdd288aaf1fb8bc898dab496765d8b56abe145b9bbeff9e26a4e695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532330, "uuid": "b407c326-f1c6-412f-91e6-20abe6cab1aa", "comment": "Malware payload (GuLoader)", "value": "7a6fec390ca53e873cf5eea31531e7e58da9d378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532330, "uuid": "2116cb60-787b-44a2-82e6-24892da985b6", "comment": "Malware payload (GuLoader)", "value": "0f6c11c424e05c1d40c24db5b9582e61326c5d7a793b2062dc574a0636c7a236b007bedfad5974bfd07923ad3bc87419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532330, "uuid": "ba06da79-de89-473f-ad61-59ecd019943e", "value": "T157E30200A5E5C417E5D78B721E76AFA1E3F6B9640428160F2F311FBA25307C6C70ABA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532330, "uuid": "bdda5296-5110-4a09-8c37-a3d85df37df7", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532330, "uuid": "e92d6b47-1fad-40f7-bf39-e3bfd85d00ea", "value": "3072:GqTUdySBaLvYzIf/M7o93auj/L1v59TZ9CoeggzozywON3zYPYADQDDWrX:Gkyacbo/BD7ClBz5wezYPKDWrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532330, "uuid": "db3a61bb-5922-4eea-aca0-dad9849b8f59", "value": 145872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532330, "uuid": "11478bec-09bc-4b22-af3c-67528b7b183a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532330, "uuid": "d4168af8-0c86-49b5-9fc4-47278dc4193f", "value": "Nonsympathetic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad426a11-d1f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680506714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506714, "uuid": "1fedb2ac-ac4e-4949-b9c6-b070ce02ef4f", "comment": "Malware payload (RedLineStealer)", "value": "068346733f1a01c6e57611561d4a6ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506714, "uuid": "54da5f3b-11df-4d34-8660-fbc06928e810", "comment": "Malware payload (RedLineStealer)", "value": "dc26efe190a125e5d690897c5635783dc3b1bf12cf642d78831bd08b69ce7473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506714, "uuid": "16cd55b1-9c72-4889-ad7e-075c3f3fcb93", "comment": "Malware payload (RedLineStealer)", "value": "f135e7f85aeb9d73b71db54733ac77e5d09a706a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680506714, "uuid": "fa4b2136-2f57-4243-b83f-a998143d8267", "comment": "Malware payload (RedLineStealer)", "value": "419f75d428b34477a1ad984fa9c78217f15906072b692658f501201e97f412d93219105c07b0c80a8f8517a009c8384d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506714, "uuid": "e6fb1e8e-e55a-4089-a541-0cd3bfcf56a3", "value": "T19F74F1223B9AC072D62B44794912CAB45B7FB8B04B6286C727C457BD4F35FE19A37342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506714, "uuid": "f5773b54-6f8e-4e01-897c-a154924ffabb", "value": "248089891092684f7229c494995977e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506714, "uuid": "7f42710d-a53d-4bed-8aeb-fe5d6d0bcd77", "value": "6144:HgszL0OAc2X0kdxzhTg39bOTeVX6mpgHwvz+o4U2BF:pzhAc2ZdHTg35MeyHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680506714, "uuid": "12a299e3-eda1-4af4-bb9d-f44d86f1f7dd", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680506714, "uuid": "03674cd2-56ef-47ff-a323-102e7e67b99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680506714, "uuid": "b64dd6db-2d20-4449-96cf-9ccacea6c0d8", "value": "068346733f1a01c6e57611561d4a6ccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15eb53c4-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496152, "uuid": "e6383031-7c85-46be-8e68-1e2ab3e0a777", "comment": "Malware payload", "value": "7b0e2364b678380beb1b54728e76b971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496152, "uuid": "e5ffb9b3-b333-4d5a-a5f1-ef5959086118", "comment": "Malware payload", "value": "dcc960a3678e41c1e29baf64340f33e4a81568e2fdb0b16b2585a1a4054aadee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496152, "uuid": "2ff75f8c-2be3-480b-a328-fdf70a412c30", "comment": "Malware payload", "value": "fc5be70e789fc9bc7410790293dc371882d86d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496152, "uuid": "5048600e-bf84-4489-a3f6-60cada9c3997", "comment": "Malware payload", "value": "76b1b3d013ebca238646416c4ae0f9e0dd59be0bbb67d4f56b3d3841595338f40c2c688825f5bc40db0a6846019e3a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496152, "uuid": "1e3af436-81cc-4b78-a02c-671c16d2ecf2", "value": "T16215AE45F6E180F2DB893630096B77319A76ED2B4B358FC34569ED285F32270AE37225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496152, "uuid": "8aefeb9c-6fa8-4691-b351-5093413d8dbc", "value": "6144:mWB+8tXyZ5ulWKMxdTTrUy4k6JXEEtCWL9Y3JxnxXJ0lXDBnH4RN8CcAxNg376q:mWBZvOdTTrvMVMxjnxXmxBHn6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496152, "uuid": "4200911a-e8a9-47e5-9617-473831be071e", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496152, "uuid": "8775742d-f077-4fde-a9bc-de6ef45a7856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496152, "uuid": "94766a16-bcc5-42a3-9bd5-350742fab49e", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1341547.20462.19116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fd4150-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680519728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519728, "uuid": "b34cb676-6026-44a8-9098-9319862aacee", "comment": "Malware payload", "value": "5cd1eeaabae27945d45c9c7cd639335e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519728, "uuid": "58b3ebc6-abc0-4590-841d-08651904ce26", "comment": "Malware payload", "value": "deb398aa4b335f7c0c6f3a7a63ce46f60c21ada112a2ab76995f277ff1f97d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519728, "uuid": "c19e4e73-a88d-48a5-8b25-71ec5c8ada61", "comment": "Malware payload", "value": "beda9228860c97150689b6f60a27dff45d75e78d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519728, "uuid": "b3106347-5d1f-4e75-a351-27162ed14605", "comment": "Malware payload", "value": "59ec190601dc7258a3cf4f5a09bfc1954bf76c420f815a18de9e50c6fd886c684a4ced8b52f75ad5a2b7a5b334068e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519728, "uuid": "281169e7-aa22-4fc6-ae4e-a657c7e77d7e", "value": "T1E562F9489BD9063AE9FE873889B3174016B0F2419A33CF9E49EC511E6F732549A12F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519728, "uuid": "684fdf83-793a-47dc-a917-488834de4e49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519728, "uuid": "b7ade86b-1652-492b-9eb4-13fbb9efeaaa", "value": "192:zkZYDavZtSVNUxM58ga/0gzHweaUyoxcsnWp5Prgo+G753F5:zkZWahtQUZjMKHweafoxnWp5Mo57RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519728, "uuid": "dd95709d-cfa3-499a-85f2-517e0f67be25", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519728, "uuid": "2eabb136-4e92-4c7e-947a-38e9dc929491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519728, "uuid": "6a34c162-13c6-4643-91ea-ddcda49d6446", "value": "deb398aa4b335f7c0c6f3a7a63ce46f60c21ada112a2ab76995f277ff1f97d3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7d8ed0-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680522309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522309, "uuid": "e50629f0-fa42-4799-8cf8-a1ebfbf6e555", "comment": "Malware payload (Smoke Loader)", "value": "9244db891279562566965915ebd11a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522309, "uuid": "09e4c8ca-02da-4c27-b871-873417b405ab", "comment": "Malware payload (Smoke Loader)", "value": "dee582a9de9d3898828df531fbaf1ee6d67bee111d5087241716d7af02777777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522309, "uuid": "a92f7815-717d-490d-858f-54ffe768f1a9", "comment": "Malware payload (Smoke Loader)", "value": "86130d046c231c779659784df7729f5e58f72823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522309, "uuid": "ee6ae699-9ff6-4522-823f-997f9e6b934e", "comment": "Malware payload (Smoke Loader)", "value": "a145794d3eb7636a6c162da94a19f2ba1fa063daf32e40ef5403b9dacdf08f38dffe06d8a43e88d5ca6302f7a40caaaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522309, "uuid": "7e31d4e3-f20e-4042-ae7c-b79f8ff10303", "value": "T1F614D0207AB1C072E41785785879C6B066FFF8B19BA1C9CB334857BE0E313D25A7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522309, "uuid": "350592fa-af63-4ae8-8bb3-91b9f80e4458", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522309, "uuid": "4e9c54ef-b477-47b0-84a5-88ff1037f2bc", "value": "3072:xNjB5FlKiysVUIb+tHguq4hOuyEE0XT0SS5/uw:L5lnjJ6g8y3Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522309, "uuid": "fd240b81-1ec9-4c16-a427-7efa7f6b875c", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522309, "uuid": "f0009895-7977-44bb-a9db-ba3b2f0993df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522309, "uuid": "744931cc-d5f6-487c-af74-7c81f881c5e9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30da1abc-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532275, "uuid": "084bfc73-c19e-4d64-93ce-25311476c177", "comment": "Malware payload", "value": "9add6a26afe679ed370260b9cbb63f33", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532275, "uuid": "0971a428-3871-44c3-bcfe-aee3718eeb7d", "comment": "Malware payload", "value": "def6507d9726538b2d65b266de522537389c6f30bbd4437877299b69de3e9b35", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532275, "uuid": "31bd8af5-061e-4ea0-89d5-7c5deb3ebcf5", "comment": "Malware payload", "value": "18c03a83b976b90da1687409cecf5cf7a3de3d85", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532275, "uuid": "61cea938-d3b8-4f3d-b0a7-abe8915e3f53", "comment": "Malware payload", "value": "24ac915bab06caf4f7518f654b7fae8b6dc5cb87131f435251193e084d2cf43d4370bc560d2385ca65ad11481535bd89", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532275, "uuid": "2e05f3d9-2973-49d1-8a66-8053b149a709", "value": "T11B45D0040BABCD3EE7BD0B7994D9048A9AB5C415E7C7F34B04C029A63FC6B99EB51193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532275, "uuid": "d4da7974-1164-448d-92a1-a1ea9b8b7eb5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532275, "uuid": "ba0b3003-febe-4785-841e-7c939851a4b3", "value": "24576:tYC1+8aaZcxqfJUS3WzGRLDyFuP12lTU0NuEpREjmvmSMV:v+Hq3OY8GAxvmNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532275, "uuid": "092b507e-ff11-4cc7-aabd-ab227e8c2920", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532275, "uuid": "b19fb7b2-36a6-4e9e-a5df-1430aa2d50d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532275, "uuid": "8a99dbb0-afc1-4351-afd3-6fef2eaee351", "value": "dbb1bb059a110a938bd8e2a6658c39fbe912910e6cb400cbfd66756041c25958.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca20923-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525611, "uuid": "4b6a2e6f-f776-460f-8aca-4c8f358bea69", "comment": "Malware payload (Gafgyt)", "value": "c71ad54ce96c433e02a852b648fb5543", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525611, "uuid": "35608315-bc61-4f42-bef8-d2bd744d1b93", "comment": "Malware payload (Gafgyt)", "value": "df02d3aa5e340e042838b06002deaa72be0bac2c3f12279995c8c5046875c398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525611, "uuid": "4ebf49fb-5ec6-4020-904f-390544e941c8", "comment": "Malware payload (Gafgyt)", "value": "77262137b6b69364867f32faecf3a03965296fe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525611, "uuid": "1a14b8c4-64a4-4389-809e-3c4f07fcbe2a", "comment": "Malware payload (Gafgyt)", "value": "0fb2aee000204a9901bc84f7be9144a7f716c29195dfd20adf4d9ef409c547d952a27b69cf85475512308e037047420b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525611, "uuid": "82cc419e-179b-4bc7-b742-702c50e94143", "value": "T1DBB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525611, "uuid": "095dccf0-130d-4fd0-a7e1-440c94603e66", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCtB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mj+0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525611, "uuid": "78f12c06-8be3-443d-bb10-1c8544c936ad", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525611, "uuid": "b19ddf13-efc2-424a-a152-6e2f5540434e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525611, "uuid": "005927fd-89de-477a-9b12-bcbe5204c947", "value": "c71ad54ce96c433e02a852b648fb5543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdbd5e4-d1e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680502526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502526, "uuid": "36abd970-3564-4a1e-8859-bd0c72394f26", "comment": "Malware payload (Mirai)", "value": "a48806558facd5eb0e65520319fb0cfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502526, "uuid": "3d4b9749-1295-4cee-83e6-af788507e4af", "comment": "Malware payload (Mirai)", "value": "df0be068d9be2e576d506864e0fc91bc76a09f1c6c9c3dd93794c5d521ecd2bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502526, "uuid": "5d8ed991-7746-4d20-b116-189f89358e66", "comment": "Malware payload (Mirai)", "value": "f515154d9f128bd314a713944881a0f6527e36b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680502526, "uuid": "f7e499e7-4cea-4ea9-8f4e-9280cc932b8f", "comment": "Malware payload (Mirai)", "value": "c59b5d946c8fb378956bf244e22abe5a64e2341cf55e15a0b3187dd4d4a2bb7d57678e3f708722904ecf1d68d2c95440", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502526, "uuid": "bfcd0b8a-21e1-48c2-b0f0-f6864a58a157", "value": "T13403F751BC829A37C2E1137AB66E4A8D336167E8D2CF7217DD204B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502526, "uuid": "7398d66b-23ca-448d-9069-b8cc8a45acc0", "value": "768:kg4QCbvsG5f0OlnlUlQOBFdApwAUb9z/W56v+b8O7LDUXoTB/NwwW:kRbEG5fXlUlbH4aScv+/U2LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680502526, "uuid": "1473b4ce-c7b3-44a2-8332-5ed572ac9ec3", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680502526, "uuid": "8a7bd648-2fc7-463d-af09-5572ba9f1b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680502526, "uuid": "9c3580b2-0cb0-4fc2-8e20-84fbff7fba54", "value": "a48806558facd5eb0e65520319fb0cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4a1529-d21e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680526386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526386, "uuid": "1a050b6e-f578-4add-94ef-5b01cb97dadd", "comment": "Malware payload (Vidar)", "value": "c35b6e853ee8377fce6e0aaa5817c3da", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526386, "uuid": "44ce2fc1-803d-4fae-9f66-8f6ab74ce728", "comment": "Malware payload (Vidar)", "value": "e0e9debc2721a57093247e61e4ad4dd530eb2d02c889b57b5dca81fa5b859c2f", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526386, "uuid": "b5907c0c-027d-4734-9675-71c00ecf5a7c", "comment": "Malware payload (Vidar)", "value": "e770b9c158321afe45bd3544c5100f3df991636a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526386, "uuid": "9139ad98-1eb9-4134-8781-ac22f7ffcf70", "comment": "Malware payload (Vidar)", "value": "c06d1c18aff73be802d03a1661c2f7a6987c4105de2d2549b49ad42083e310e96ae5d0ece97092ceee34652a156f79d2", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526386, "uuid": "b539091c-d36e-4618-bff0-f5c44caa8afa", "value": "T16766331CA4AF9CF76E30413C60EA7162EC98385CC99C79FAB94530D3982834EF1759AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526386, "uuid": "c4946387-9891-49e7-ae10-5a581944b32f", "value": "98304:6PWGKuM1hl7wO51fxolOP/vvzjtYr0lWUo0UzOxLqHinREj05m+fAtjN5ZZ3o7J2:kTul7j/tYkWUaOxLxx2NPNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526386, "uuid": "b942a107-790d-434f-a7c4-58a51b689eb9", "value": 7111070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526386, "uuid": "08d7ec70-ef9f-4473-8a5e-c12aebd75d58", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526386, "uuid": "1730cf4d-83c3-4767-bfb6-2a36a94cb392", "value": "LoaderCrack 3.7.1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff5294a-d270-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680561614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680561614, "uuid": "04996106-2331-485d-b47c-76b2bfe2f458", "comment": "Malware payload", "value": "d146c2f70cb0ddda09e69e694584dc39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680561614, "uuid": "dece4109-cfae-4e38-bbfc-5efa1039f785", "comment": "Malware payload", "value": "e24198e5fa5b7ce59ac3a5b8e65e974d5278f4fa2aa44536dc72b5e8e923700e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680561614, "uuid": "83c02a80-29a2-494e-8bb8-3c3dee33afc1", "comment": "Malware payload", "value": "98be6cb049411f04e2e003695daaae113eaeac3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680561614, "uuid": "8666159b-2826-467e-bb25-ed13e2f359d6", "comment": "Malware payload", "value": "39dc734986bbc92ace1076c2a766b961b7a94d43113f9fb4399c88a58d42b8caae348da872c449fb8f4e3b80f49070e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680561614, "uuid": "cccb3661-8e4a-439f-b5a7-d8e3ac7d37cc", "value": "T12264BE3899C6CCB0F05C617A84BBD67E75227F4487628ABEFA55423CF53A20365C6327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680561614, "uuid": "3aeb6641-02af-431b-8032-43ff355648d5", "value": "dc2ea2209c2f5ee72209580a83f372c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680561614, "uuid": "c9a3fd70-83d3-4e81-b882-b7b5ecfe6e51", "value": "6144:1rS/7G2eB6D9vrWmwkAu8SOZEhVcMElgmITVynzWiw:1O62eBaDi0OZEhVPVCii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680561614, "uuid": "c840b25d-3b23-4eed-be85-7be5e5d5274e", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680561614, "uuid": "3dc2e710-5b16-49e1-b121-58baf75ba391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680561614, "uuid": "7137a62b-6ce7-49b4-9837-1cb8801189c8", "value": "e24198e5fa5b7ce59ac3a5b8e65e974d5278f4fa2aa44536dc72b5e8e923700e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83f2a6d-d258-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680551400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551400, "uuid": "56c69d0d-66cd-462e-955b-b10cbf83b853", "comment": "Malware payload", "value": "a5103b93e58f2e0ec580d287a2dd1296", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551400, "uuid": "6c650f0b-1e6c-4418-aa32-8e0e2e5e9559", "comment": "Malware payload", "value": "e3361c3ce034078210be01c26d17bb402f0dab3d757b3213697130e59c38f66d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551400, "uuid": "bc391969-da28-43ed-bcb4-287ab32d3321", "comment": "Malware payload", "value": "ef57fef10db2ce5e3c01d229605f1bc598f9443a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551400, "uuid": "ff48cf44-0148-45c8-8db1-ebab24333171", "comment": "Malware payload", "value": "4a8e97c19f1be84c901299c4fbeafb83759bf1b6b340541a2138f25cf12a55dad88291c3f70d232a03f515716adaad42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551400, "uuid": "40df171a-8d09-48da-be9d-704a483a8479", "value": "T190D31921E4508757C2D2177AA6DE825D3F321BE6D3DB33215A34AFF42BC1B891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551400, "uuid": "7e875098-88ea-4d45-911a-fff3de2b82e4", "value": "3072:kqIrn/ErhTaC/DFUPDFf8DIX+mTQOYkNX3Mn:kqIrsdTa6UPDFEUX+mTQOYkR3Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551400, "uuid": "4ef9e37f-376a-4ef5-92d2-64db0ab14635", "value": 131897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551400, "uuid": "e0c40882-fe03-40d6-ae26-cd5c2baf14e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551400, "uuid": "c223b634-a528-4dab-a875-ba11e6146e51", "value": "a5103b93e58f2e0ec580d287a2dd1296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ca518f-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Zyklon)", "timestamp": 1680533617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533617, "uuid": "32d3425b-5d40-4025-969f-08a04d183480", "comment": "Malware payload (Zyklon)", "value": "0fc5e679a966381cc05917e6046da9f4", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533617, "uuid": "f68a8903-1302-492e-9c55-0db774be2576", "comment": "Malware payload (Zyklon)", "value": "e387c71dab11c5648f482091bf4f6ddcc5da4e1f1235e311dac1f8fa818442c2", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533617, "uuid": "060eeac0-6cf7-4480-ac12-ec2f2b98a725", "comment": "Malware payload (Zyklon)", "value": "8f9f53955e5732e955e8f5ff600ec519df94c161", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533617, "uuid": "4250b36e-425c-4124-ac06-574cc26c5fbf", "comment": "Malware payload (Zyklon)", "value": "ae8d449ff619c775922a9b2ab0696985bda5f6dbfd6354c4a7890e1c585b701738168d172bea5b79df6a0fede9b6a5b4", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533617, "uuid": "09178319-27e7-432e-9dc8-629e0527b849", "value": "T1CA646D9AA7AA46D0E95C4CB074DB8135071B3C32769C9AE1DC0B37D313F6368609ADE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533617, "uuid": "1c07060b-46d6-4835-af74-b8093a750704", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533617, "uuid": "18ccf0d7-4fbe-4700-abe9-de4e3e4218b7", "value": "6144:EPP55vvFpmmMMmmw3LLllLLZqRjee7vYYo2U4YRNNbKL4pTYdkhVoi4Fc+dVkR52:EPP55vvFpmmMMmmw3LLllLLZqRjdvYYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533617, "uuid": "dbf9d608-445c-4dec-ad94-9fdf557faa66", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533617, "uuid": "5f1c1e1b-6f7e-436e-b83c-e8d3d079eccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533617, "uuid": "d5a68ea9-cf27-4208-9277-e815c8cc38f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df78ece8-d211-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680520972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520972, "uuid": "dcccb47c-62bf-4d5b-8dc0-2223d1b8760d", "comment": "Malware payload (SnakeKeylogger)", "value": "277e551e49b2a3b625d9a4c0fba8731f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520972, "uuid": "ad0cba55-c212-47b4-bdf4-9a8d1c4a56bc", "comment": "Malware payload (SnakeKeylogger)", "value": "e3a5385e27f2df0e928bc406d0884174fb072605e5cd79b456632a3ea3dc4129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520972, "uuid": "04297751-4086-4e67-880b-85564d71d447", "comment": "Malware payload (SnakeKeylogger)", "value": "ab65d6efb7d313a3bf3908566cedff8cab6eacb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680520972, "uuid": "51c3ce68-a685-4792-8748-aec024bc4391", "comment": "Malware payload (SnakeKeylogger)", "value": "0abcee6f933fa146effb818601eb83bc0d969bfd0d85d048a99be23489dd5bc53fefd8ffbe156be6f69b180afe4b78bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520972, "uuid": "7bca437c-ce05-4259-b63e-a4fdc0cc01cd", "value": "T1D43412233BA1C0F7D7360A706AB96EB69FF5D56119D8978B3F504A993952BC08E07303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520972, "uuid": "ddccd6df-e40c-4777-b822-2ec877853145", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520972, "uuid": "571eb887-c8cf-43a1-ab12-ee9be9fc6256", "value": "6144:sDfeDgUQPmG4i4dW6zgVRaVVzl9QACPJflNG9:kI1QPmYczgTavzlpCPJf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680520972, "uuid": "581054e3-1148-4924-9de5-52b04dcf9a35", "value": 230680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680520972, "uuid": "ea603025-228f-4a43-b6b9-619b55dde22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680520972, "uuid": "f98e1291-81ec-447b-ad14-03e5ed77b62d", "value": "Justificante de la operacion realizada.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f77de95-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496168, "uuid": "69396154-aa78-4b35-90af-f933ac93e26f", "comment": "Malware payload", "value": "0444ab1bdfbd27453c72eae9d670dec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496168, "uuid": "50a4edbc-b4d6-4287-b294-ad7727da1e9e", "comment": "Malware payload", "value": "e3bf8b6da83f9df6a37584e71d85a500adcd4ce10a33af733667d62b5bb94368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496168, "uuid": "66bb6120-8bf6-4713-bb21-348dc9201f7f", "comment": "Malware payload", "value": "093a667a3e83e180f6fd64fcb48cd5ae28e06682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496168, "uuid": "f6276fe1-bdc4-4d5a-ac5a-6e49fbe38d45", "comment": "Malware payload", "value": "6718db34d16f07b2b73019d1203a697ee555aaff8c1497ffc42a187f96563338c3bf3f294807efd5b555cdc665377dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496168, "uuid": "900574ae-cd42-4602-9838-d25f306f2c38", "value": "T1F6F49D8C3CB6BF43D81C55F74877815DAE26EBCADA06008B596CFB1C1DA55E25AC3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496168, "uuid": "abfe8f78-f21f-4e5c-aa61-01ffed09f62b", "value": "12288:kmINqbb3wJXa39063xp272tbAD1UBOnTG5SLulOzwDydkXmx7:kmoqIXQxp2B10KQtlOzwDydkXmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496168, "uuid": "505fc7bd-606a-4d63-9ff2-611f42da48ad", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496168, "uuid": "38ffd223-f5f8-4819-85fa-e6e215838326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496168, "uuid": "748bad35-ccbf-49dd-8fb4-bebfad8c66d7", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.1343.4276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9854ba9c-d266-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1680557360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557360, "uuid": "1edc2642-0dde-482a-bce3-e9273b820cb5", "comment": "Malware payload (Mekotio)", "value": "2bdaa4b55a046162873998cc119097ac", "object_relation": "md5", "Tag": [ { "name": "AutoHoykey", "colour": "#5D5F00", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557360, "uuid": "a074ab92-a169-410a-92a8-3bde4047fb20", "comment": "Malware payload (Mekotio)", "value": "e3df82ead1dc4d74ddb51592918a30d9d4498d13ee18317d0862f288ee1ac462", "object_relation": "sha256", "Tag": [ { "name": "AutoHoykey", "colour": "#5D5F00", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557360, "uuid": "7f33de6f-4321-486b-bbc2-a195f5ec8df1", "comment": "Malware payload (Mekotio)", "value": "a449d3cd8cd2f1cd645c8e653a60ed5ecf3ba902", "object_relation": "sha1", "Tag": [ { "name": "AutoHoykey", "colour": "#5D5F00", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680557360, "uuid": "f814e787-814c-4902-af12-5e1dd388d489", "comment": "Malware payload (Mekotio)", "value": "e39788604bd8b436bd15a956c591d137627a5a5b4131c6b9b249f587dd387240c50c4685a082d44e15705f7e2e3deb0e", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHoykey", "colour": "#5D5F00", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557360, "uuid": "ce626826-931c-4054-bf47-09e632d4af72", "value": "T1C4E6338DFEEC2050331A8D7E5DDCF5E1911B2C52BE9843A55D2BEA9B4ED98470E039C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557360, "uuid": "58a341a3-24b1-4918-a511-2577c4625bd3", "value": "393216:tKz7KeZPzDs+1sO8xax48BaIFBtAxgnHJ4hSQhpt:IHK+D/7AD8gIj5HJa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680557360, "uuid": "f02595f4-80eb-485c-b56a-843b86653563", "value": 14508750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680557360, "uuid": "ec0c4f16-f051-4cb5-9d2a-89dd953ba2cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680557360, "uuid": "41435de8-6cee-4a10-8089-2a6314d43d7b", "value": "payload4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec75401-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496167, "uuid": "2b3e90b1-5323-49b9-b8a1-5326f561a666", "comment": "Malware payload", "value": "42a273f550de6a7cfdf55616b94c1fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496167, "uuid": "aae81e5d-42ce-4be9-b05e-584a99353b92", "comment": "Malware payload", "value": "e403d5706c7f7808744930d6992440cb58f3432d310bc0e5b53a99d6b6955ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496167, "uuid": "91383de6-9bbe-4639-8b4c-ea0a8979dba9", "comment": "Malware payload", "value": "b3e6b959adaab0359219378e60601cf1146d1890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496167, "uuid": "d8e094c7-3e91-4b34-aef4-8511bdb3fb44", "comment": "Malware payload", "value": "492606b34ef48ed4bf8d65f38fce8f4553bd1a53b5d45c7f613109f3a1839c54e1b4fb30b7358496850dbde71c9aa874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496167, "uuid": "0dea71f4-a53e-4f6e-9fb7-5be5e1f08e17", "value": "T19414AF9373E282BDD6DB41324F907B76B3B6DA520B229687C3F50D482F714A25739A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496167, "uuid": "e5fb372f-e535-424c-9448-87c32fbfe0dd", "value": "3072:Fbgj/fJ48xXQpWIobBvh3MZNQHf2+qZgQTc1E/ZQJ4UEi8f:9UJ48mpWrNvmB01E/exEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496167, "uuid": "37d04acc-6274-416c-acfb-43827b65d87f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496167, "uuid": "a9fee4f5-aa0d-46b0-b737-524e3f752eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496167, "uuid": "a219630d-a04d-4493-9b2c-9016ecf36fab", "value": "SecuriteInfo.com.W32.Heuristic-CO3.Eldorado.12587.8184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1942ad1b-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496158, "uuid": "0c875792-a76c-4ac5-b6da-a3907bcb5e4f", "comment": "Malware payload", "value": "1b69577117fe86c6b5da65ba9d048241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496158, "uuid": "de511c74-564b-4f4d-a93d-f2edcf440dad", "comment": "Malware payload", "value": "e53d46ae77046bcc00b8b7c8f942a41ed3f3e9f1fee0d8c6b0c60d58ca06e393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496158, "uuid": "5ff97522-23cd-4f82-aa15-2282bd469f20", "comment": "Malware payload", "value": "53d9689186661dc9dc5943a6ab4f7f86691aa271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496158, "uuid": "2578e8fa-efeb-424e-88ef-45fee22fb539", "comment": "Malware payload", "value": "fed00df6ba5e35781dd46127407efee2670547fa25af21f9f3765a5c30160eee4ac6b7828dff4142d3d2060275961024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496158, "uuid": "bb33d23e-82c4-4369-a004-953305f89d29", "value": "T115059F5BF9A3D4A4C77420F04C5B6B36DA6B89424B36CBC39364FE6E5D22082E937135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496158, "uuid": "4d05ac4a-387e-4f9d-a443-37ca984d5ba0", "value": "6144:DZB55tMCnsfyZGk0izbo/i/8+H0OGNToq6YjW3HaWwWYuNFnYHuD:DZB5VWizboq/8DWTkWXaWwW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496158, "uuid": "12a80146-5fff-49ea-9146-3874f1cd44b2", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496158, "uuid": "a1f5e47d-eb04-4f5f-9486-66a3840a5fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496158, "uuid": "72c075b6-b15b-4ed2-b58b-e5c259199d4e", "value": "SecuriteInfo.com.W32.PossibleThreat.7673.8384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4cac0c-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680524805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524805, "uuid": "b8e8851e-4f80-48f8-8edd-ddd85d2b3400", "comment": "Malware payload (Formbook)", "value": "3052dc2ad23f1eb517317d856110d60d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524805, "uuid": "fd79c515-edda-4251-9520-37a90bb2bc7f", "comment": "Malware payload (Formbook)", "value": "e6a37fc9959cda197e79dea566901b4d837b7b8c35a13d3d167c113c59b6b733", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524805, "uuid": "8958f845-e924-4799-b292-cde776e53600", "comment": "Malware payload (Formbook)", "value": "c2dfa9ae2d0d1d2888ea884a20455870c9abdb46", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524805, "uuid": "bd18ef7e-babd-4d85-acdc-95337e0780b6", "comment": "Malware payload (Formbook)", "value": "847d150399f415e6daa978a61524bdaaa4b98c5c8ff607cef87fa660629eb6db5d9e90ef6ad71b3e7455e390d556297f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524805, "uuid": "9788fad0-99a1-498c-8583-4db7cb69f95f", "value": "T1CF35011BE2808E0ED8424F74AF97A8DC120E7D517E1AB1833041779F2EF3A25A557E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524805, "uuid": "7c82b779-c75b-4fb4-beb0-9d7044fa11c0", "value": "24576:qLKEu9VDu9VJ+MXU3u9VO+MXUE47NK+1LR20:qLKEuruh+MX2u2+MX547NjD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524805, "uuid": "377837c1-53f0-4b5c-aafb-c26b91524b91", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524805, "uuid": "cc0c08b5-02e2-44d8-b892-63c9c542e4e7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524805, "uuid": "281126c6-b8c6-4e8c-965b-9e46def723b0", "value": "ALFANAR ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8b5605-d22f-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680533582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533582, "uuid": "25480bc3-369b-4951-b732-e9e24b2d5ae4", "comment": "Malware payload (njrat)", "value": "797e61bdf6cbf349e9a3be636439c09c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533582, "uuid": "a4e37054-0a58-4cbd-b300-b71d665eb7d2", "comment": "Malware payload (njrat)", "value": "e6c234fe962447e2330d76e1381fe44fb30284c864b6a9735833f59201835e86", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533582, "uuid": "3b8fd2a9-ac41-47e1-bd84-3386358499d7", "comment": "Malware payload (njrat)", "value": "ca000df76e2a3962a472e357531d80416e22caeb", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680533582, "uuid": "ebe49504-eec1-44b6-b991-aa22e330b55f", "comment": "Malware payload (njrat)", "value": "bbbb19aee27cef7d05e2a57a40589775cfe511bc3df9936b7db7541eb93d344ba4621fa6e9ada18947b9f211177f0516", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533582, "uuid": "4f623300-36cd-42f7-98e6-0e0cab0df6a4", "value": "T11C93E84977E56524E1BF56F79871F2004E34B44B1602E39E48F219AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533582, "uuid": "41d7807d-019b-4b39-bcb1-e99f09e50b37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533582, "uuid": "cf0097d3-457e-42dc-a990-75753d7e1f05", "value": "1536:FUk1GkeUqZJO5NNSimjEwzGi1dDxD+gS:FUPUqZJOXAOi1dNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680533582, "uuid": "6a5ff2c1-aa93-4ceb-abfa-fe95f88c20df", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680533582, "uuid": "661729b2-30a8-45f9-bde9-170b4cd6638a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680533582, "uuid": "47b5e34e-63fa-49da-a144-0172c1336d5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cbd8bf-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680522888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522888, "uuid": "3b1850f6-0a69-4bb4-8fb4-bac6f72ec202", "comment": "Malware payload (RedLineStealer)", "value": "4f30e8cf83802924d8e9c5872b12874b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522888, "uuid": "d68c3d95-51da-4864-a4a6-a3a7f35c8018", "comment": "Malware payload (RedLineStealer)", "value": "e7501eb3311c1810a90d8bf75054a0f7cf41f114d7664ca922072e292f882a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522888, "uuid": "5280a84c-97a9-4aa8-b319-7ca14badb25d", "comment": "Malware payload (RedLineStealer)", "value": "bdfb33a024fe5bdc0798f9aeac1bce6c37b95bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522888, "uuid": "8383d37f-d79f-4038-8c51-fc6cafabdb80", "comment": "Malware payload (RedLineStealer)", "value": "59f60143ec206e4c4d4ba318be709fcac9865d6466a322d6fee2f526e6f5bf826a76619b9fb7ba681764ca1f61ceb80b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522888, "uuid": "e80d4846-eb3b-4be1-9cef-b358b1432ea2", "value": "T1C7E4121277FC81B2D9712BB419FA03930B35BCE29975825B234EA85E1CB21D0E972777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522888, "uuid": "85afdcbd-2a17-4424-81b3-0e4d6443b60e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522888, "uuid": "80bbe2dd-cb4a-4714-8d0f-5a2e8bb72550", "value": "12288:UMruy908HCdhmonEwegJR4vUPIAkiW913Br/Xe2q5VFlShH+ZfCUb:qyfHMmm1kUA93/Xe2q5VFlShHaXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522888, "uuid": "31796b2d-852b-4d93-9a48-94fc372bdd71", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522888, "uuid": "1fe11efd-3fe2-4184-92b9-9baee13a7701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522888, "uuid": "a253fa95-d905-48d6-bf8b-b06448479a54", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa40a09-d215-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680522413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522413, "uuid": "e10f932c-cf99-4a03-a242-b5022fe6dcf5", "comment": "Malware payload (TeamBot)", "value": "cc0b41c8bb479965de38dd588cb0e1ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522413, "uuid": "0d0ed522-14ff-4677-822c-d76124ead89c", "comment": "Malware payload (TeamBot)", "value": "e7773ff571fc21bfc4bf357f9a9c4e6d07a4a2bd77b23cd948bb0d62f6ccf9fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522413, "uuid": "400a5c7b-7679-40b2-b4a3-f8ac9d4aaa5e", "comment": "Malware payload (TeamBot)", "value": "cbac4b00872a1d9a7410149a41b496ad7958d235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522413, "uuid": "a59bd323-a743-452a-a3f1-768557564c1b", "comment": "Malware payload (TeamBot)", "value": "85fc5e264824f32929c944904a1ba30ae4057b2caecb1fd7bd7bf663a296efb16b1d4424bb29ffa821718db13abab494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522413, "uuid": "6c112754-b804-4dac-a047-c6ad415b106f", "value": "T1AF14D02137E1C0B7D42785789571D7B0A62EBCB1DB92C9CB334917AE0E712D19E7A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522413, "uuid": "c064aa10-c69d-4c12-b175-c434c052f600", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522413, "uuid": "7c486719-c0c4-435a-9631-66c9eea4c681", "value": "3072:IZHBNooo9CEd5zxVobtlTKqy06ZP+STD109lES5/XFF:WbMddxmjWx0WThu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522413, "uuid": "0aab45e3-b7a7-405e-af92-4c9648474851", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522413, "uuid": "6396840e-4584-48c1-8eff-4872a2435952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522413, "uuid": "7cc37a83-5ac7-4a48-9d4f-9e4c426c54f0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21816926-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1680501326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501326, "uuid": "b9c2a9e7-d1a4-48fe-87c5-9a6c10795952", "comment": "Malware payload (PureCrypter)", "value": "34fc4c9949bc88499797b97b42717c53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501326, "uuid": "7fed7a46-ad4c-4a0e-b8be-ae2a8c07e42b", "comment": "Malware payload (PureCrypter)", "value": "e7b13f4b043181046c5b26f3f80fd2ecdbbf04b8eebe7a05123d4490d9d678ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501326, "uuid": "a9a0a122-f9ea-4ba7-84ce-73f133a01567", "comment": "Malware payload (PureCrypter)", "value": "c043acfa12e2e48c22719a2165331c3758904d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501326, "uuid": "e9989697-6fcf-4974-8067-dc2339af6efd", "comment": "Malware payload (PureCrypter)", "value": "2163dca5b77753376c2ab4689e4de42635aa610891ee80563641bfe3c638bdb19c14833184179fec77d09de5654fb272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501326, "uuid": "9fc39d91-7ccc-4557-9650-fd2e74147763", "value": "T1A2541B05BBAACA62F6A9273AC9F5960407F1F841A676EB0D35C913DA0D13777CC0172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501326, "uuid": "fa8c339d-655e-40e1-85e3-1bf60b05f71b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501326, "uuid": "43a8729b-3577-4bab-897c-1665beb2e9b1", "value": "6144:rHX1QhQ7Jbd8bW3lna5n+h/TYoKftd0sopyV1S:rH5fa5no0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501326, "uuid": "9de477da-258a-42e7-a909-80e35a8b2ba0", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501326, "uuid": "34fb4450-3ac0-480f-8a37-a06f17580648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501326, "uuid": "b98d9c21-85ad-4d32-8c6d-cc4010d6d23d", "value": "RFQ No. 109051_________________xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075e0c11-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525334, "uuid": "fbd86e43-fa30-421b-b883-e96628fff111", "comment": "Malware payload (Rhadamanthys)", "value": "5371a062fecd06cc0e1703a65eee26a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525334, "uuid": "1b4d1bb1-eff9-4242-8403-7e754ce8ecf5", "comment": "Malware payload (Rhadamanthys)", "value": "e7c2002c203f78defd5b677f8d5d9825fae55298c309c96f1aded859a076eabe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525334, "uuid": "514d1d75-f182-4f18-af28-d2e4b7f71ef3", "comment": "Malware payload (Rhadamanthys)", "value": "b39fd93be428a040565964d96e7d7c843cde8baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525334, "uuid": "dce30025-e4b2-4d31-85c9-199810250476", "comment": "Malware payload (Rhadamanthys)", "value": "e8d57a9127cbade80cf452b90aa28f82638ea9d400274d8617e3c6af9fe3dbc94cf92171ad4f39100596a2b3e26759d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525334, "uuid": "0845fbf5-c43a-4a2d-bee1-934e20461a85", "value": "T1E464B04267F1A871E63246358E1EC3F42A1EBC61ED25FE9E2745FA3F09341A1D222717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525334, "uuid": "0adfedd4-89ba-46dd-b94e-0c3805933a20", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525334, "uuid": "6d0fa6ac-3531-4a78-91d9-bff8ed5ea5f5", "value": "6144:0UAC1CvjrC3G0qnZfcoybVfernV8WZtkjt:7V18jGW0qnZfcoybJer6WGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525334, "uuid": "9d3a66ff-c531-41bc-9aa7-afcd8c775916", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525334, "uuid": "0972b193-ad10-4480-8168-2e658a03c1fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525334, "uuid": "f82c8c0b-2e70-48e7-966f-362cf7534706", "value": "5371a062fecd06cc0e1703a65eee26a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ebdaa-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680501297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501297, "uuid": "353f1231-2df3-4317-90f6-ee69ad0f7791", "comment": "Malware payload (GuLoader)", "value": "c70ee0dfebda6f8e141ea0e8c95cb557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501297, "uuid": "b8605154-b024-447f-b406-77d6f161e3f4", "comment": "Malware payload (GuLoader)", "value": "e7e43614a16fda0674156d897c3c10b48940209fc4dc7f58bfc1a3aae3af8778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501297, "uuid": "66b46a4a-fa0e-4147-bb1e-c6f620060497", "comment": "Malware payload (GuLoader)", "value": "e8d02bd0623e631b12011e820618374c20705a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501297, "uuid": "73118ec4-76bc-4e76-b95a-37fa55b5d7bf", "comment": "Malware payload (GuLoader)", "value": "68349dbc38290eb58476c002aef38375ba50d7cecbe68fdefa34eca0193094ef81ab65365a666de1d10733bb7783dce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501297, "uuid": "8856ee33-52bc-4ea9-91dc-d90ebfc6690b", "value": "T137F412A53B98C807E3A15A7859B4F77D4775FE281D0BC30396F8788F3625B51AC29342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501297, "uuid": "5348b612-ec03-48c0-b030-8b013a245813", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501297, "uuid": "53090895-8010-409c-89c7-482cb4f21a68", "value": "12288:/ghti/pIMIm905UOCsqhyRC600yP6ijvrguiK9FdXj00x1Ss6QXd+2wYuKP2gX5O:4O2MIk05UThyRC6w6KTF9FdXjdITCd+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501297, "uuid": "ca1fb488-067e-4452-94a8-1c87df1b791d", "value": 770621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501297, "uuid": "7fe98c7a-c436-42fb-9f77-5ba84e75045b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501297, "uuid": "5a16ea89-092d-42d4-9dd5-2e73e3953506", "value": "DETALLES DEL PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375e8bb1-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526703, "uuid": "a823316c-e762-4dcd-8248-20a3efe2bce6", "comment": "Malware payload (Gafgyt)", "value": "9fd72bb15e65ac725847000cd732e606", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526703, "uuid": "9b4cd691-c57d-47af-b066-36779c6b7332", "comment": "Malware payload (Gafgyt)", "value": "ea5a4ae2630a9a2a4ff2c17c62df131d736c0d8e9d06f91308a3868c85dcaff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526703, "uuid": "458428b0-d7b2-458a-8e44-e281486cb549", "comment": "Malware payload (Gafgyt)", "value": "143c0343cbdce472980f5e244fefbbe11852df65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526703, "uuid": "b95afcbf-f5dd-492c-aa57-79a90fd9a9e3", "comment": "Malware payload (Gafgyt)", "value": "6995190d9372d8f1bf4c73a51aeb98fce92bccc0d7a23db7fc4fbf1a3595e4205d06806b12953f1f2fe9af66c6b0537a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526703, "uuid": "c11c0775-e007-4a40-92a0-de93d18634b5", "value": "T10DA34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526703, "uuid": "22c2b5ee-d5b6-41ba-bf29-ae686b31db1f", "value": "3072:YWCjQrLpnr85EdT9Oa8vqbVr7R/CEgmqAgcVyZIcBI:Yf5EdTbpr7RWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526703, "uuid": "4eda58cb-726e-4a2b-baa4-d57c16ae65ce", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526703, "uuid": "64e92cdb-877a-4b68-a441-659e9753dfc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526703, "uuid": "0e18a08d-1192-4080-a60c-c0df72e090d9", "value": "9fd72bb15e65ac725847000cd732e606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c87499-d1e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680501971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501971, "uuid": "c5c3cca5-b455-484e-80e0-0a5e7b94efd3", "comment": "Malware payload (Mirai)", "value": "8bd7d5f8dfd75caaf9f747eea249acd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501971, "uuid": "c5e9af5f-57e8-40c5-bc63-58669c4bcc7c", "comment": "Malware payload (Mirai)", "value": "eae68f5e6c80b16e8f37354b73449bb1955b698c73498433ebc10859b7d3b3f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501971, "uuid": "d208a723-64a7-49e7-befc-5c380c32074c", "comment": "Malware payload (Mirai)", "value": "a63193ee38d0768a843b6a9f72fbe6450f36c9af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501971, "uuid": "f0fc2c62-26e9-4bc1-ba7f-ad6126a92609", "comment": "Malware payload (Mirai)", "value": "f09955c6ed06d996fa5395e040709bdefe275734d7b4e16295a5830df526ce9d8cd4269afc4a2a207ae66eeab797b14f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501971, "uuid": "f4b39dca-dbde-4fbc-a4a0-a31b5cc23e72", "value": "T128B2E1340AAC5E36E6D4793AD8F8E90182724D30D4FBF5B17D04C779BA7A41C0EA6953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501971, "uuid": "c9fb2342-5d43-4371-853e-aac3bee7a5c5", "value": "384:CNyiK9n9LPQYO1+aB+ieHAAHzB3qeqrhknczktUB56jzJhymdGUop5h4:EqAYOvegAHzB35qrKczGUT6jzJs3UozW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501971, "uuid": "84dcf985-2188-4e56-9c63-204fac63de8b", "value": 25240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501971, "uuid": "83ae1b2d-2c6f-41e2-bed0-f3a8f8d787c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501971, "uuid": "8b1af6fc-3deb-4d0f-97ee-6f9a4f5b30aa", "value": "8bd7d5f8dfd75caaf9f747eea249acd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c5eb06-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680512260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512260, "uuid": "5e19fa4c-8aa2-4b24-90ce-796f1f3a6ba8", "comment": "Malware payload (Stealc)", "value": "565d92c7797ada687474bf051ff0c4c0", "object_relation": "md5", "Tag": [ { "name": "565d92c7797ada687474bf051ff0c4c0", "colour": "#6467C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512260, "uuid": "27862494-8060-44ed-9dbd-9afe3d77cb8a", "comment": "Malware payload (Stealc)", "value": "eb6c798cc9b87f2287e5eabc203b5a9d3c8af969f8fc433107a3a129b1df8596", "object_relation": "sha256", "Tag": [ { "name": "565d92c7797ada687474bf051ff0c4c0", "colour": "#6467C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512260, "uuid": "5f1ebea1-5f66-443a-8488-6f159bbe5eb7", "comment": "Malware payload (Stealc)", "value": "2d48db398da89eae5da952aff9221dd7359a2ed2", "object_relation": "sha1", "Tag": [ { "name": "565d92c7797ada687474bf051ff0c4c0", "colour": "#6467C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512260, "uuid": "9af2f8be-98de-48bb-8c24-9d18c28d2aeb", "comment": "Malware payload (Stealc)", "value": "a8373f81b7f40cfb715db1571da3c7bcf4734333bc2f647694a2875d0352d41466e81b951693220cb28faa475ca66c9c", "object_relation": "sha3-384", "Tag": [ { "name": "565d92c7797ada687474bf051ff0c4c0", "colour": "#6467C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512260, "uuid": "7160d2c2-20d7-4364-a063-d9c084b1ed52", "value": "T113D633DD49AF90F4DDC93470830BFE8A66F96D760DC0CC1CA9D26EC9AD52E71A022617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512260, "uuid": "c405eb03-2493-4889-86a9-ab071b4d9f91", "value": "ff33eadca45c6385bfd8315e8bf376d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512260, "uuid": "5bc5fdfb-8581-4f30-b242-7757274c875b", "value": "196608:Z9cTrBl+PoIR62/AC04vR8oV0GpgjrxgpM+GJTaHauue7/RX/fVX7m5+aYqkS:gTN0gIomAgbknxFWJue7/RX/tLm8a4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512260, "uuid": "4a120895-d366-4f96-831c-f98096599883", "value": 12998768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512260, "uuid": "708843bc-63c5-423d-816a-e60624e46553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512260, "uuid": "da058e6a-5edc-430d-bdaf-062c01ab0805", "value": "565d92c7797ada687474bf051ff0c4c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533591fc-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680525461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525461, "uuid": "2c8d3b2f-dcc5-4263-8cb2-1425a1f07009", "comment": "Malware payload (Vidar)", "value": "c54e1010667d865535bf01ddf53d2651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525461, "uuid": "04367ffc-3835-45a9-87f8-a53fba66ef07", "comment": "Malware payload (Vidar)", "value": "ec3d7e542dfae02a5cb5048b18b48e6438f32a8b2a956f2779b420fc3849dc2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525461, "uuid": "3beb1b6e-276f-4c84-a2ac-594fddad7524", "comment": "Malware payload (Vidar)", "value": "2be8cf8ee67bd1685958d653637b62d2ac424d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525461, "uuid": "679a6a63-686a-44a0-9784-d576596aaff1", "comment": "Malware payload (Vidar)", "value": "aaeb5b170f978328ad6ab6907cfbec58fee1448adb43577945ee3adb03aa8dc0c61baff3e52ecb8b4f776669d6e86a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525461, "uuid": "20bec578-fad7-4a66-9dc9-b024ebd6291e", "value": "T1AC64AF4257E1A830E21757318E1EC3F42A5EFC61AE257F9E27B5BA7F09341A1D222317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525461, "uuid": "2d91dab4-ddfe-4568-8c94-cadea8e58ebc", "value": "e7de1a10ece3ac9cb12c5c2fb0c2137e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525461, "uuid": "47b6840a-96e0-4e29-b005-5a31009d9676", "value": "6144:gaz/ZZJjgQQQlufWSxKPq0wQF+wPZtkjt:garZZpgQQQ7oKPq08wPGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525461, "uuid": "fe49b2a0-5c75-46d4-bce4-9a55a8ff9dbb", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525461, "uuid": "395093a2-c2f0-4094-be0d-d9d68de03092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525461, "uuid": "360b4483-07c6-4627-8cb8-b4ec694864d1", "value": "c54e1010667d865535bf01ddf53d2651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1182a0fb-d1e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680501299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501299, "uuid": "65a64edb-0609-451e-9aa8-ef7cc78b0729", "comment": "Malware payload (Formbook)", "value": "5581ce4173950dc3f099b54ae4ad04f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501299, "uuid": "b816e177-27cc-4cdb-8ca0-7ae7581c4ceb", "comment": "Malware payload (Formbook)", "value": "ec7e57dbbb53244026d10b925da33e1051b0f668db7224bbedae112917c71e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501299, "uuid": "4f5493de-0ca7-4f79-9c78-4c228223116b", "comment": "Malware payload (Formbook)", "value": "fb037634603cdc5155fb201e79e37eb5a7d69ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680501299, "uuid": "16a50525-941a-46bf-b0a4-b9f06a6b2bf6", "comment": "Malware payload (Formbook)", "value": "7f335bc2b695a47e36153fbb05b84b266de905aaa69e0851be3343a840acdc6fb06cc44ed127c5de2b01e275357d589c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501299, "uuid": "5f0f2500-078b-44b8-8149-f45b69510016", "value": "T1EF04231B49BE6C5DC931BA74979029F5242349FFF450C60A827C49BBF0291DDF35BAA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501299, "uuid": "a68112df-c9dd-4ac6-b846-b05eac3ca320", "value": "3072:nvfvpF273RijjB1KP5AH8lfj1iLX7KchBH+0QYo38Lh/BT8qb21bvyUs:vnpF273RR5AH+fJiKcXW8NqqKFKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680501299, "uuid": "1f7b8989-70c6-497b-a37b-62b7e25fc112", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680501299, "uuid": "56567ce2-7073-4fa5-93de-c192886638a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680501299, "uuid": "89b9b3b0-0323-4883-a842-60a98ebc7be7", "value": "ec7e57dbbb53244026d10b925da33e1051b0f668db7224bbedae112917c71e69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0968692e-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496131, "uuid": "e1b9e11a-162d-47f9-8306-92d60a4dbf98", "comment": "Malware payload", "value": "6e092e66fe927aad6058a354c7333ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496131, "uuid": "458d0294-6e2a-4ec1-acec-a4fb056f7a57", "comment": "Malware payload", "value": "ed1f31ad6ad3afb355026640ee101c111de1b7e413f6375e161a34a0cff21bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496131, "uuid": "112c2eae-349d-442e-af1c-d708866366d0", "comment": "Malware payload", "value": "26be17309bf1481251f8fcaafb7464bdfbf3695f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496131, "uuid": "dd997c2e-c206-4798-8482-bf4a2c5af0e4", "comment": "Malware payload", "value": "d7047adfdcfe79419edce92191bbd887b30ad38903055efdc6e18b5a90f8959685c0596c60e4cc5b972b398ddd1c27f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496131, "uuid": "87a51b76-2432-4714-9c9d-85e68a242f39", "value": "T1B5846C36F6D08837C2732A3DDDAB46A4A825BF952D2934862BE81D0C5F3D79135392C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496131, "uuid": "3b9db38f-21fb-43ad-8f3f-15f3ae6a22d4", "value": "6144:nmAOnKl5eib+RzWjt8yEbMDWFEOh6vVtxHZnyS88ZwY1v:BOnKlFbwy1WpQvVZy98f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496131, "uuid": "145f4159-9e7e-4942-b9eb-ffea4a9a0838", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496131, "uuid": "ae2fb5aa-efb4-41ed-aed3-7e51a2b5bc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496131, "uuid": "88425a3f-c173-4a59-87bf-0871fc763834", "value": "SecuriteInfo.com.W32.PossibleThreat.31794.26075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30806a9-d219-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680524333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524333, "uuid": "c0fece84-69b2-405c-8111-8be34072b4c9", "comment": "Malware payload (AgentTesla)", "value": "401d1a480f9b8dc646a7bb349b7c8af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524333, "uuid": "7dcc73be-9220-415f-ae42-f8b663b0da99", "comment": "Malware payload (AgentTesla)", "value": "eecdf61f19a47b61d84f48d73575337a788373567568d795108e9a54d4a1d811", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524333, "uuid": "42251574-690b-4f5b-babd-995115f4a060", "comment": "Malware payload (AgentTesla)", "value": "45939070da433b5ef38081df24620d87f38a689d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524333, "uuid": "937ad660-789a-435f-906f-17ce11f63873", "comment": "Malware payload (AgentTesla)", "value": "1746baf4eee989aafa7cccac525d89ef8458ebb59178a6be1e08a1dfa1dc87c653716f2271d253820ad78f81443b64b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524333, "uuid": "32673546-0f60-4c8f-bd67-e7851651ce85", "value": "T1A1159D791D9886E6F478D675AFD0C033A2C35FEBAB018C6825D63E9F6E7590318CA01D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524333, "uuid": "257e8ca7-dccc-45d3-82cc-44fa6dea5a9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524333, "uuid": "227b14d1-fac2-48a9-8fc3-0945da0e8245", "value": "24576:gH1BndpkB/NPQNRF7kVqeYVMS0k7OTP8U1T2s0O8BD48rWHFDW+1RUr:idc/NoNP7kvkMS02OTPP5L0O8BD48rWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524333, "uuid": "d2917496-dc49-4d8f-9870-202b6b72817b", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524333, "uuid": "7fadc655-4598-4020-8967-00a3000effdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524333, "uuid": "f9ebbe1a-1443-414e-ba59-5b2a3b6fcddc", "value": "eecdf61f19a47b61d84f48d73575337a788373567568d795108e9a54d4a1d811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1132dc8-d258-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680551361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551361, "uuid": "7104d883-6df7-4251-85c2-31aa8703770f", "comment": "Malware payload (Gafgyt)", "value": "7658f444bee8703432f9ab2dd2a1bce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551361, "uuid": "872ae133-dc8d-4ba4-bdc5-5ba8f09bc504", "comment": "Malware payload (Gafgyt)", "value": "efaee2df91ed92e554fa3beadb528b045ed258f972acd91005a1b96b96e55d82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551361, "uuid": "e64a350e-15fa-46d3-ac22-c5173c87bdee", "comment": "Malware payload (Gafgyt)", "value": "2cf88c5167a98b95780aa2034b837dc1c00df347", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680551361, "uuid": "2214fc8c-1a3c-4c18-ab05-c0fb4874f3e6", "comment": "Malware payload (Gafgyt)", "value": "e9e29ec75f98f3465f9cc73475ba0c77b44842c68ff2808f90b64bd5f63e15263da20e1def2c7692d6703e84c0ec255c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551361, "uuid": "2eb64c2e-9b52-4286-8680-4fe6bcdbd126", "value": "T18FB3F721F9408767C2D227BAE7CA468D3F3556D7E3D733115A38AEF42BC1B982D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551361, "uuid": "af135bed-90b3-4088-aeed-be6809182ff0", "value": "3072:cXb15cIK38YiDBTBP9snhnazmkZrQAhWDCXF8e:QcIo8YQpBP/mkZrQAhWDCXF8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680551361, "uuid": "ba2f5318-8a31-4614-805c-9c85a50b60fb", "value": 116779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680551361, "uuid": "deb4aa4b-328e-41eb-b503-a6c50fd057b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680551361, "uuid": "5a97d4ed-4862-49ef-b803-687f425c0098", "value": "7658f444bee8703432f9ab2dd2a1bce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7b7295-d279-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1680565525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565525, "uuid": "fb249d0a-a052-4720-8cb2-89914b6a7b50", "comment": "Malware payload (AveMariaRAT)", "value": "a70d80cd1c3980251681d1cbc0e9d46d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565525, "uuid": "69d50110-bd2d-4d93-932f-60a13c2fd1c1", "comment": "Malware payload (AveMariaRAT)", "value": "eff5006d8102c70638bfd284058d10c1aad385039e62d01f5dc287d13e29a59b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565525, "uuid": "4d665811-58f9-44aa-8009-dab189411401", "comment": "Malware payload (AveMariaRAT)", "value": "2dd861ff40689f28ece21d2487ba1f59b73a23cc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680565525, "uuid": "1040a4a7-ede0-4791-9e23-2f9d4d407674", "comment": "Malware payload (AveMariaRAT)", "value": "940ecfb385492cfa75b7ce8bbfff428db68b59f5dc4a034f788dbaa84811cdc24f5a80fe8225224aae0f8fe819b3111f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565525, "uuid": "6abfdc31-37f5-4a12-9366-e3d97e82a328", "value": "T1C9B4B650DAC8EC69D05B1276A835B078B82DF7ADD37BDD5E290D248988673832413F7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565525, "uuid": "5a97c90a-266d-4062-8bab-498d0148db35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565525, "uuid": "8155672b-c6cc-45ba-9ca7-27c3c715746d", "value": "6144:8177CJS2P8N3qcLpaqD/9qeGNHi6Ukq+xJuDh6XcH/e5Xs1wV/yCYBkP:8QE6qNScHPCYWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680565525, "uuid": "67f5a156-d420-4906-a43c-d767bee52167", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680565525, "uuid": "6e911a7c-ce68-42b5-82c8-7cdff17417dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680565525, "uuid": "9309f199-9ba1-4599-a8a0-e8c7b3432425", "value": "Requirements for RFQ 0643CQREpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c5ec0b-d21b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525309, "uuid": "7c317606-455c-4635-a085-33539731824d", "comment": "Malware payload (DanaBot)", "value": "2fa6192193f125ecfbe7b5e840510cf7", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525309, "uuid": "d6dab750-6c43-4200-b590-640fba420fae", "comment": "Malware payload (DanaBot)", "value": "f0c8e87c4048df5378a2f3d23a9e3f2af25e71bd1fe4ec08e24e21adcffd9ee0", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525309, "uuid": "30b31998-2f5d-462b-8416-4ff5db1955a2", "comment": "Malware payload (DanaBot)", "value": "9b8ec9054758b5604801621e6bdf3b3943e2ec08", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525309, "uuid": "372746f7-5a2b-4dac-9de3-4195c4025dd0", "comment": "Malware payload (DanaBot)", "value": "8150ddb0d37f4bfbdbb505b605c8b70232b7c830d51d30e3b8cb231509337b29cab63fb52d6f3e03e5c352505127d67c", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525309, "uuid": "c958be9e-4140-497f-b846-c70dd90811d7", "value": "T1AA36334297A86934E53C4E335F2EC6F05B4C7D622E19775F2B7CBE2B12785A6D222304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525309, "uuid": "3faae83e-6c78-4594-adff-1de30fbd2604", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525309, "uuid": "db609eac-3e4c-46ee-bda2-dc9d94c3917c", "value": "98304:mCz90bYBEXtUZ9qe9vcqGrB6Wxh/i1+iB0aN2QG4KegEI3Sc:mCJGYuXGZPVAtm1QmMFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525309, "uuid": "eb6a0a60-ec21-4ac3-a72d-34d631af1a07", "value": 4949504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525309, "uuid": "a26a7e93-7a93-42ad-ada6-0f7423a6a01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525309, "uuid": "3f0af820-12ff-48f6-ac65-ed0faedae543", "value": "2fa6192193f125ecfbe7b5e840510cf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0372afc1-d216-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680522750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522750, "uuid": "8bbdcf77-deb3-4d6d-8190-214d7670e33f", "comment": "Malware payload (RedLineStealer)", "value": "b7e5e1084a65926a29ea0205bab3b82c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522750, "uuid": "0a641c3e-910c-4709-a60f-0e9b7bd2c96e", "comment": "Malware payload (RedLineStealer)", "value": "f113dc9d4ca733096ee6d7e5d7bf0d3635c0f5227186ae402dcc512f72d44077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522750, "uuid": "3233afbf-dc07-4c82-abd7-d5015bc72319", "comment": "Malware payload (RedLineStealer)", "value": "39dfc66c8a945c9d7ae7db1a4c56431716a875d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522750, "uuid": "54c729fe-7919-430c-99a1-fec9dd58f9f3", "comment": "Malware payload (RedLineStealer)", "value": "89ad8c0d5fef57f1281bc2d2026e9938af61b00f58fc34dac0b2e7a46dd5b0bbb6a9d58c7a13a0cb383e5ef08bd783d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522750, "uuid": "d60cb59a-955d-4e66-8cae-fd9427912025", "value": "T1E4252302BFD80131EDB557B029FB07C70A75BD6559B5832B6B81E90A2D327D4ACB432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522750, "uuid": "005d94d6-ce3e-44fe-a8b1-dfb1205aa223", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522750, "uuid": "c5015742-efda-411b-bf40-a65d50c5fd97", "value": "24576:Syun5bXOXC2oE0/NxB5nI6RP4j2iVpxQ3Hyfq5kow:52bXOPoE2Nxhh4qiVpxmUMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522750, "uuid": "952ef197-3334-4518-a390-4c8b65925a8e", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522750, "uuid": "8362cc88-bd7c-4432-b740-19ab178403f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522750, "uuid": "85e0970c-b05e-4583-88f2-6ac4fa097f79", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdb68c1-d22c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680532269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532269, "uuid": "4e593821-835d-4ea0-8cc0-0c75d1341bdf", "comment": "Malware payload", "value": "3416a16122626f96047f83b7dc33059e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532269, "uuid": "6764445f-d5f0-4291-ad7f-24d71946669d", "comment": "Malware payload", "value": "f1226b785abc247e464a7f4a003e86c8caa31c3f636aa18f68f374f5806f8ec0", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532269, "uuid": "7cefe1cc-3ca1-48b7-8638-3db17093cac6", "comment": "Malware payload", "value": "bbf85238bb650c1ba8ab83c23a56cffcdf6e65fd", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680532269, "uuid": "451312dd-865e-4462-b003-dee3cbf2bf26", "comment": "Malware payload", "value": "b3f775f031b3e0b3eec2cef9114a3fe605a06f9639e68a3afa1f315bb960f6d679e9f2179ea55e7693310d22e2927dce", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532269, "uuid": "0b94d065-d66e-4d7d-8785-70a16ac391bb", "value": "T1EA45CF888E98CD1EE7DF23FAA5B720929BB4C4259783E34F059135EA3F1739449436D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532269, "uuid": "cc6af210-ab3f-4d34-a3fb-a0e668634ede", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532269, "uuid": "e30aeb25-8b68-4c6a-b953-e4f237a2fa29", "value": "24576:Snf8Ow1S56kR3fjbOQamtp0eUHZ4VxlfpwHZN9NBppMi6NGTZylo4BG:bVGfnOqaBH6hpwVNBppMNQTZyl1BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680532269, "uuid": "14f151d7-499c-4578-96a0-ed9fcfec65b7", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680532269, "uuid": "eb75ada3-a7a3-490b-8079-c224ce64d58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680532269, "uuid": "b3fe9917-1e4d-4605-8f35-f7ab5f571c35", "value": "b47c84a6581eb25ddbee5a14715abf7779947ee480cc063ff8a99cebbb492919.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564c0ebb-d239-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1680537922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537922, "uuid": "1cf40399-f39c-40a4-a67e-c0d3906a3ed2", "comment": "Malware payload (DCRat)", "value": "11485865ff246944cfdfe07f9bfb9018", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537922, "uuid": "eebff74c-c580-4807-bd60-c0fbd756d8d4", "comment": "Malware payload (DCRat)", "value": "f13d92dfc7cc1262d44e477b9fc06e0bc5e40043eef1ecbf22da881f36f4448d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537922, "uuid": "77fec046-2b8c-4fef-9896-ff6e531d180a", "comment": "Malware payload (DCRat)", "value": "44c628b26bbc7f727b9c41e925f5e11eff5b07ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680537922, "uuid": "bd514bda-7fe0-493d-8f9c-c1496dc036ac", "comment": "Malware payload (DCRat)", "value": "d639935771f00256a513400dedc2a34bf5b17160bd9e8f03b06e95a5311921faa92d43ec7d7428676aa31f35a0e09a98", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537922, "uuid": "bddcfe76-1276-493f-82df-6c037b8f6fac", "value": "T1A4B5CF0A7E48CF11F009123BC2EF554847B0AD516AA6E32B7DBA376D55123A73D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537922, "uuid": "3358d49c-837d-4583-9d1b-286419b4c747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537922, "uuid": "23657b42-ac65-4d0a-88b9-9f2676d97d74", "value": "49152:Fm1TWKfAVRY6rq7O22S4H8dtweWuX39ff0M9wVniIhVVSM:AFfGYNqneDH9H0SwsIh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680537922, "uuid": "97204bb6-209e-4a4b-adf5-bbe013ddf517", "value": 2411520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680537922, "uuid": "90b72f91-038b-4ea5-88d5-7043c71281af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680537922, "uuid": "0f605e6f-d4d7-4765-8f70-532821e51af3", "value": "F13D92DFC7CC1262D44E477B9FC06E0BC5E40043EEF1E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b15c0f-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525349, "uuid": "d4092bba-bbb6-496d-b364-be7206387fc0", "comment": "Malware payload (Rhadamanthys)", "value": "0b022ec9f04e701c407ef27fc2684f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525349, "uuid": "7af3fd0a-4250-46ee-8e06-6371dfef4d0c", "comment": "Malware payload (Rhadamanthys)", "value": "f1b26f0cc0816504f12258a3ee424de6fbe44726489a30318f210a97a2160fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525349, "uuid": "82d0d325-95c8-4315-86e6-eba54e936d7a", "comment": "Malware payload (Rhadamanthys)", "value": "39f593e6e3c278bec44ccb44713f370e791890fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525349, "uuid": "6fa49786-0425-4ebc-9b68-54d9a5a3ba64", "comment": "Malware payload (Rhadamanthys)", "value": "847c924dc2a473d51addae7085a59b7b29faa828aeee9fd7c184423a62de117f692b39f5674ad8cf7ac2a0eb44e4f5bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525349, "uuid": "f522fbf4-71b0-4b1f-a320-83ea8cdea540", "value": "T19064D042E3E57879E21247314E2EC3F42A1EBC61AD25BF9F2655BE3F0A341A1D221717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525349, "uuid": "0a5bf197-ac32-4dcb-a3a4-4436c74a46ad", "value": "c8e27fc56217a3e872533a4d04f73544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525349, "uuid": "9383450f-82b1-45b4-bc33-b901f589ca57", "value": "6144:XMQ7AYGvhE/2hmRk5DmcUH5fc47Ztkjt:8sATJe2ccUH5fc47Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525349, "uuid": "0c203429-6fd6-49a9-b04a-d9f825c6cfa7", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525349, "uuid": "ccadf476-2c04-4107-9b6b-3e977372b5a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525349, "uuid": "b288891b-dd48-4a1a-ae30-e36e660af913", "value": "0b022ec9f04e701c407ef27fc2684f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9839bc-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545635, "uuid": "22a4d88d-8c8f-43e1-ad02-f8301779be0a", "comment": "Malware payload (Mirai)", "value": "a2b59267d1ee635335a196c33072ce82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545635, "uuid": "644c52bc-a200-426e-8fee-5015319c6422", "comment": "Malware payload (Mirai)", "value": "f1ffa4b4d79ee946e4a25c7ffe8c0c765a87d1227b3a771ae5e0128f52599b75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545635, "uuid": "8e48ed24-d836-4832-8e58-fea2c3d431a5", "comment": "Malware payload (Mirai)", "value": "ed66b577eca637fd6b40a7982e93a94395d7e6a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545635, "uuid": "4ec5ffdc-05fd-4053-b6bc-77a7721494b9", "comment": "Malware payload (Mirai)", "value": "d7c144e40cf0061b22774adc5333b784c2c3cf33297b420e257a405419b1b10354116ba156c35c4dc992e1b5628ab6ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545635, "uuid": "dfe74eb2-e5bf-44a6-a390-9bb075680496", "value": "T1E6E32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545635, "uuid": "ab593057-e4f3-4e70-814c-6f7e1a2aedab", "value": "3072:CJLce3pC5mn7/abHbz4NpaIJ8VIJ1FeUXkkTM/9cHMY:CJLce7/abHbz4NUIJxHeUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545635, "uuid": "283e3423-f6b6-404c-9511-f69fdc742a96", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545635, "uuid": "20a2e28d-4b18-4acf-8cbb-b36fda689023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545635, "uuid": "f51df7e8-fcdd-402c-9cf8-322ad9387e6d", "value": "a2b59267d1ee635335a196c33072ce82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ebb15d-d21a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680524529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524529, "uuid": "46bbda84-558b-4334-aa5c-cbbea850755f", "comment": "Malware payload (SnakeKeylogger)", "value": "41a9384b93aa05622d02e7dcb37f1e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524529, "uuid": "13f0633d-1e9d-420e-b746-57d7a0c4bed3", "comment": "Malware payload (SnakeKeylogger)", "value": "f218cb48273b179ab9c039a0422797a4f1a567cf893c12ce3e6d8b5bc0932b0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524529, "uuid": "5e16bbb6-5a8e-4dd6-8af6-169d7dd127e0", "comment": "Malware payload (SnakeKeylogger)", "value": "ef24be1643494c69f0a7147c3c2795fc7b5468b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680524529, "uuid": "3cc72802-f95f-4694-a5f5-f393f80b6c02", "comment": "Malware payload (SnakeKeylogger)", "value": "e0db83d89931d63902b9343c08852e18869e3e1d62790d61673ada93ba6c8e2681bf432738c77aeaab502ae0b32394ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524529, "uuid": "f1c08d1f-0384-4d21-a2a0-f4f4fce4bf9b", "value": "T109257ED1F150C89AED6B45F2AD2BA53024D3BE9D54A4810C569EBB1B76F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524529, "uuid": "775e0c23-9b2f-4004-bc83-de3ca350b245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524529, "uuid": "0ac5e244-b01a-4638-adc2-9b26707ee423", "value": "12288:85CBWKdq1FbwwJLwrw+r2zlynvnor/HKkfmlWJx6UQUymAkCV:HfrpcY2MnvqvKkfm8xSU5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680524529, "uuid": "f82af0a7-5173-40c1-8291-6f158a382c15", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680524529, "uuid": "9b9e14ba-9b04-4a13-b7fc-8e8429a58bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680524529, "uuid": "18d19b49-3d6e-4865-9707-917a46ca14ea", "value": "URGENT INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929f4d7f-d225-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680529433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529433, "uuid": "0d1f49eb-696c-4f2e-9c9b-6a5f39db808b", "comment": "Malware payload (Formbook)", "value": "b8499f9080bb9e31a11a86e0807d406d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529433, "uuid": "abb9778a-3426-4ac1-b172-a61650771e86", "comment": "Malware payload (Formbook)", "value": "f22e2d1a6903ccecd271a8b287c427f4127f5966bf1761cf0a0e5071bfe93c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529433, "uuid": "e476c756-4108-415c-9080-1d1e69e004b2", "comment": "Malware payload (Formbook)", "value": "8ca066ef5fcc5ad9bb4c9d90d5f4a2e404aa0f40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680529433, "uuid": "4ef2f939-8652-4eae-a3c4-d5817764ecdb", "comment": "Malware payload (Formbook)", "value": "bd744fa942fe638e9504ffba6378a84e9c8465bf7a7762bdf5cccf849abfbb4c8cf20882727bbf2d48aaf073c92391b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529433, "uuid": "ddddda53-80ac-41b1-885d-e90f8be65ef9", "value": "T157F401346BAF9139F93A1BBC85E42691976E73B35723C44D14B211CA4B63B038AD172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529433, "uuid": "4cd07b59-d770-497c-92d5-16e9e10e04ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529433, "uuid": "d0c6bd2c-ea12-4ab8-9cf0-1ed21ede372a", "value": "12288:qYPmYMUnFW/NyboltiAhtHTxePHsKyvZyc6R7IokYabOP76yfA5:qYPUwkziyHTypyBycMsRYabOPDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680529433, "uuid": "35233e31-771c-40fb-ab40-7c0de9f02e7d", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680529433, "uuid": "e13be6fd-b55e-4ae2-8035-0b8e8ba4f7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680529433, "uuid": "51f9d237-c2da-4d66-9686-497b9307d957", "value": "f22e2d1a6903ccecd271a8b287c427f4127f5966bf1761cf0a0e5071bfe93c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449906cf-d218-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680523719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523719, "uuid": "454669bd-7485-457a-b6c9-90801e87cb06", "comment": "Malware payload (RedLineStealer)", "value": "6eddb6f2e81d6160b7cdd6867cac590b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523719, "uuid": "9092af5e-c049-4c62-a76a-59967e18cc32", "comment": "Malware payload (RedLineStealer)", "value": "f3756567a9b209d5996cb00e4d53a6924512cfa362315ca31099974a6961a9d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523719, "uuid": "abb66fb3-8a48-469b-8536-1e171102cd1d", "comment": "Malware payload (RedLineStealer)", "value": "d8bdc4554a062d69bf01b1f82cb76f3cd5b8b0cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680523719, "uuid": "50a988e5-15c1-46c6-b03f-afa4cf02d955", "comment": "Malware payload (RedLineStealer)", "value": "bd12ea317bc74946e6c28d35fc4df0c5ea09302fb97490dfceebf346f7104dfed3df2146872a2206a59445be0cede366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523719, "uuid": "b93424c2-ac7e-409b-8766-1c88b53fc2d0", "value": "T170454B39BC51ECA3F091313E066075BC092BAAD386BDE4A7DE6C7D57AD110B1A319DE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523719, "uuid": "e294cb21-22f2-42a8-b976-6db376322b9f", "value": "6006a64dc74ce041b99c2ab005455ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523719, "uuid": "d0e522c3-bb25-4cb8-af58-38f946c4cbdf", "value": "6144:KXr6AD3KqrxLlAODnaoYz0cI0yp5snTw+BKb5J+sGNiq:KXr79BllnxYzFI0yQJBq5E5Niq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680523719, "uuid": "e1bc0c20-926b-48d5-b905-1135048fd8a5", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680523719, "uuid": "c23c03da-ddb0-4cb9-9572-4d1b9ac9892f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680523719, "uuid": "07213194-f297-4bce-b415-c693a6cfed27", "value": "Valorant SkinChanger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e94d3d5-d1f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1680508300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680508300, "uuid": "32ca9338-430b-450e-80ad-741712bdd37b", "comment": "Malware payload (GuLoader)", "value": "c928eaf8b88fd7cb250ba930589aad49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680508300, "uuid": "0036283b-31d1-476e-80d6-ccad71290c67", "comment": "Malware payload (GuLoader)", "value": "f548590defc2ccbe24f628129535444295460ede5f719adb540cf1a67bcae839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680508300, "uuid": "10583591-7348-4227-93d6-5e899e39eb51", "comment": "Malware payload (GuLoader)", "value": "98b609fee9e10f88fae9cc9547f6afdb6d03f48c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680508300, "uuid": "48c9157c-4df6-4506-b7c7-97e42dc115ec", "comment": "Malware payload (GuLoader)", "value": "f69fc3aa88050abaafc1a4368fba9135fa15d15b58676b4032befb03a53f6f8b38aab44b2b4fd54f0db93082a11de5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680508300, "uuid": "f276864e-d708-45fe-8273-0956cca30ce2", "value": "T1F3D4F10A7D10610ECD654A379C735AE21EB36E3D8DF45A2103FDBE5F88322967AAD143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680508300, "uuid": "a1e67477-86c7-435c-9b41-b651e0ad5189", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680508300, "uuid": "0f508a36-9f05-4089-aca1-49c7ceb33138", "value": "12288:vgh+G1bSEBF0NlTeHEPPyud/l2I7YKntfRChEa+CeKd8:4h+G1bSEz07TekP5/ldnChEjsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680508300, "uuid": "594d7dcc-edf7-4383-907f-cf3ca1be5478", "value": 630368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680508300, "uuid": "f83ca0dd-1840-4dee-8aed-08b164ac641e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680508300, "uuid": "6caac401-4684-417c-939a-0e51dbd9c1a2", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0191d1b9-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525324, "uuid": "9968de02-15a4-4acd-a6ae-c1c34c224931", "comment": "Malware payload (Rhadamanthys)", "value": "d9f5df77458b50352609525e0403d360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525324, "uuid": "0299a4b6-5dae-4849-9d4b-576f692a0589", "comment": "Malware payload (Rhadamanthys)", "value": "f56459cc06355bfeee43d3dcfbf5a82e90b81c364283f91721b3f89d49594bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525324, "uuid": "7acd05da-7fc0-4723-b053-5013fe9867bd", "comment": "Malware payload (Rhadamanthys)", "value": "ebd864f74852f1ab2f5ca9a6481d26cb04308620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525324, "uuid": "ac1ee3f2-13fa-4b71-8da5-15368e5f9189", "comment": "Malware payload (Rhadamanthys)", "value": "39c393ca524a85627f6501331ded9fa6bf9d0f6fdffab014326ed970d2804bca301aac2c184ea449bb532ab0fe57b726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525324, "uuid": "ecab3afe-ddc1-4914-9fa3-94629b4ca756", "value": "T110649E0352E46830E63E4B728F1EC7F4271EBC629E597F9B1675BA3F09301A1D962706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525324, "uuid": "f8d51b4a-298e-47c5-bd1c-ec8dfda9bd1d", "value": "1b6416dd291a09c30fa39a9eeb2f405d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525324, "uuid": "e1ef9ce6-3030-4ccf-85ce-42bbdbf2ffab", "value": "6144:n35OC+0vtSqPifVNAcvEAl4w9FNzGhk3Q:npOZ0vtSBfA0eCFNzGhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525324, "uuid": "4ac6b8e3-3b2b-4f3e-bc56-d4e6fd4539e7", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525324, "uuid": "ef19a7cb-c5cc-46a1-9bde-20868a2a0566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525324, "uuid": "36cd3b8b-c825-4589-aea5-c0b6466b37db", "value": "d9f5df77458b50352609525e0403d360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1890ef6f-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496157, "uuid": "ac7eca3c-3d6b-4688-80db-7504da7ecbb8", "comment": "Malware payload", "value": "b56f0b99270926ac9af1ef2b7f665feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496157, "uuid": "462ea3a8-2692-4f23-8d04-c046a387a365", "comment": "Malware payload", "value": "f57648e286f42707b3de476866f5908c48938a8ba563b78038c2f052fd4a0ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496157, "uuid": "57750ae5-59de-46bd-8c61-9a850664a6d3", "comment": "Malware payload", "value": "d5339477e1ce2b51eb69f26e41116d3f640292d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496157, "uuid": "eb279131-ba4e-48d7-a09f-792fa1da092a", "comment": "Malware payload", "value": "749bb0d4e3391aa1f01af217dff37edea06c3a2a593f83b01b2aa048c915b8ec60e95db890b93339276b8e3e4a99528b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496157, "uuid": "e302d610-4162-44d2-8e04-5c94fdcc2428", "value": "T15DE28D8EA96E2357D050C3B0222D23A6EF078CBE06745943EDD74A344277C8E6873CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496157, "uuid": "3049315a-96c3-4a43-9110-7b9f73e21fd9", "value": "192:SUxBepmrkAwkbG09fQUzNJqlIl/sx8LpMRWvenplOkjLr/pA5W6yoZXDKNGd9bJb:Si4AxbLfRNJqKk2MQeDO0/hOWFmKI+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496157, "uuid": "2baf51ae-c882-4abd-ad8b-46275af48663", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496157, "uuid": "0cacddb8-6e0f-461f-abce-b854367f0e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496157, "uuid": "2d413857-040e-4f4d-9d47-9afd0a5590cc", "value": "SecuriteInfo.com.Win32.Walivun.15500.24419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037024bd-d25e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680553674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680553674, "uuid": "bca852e7-be4f-40ac-9d43-30592945915b", "comment": "Malware payload", "value": "6232e4ed3c38e40e4a254dd9fe82f7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680553674, "uuid": "d811d9f1-6af6-42de-aa3e-7957714dfa22", "comment": "Malware payload", "value": "f5b1d7e5bcc9333f3af30c9863888bf734dfe7ba611db7934ce327020eb246af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680553674, "uuid": "88d26c7c-f1b0-4ae5-9e98-f01e6a4559db", "comment": "Malware payload", "value": "cc86c93188e665e5cf84acf03bcd47cc5cedc5f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680553674, "uuid": "5c648944-5bb4-4b25-9d0b-46647679d696", "comment": "Malware payload", "value": "1bdcb6e5561d213f9afe0c20cc56d2b551870c09b89e61a8c5a5b4df2f4f1d9b89c962ef388599bbdbb4e68bf7e24ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680553674, "uuid": "f458c9bb-f005-47e2-ac6c-e9b5b5a02994", "value": "T11BD58C8666AC81E8D156C235C4078E4FD7F2F8510F3997EF41614BDE9FB32A10EA9362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680553674, "uuid": "cb617987-1b8d-46f3-895b-f829c5326e47", "value": "d9b09d031c0eaa1cf5f3204e259feda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680553674, "uuid": "06899c4d-c0a3-4e30-8717-a6fe004b678a", "value": "49152:ZOWxYRZ5pJvZNw/ZMSjxT1+E8PmI/4bEb5P3NoRYmzxyR0/8ZJRj7:ZOOAJvcZEb5/ExyO/8XRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680553674, "uuid": "b94beb05-401c-498a-a387-8e5097ae4de7", "value": 2837504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680553674, "uuid": "6a740a14-cebb-4a4f-a1c2-6d4fa73135b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680553674, "uuid": "80b7c486-72e3-47a2-8de9-a856d961a522", "value": "SecuriteInfo.com.Trojan.GenericKD.66202931.8268.20540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22b0b41-d232-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680535096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535096, "uuid": "196ffdd3-0cae-4b16-bd59-59143b03cb94", "comment": "Malware payload (AgentTesla)", "value": "13ad17758e68bfb91cf085ef4774e9b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535096, "uuid": "f10d43ef-c675-41f5-bb3d-1df7b368c669", "comment": "Malware payload (AgentTesla)", "value": "f5c4b5612bc19c2caf01dba4a764a7c0d001ffbc6028c22ad3b30b8757e13cc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535096, "uuid": "6aa477cd-9c3c-44c6-ae36-0c84b3372b3a", "comment": "Malware payload (AgentTesla)", "value": "a7c834e4b39733808b7100cce150bb7f56b4eae8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680535096, "uuid": "9a7d9589-cfed-4d03-91db-48257f90eadb", "comment": "Malware payload (AgentTesla)", "value": "bcc4b7c478863a0c0ba4e4b9a036da583466253f6da94fe76628d1e9580e006e931f58af5995b847ce82b094d9c2d07d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535096, "uuid": "8c95335e-7ec8-4124-b97b-ff4f0646fb1b", "value": "T115F423002B186722C86E07FBA073711807B6BD67B852E33E6CE94DDB5D22B54C65DE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535096, "uuid": "6e32b3b6-6745-4be5-8e5a-8890a058121a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535096, "uuid": "445d6a34-44a4-4eb7-a8a2-4195a4a24f51", "value": "12288:15CBWKdq1FbwwJLwrtedxaSwpMmTb0qEWMEeRybNUvGlRqWmyVnei+ygAMiY:+frp5edxah0IMEe0iezqCuF51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680535096, "uuid": "e7b8cc97-f89c-4403-bc3c-e46ac94818ac", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680535096, "uuid": "b5a46357-d597-418d-bb56-f10ee7bd5200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680535096, "uuid": "1f789a97-cbf7-4c1b-aef7-4b3a218a62b4", "value": "SCAN-06-07-2020-1051-0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf4dfb-d257-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680550734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550734, "uuid": "6b2d0f25-301b-42ce-9f4d-f6ede25edbb9", "comment": "Malware payload", "value": "436f9295d0c0b800c3024eacc373a488", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550734, "uuid": "2f076502-c353-4219-9b3e-bbfb36e3a7a9", "comment": "Malware payload", "value": "f5d43378d020c27bfeea69b3b163f2d341237dfe3b26f34864b0b1d54e518922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550734, "uuid": "9b08479a-ac4f-4ea1-a156-8984d6814013", "comment": "Malware payload", "value": "7ed89d0b5eace657232595649118951ddd3895c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680550734, "uuid": "2673bd75-0be6-4412-9aea-ebe4fc7c59a6", "comment": "Malware payload", "value": "f9a2594a029d76beb6f8a20181dcffc972ac80847f6e74a0f36dd0688ce063b6794c71baa655209e44cc404489aa2a5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550734, "uuid": "ca6ee0c4-940b-4dc5-b337-a6ab201dfd4d", "value": "T1D8D3843E7A12ABBEE2A8823107F25F708F9521D367A19345E27CD6985E7128D1C8F750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550734, "uuid": "61c2a946-4be7-4889-aeef-30748f6bc9c5", "value": "3072:/ZqFo8x61DDko8x61DDBKrQMAEsjj6zbM5vGaVCJ23K3MbHry6celYTgAfZHXPh6:QdtcI5prmW+IFB16t1hJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680550734, "uuid": "279d8e8f-b037-4094-b659-c05a7ff79185", "value": 136816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680550734, "uuid": "71448a4d-fa8c-4521-87d4-f082a4eb86c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680550734, "uuid": "3a0d34f8-1aae-4d24-9e56-9b2e2b46de9e", "value": "436f9295d0c0b800c3024eacc373a488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf9ff37-d248-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680544347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544347, "uuid": "30fc8ea8-bcc8-476f-b399-ecf119502021", "comment": "Malware payload (AgentTesla)", "value": "efa78a436a42c9836b5da67743e46f2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544347, "uuid": "ebf173b4-da02-4d2a-a9fd-10d7271d2625", "comment": "Malware payload (AgentTesla)", "value": "f606840c7d19d6b6bf9fa6fd7cd6df5856d5b6cdad43380f32564dc83b5ce88c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544347, "uuid": "9a6b853c-3127-4cd7-b27c-78c94c7759ab", "comment": "Malware payload (AgentTesla)", "value": "a3e4d8eae0429e16b65e3c444e566a8410ec2e5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680544347, "uuid": "dbe2828c-98f6-4b5d-bb20-9c3bbcb67e8c", "comment": "Malware payload (AgentTesla)", "value": "4e74c8a6e29a73862dbf199577e078d4949263020ed05eb7b92f22ce3aa201a41e77cd9886ff128c5470c81d4caa67bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544347, "uuid": "88d21c79-569e-4cfb-9219-686f277d135f", "value": "T1C7E42321ACD7B237582F2971B096BB3FFA037E63AA51F2D702172681B5701596EC53C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544347, "uuid": "c47be841-1be3-4616-895e-5790c3863376", "value": "12288:BBCvSmdq1FvCssWxNy4I264HYP+JN86l8wG5oZjbUgPy7xaBmYhx/wLsdlhLC0iq:8xlssWjy72L86l8weo6BKmux/3ByXavj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680544347, "uuid": "5aed908d-8598-439c-978c-514962317b0f", "value": 690265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680544347, "uuid": "f2d7d03a-3627-42fb-bbb8-ab3d99268a65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680544347, "uuid": "54631175-f0f9-41e6-b3cd-743e3f3a688c", "value": "DHL_AWB_NO_#AWB 4906300000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467d9a72-d213-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680521574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521574, "uuid": "ac00efa2-e566-4fa2-90b1-5ed688220ca8", "comment": "Malware payload (AgentTesla)", "value": "82c6be495be71b2c1088d9edd48592a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521574, "uuid": "ddc2cc17-3066-45ab-a943-7ce8805c7338", "comment": "Malware payload (AgentTesla)", "value": "f7097b6e816feb26eabe4231e5dfeae2a8a3a6faab8c4a97146ef7afc67d17d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521574, "uuid": "c03401a7-6319-45c2-89bc-77834258fe13", "comment": "Malware payload (AgentTesla)", "value": "bdd6ab76fbb5af5efead5fa697c2456b665451c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680521574, "uuid": "d8a8d04b-7752-4248-b092-83c62ab98baa", "comment": "Malware payload (AgentTesla)", "value": "75862d748342b11b20f1fd1fe580e45abdf8d2874c862c6a728a2cb1c4fb0f1d2770facb9093c99783f8804511c03ca5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521574, "uuid": "d6096de5-02ab-464d-83c3-c0c609d94019", "value": "T173D4021CBDF9A537E9BA8676089003405F325239613ADFEBCC55B0C83DA3B85A9F0657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521574, "uuid": "054459fd-4169-4964-a292-80c230baf19f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521574, "uuid": "74f78c83-e50e-412a-b7a7-4a304bec4daf", "value": "12288:83AGUow8J5Q8KpduJwtJG5KVXvwARTAWtQiyQT4W00HmGR6B:8wG9JxzMhwAtVHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680521574, "uuid": "db8a4915-3a74-42eb-adb8-b41597dffbc4", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680521574, "uuid": "5d656343-f008-4d15-a23d-91fcf8b8d7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680521574, "uuid": "a6635574-1b0b-4b4b-b745-8c6f64eaaad6", "value": "RFQ NO 012594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250765d2-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680525813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525813, "uuid": "098ded5f-580e-401a-9cbd-74e78ae2d8ec", "comment": "Malware payload (DanaBot)", "value": "457c7a3bbebbc47e3fc7b69551f23573", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525813, "uuid": "4d486b6b-8867-4f29-9d2e-8006ef124dc2", "comment": "Malware payload (DanaBot)", "value": "f716cc31bb41a40f724e501c9f1bc6b0474e85023d5e888475dad440d4f30466", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525813, "uuid": "0ea51320-1a7c-44d3-bbf5-7d72f34e7914", "comment": "Malware payload (DanaBot)", "value": "93b32f0febe4924593a54373a231c42ab3d57328", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525813, "uuid": "ccc4f325-266c-446d-84cb-a26d169d81fc", "comment": "Malware payload (DanaBot)", "value": "270b6407bb627b787806b9ba9415f5b32c9c32ee9d125adb4ed98240e28fff0cf222e5b0dd6499ddebbbf2970efc765d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525813, "uuid": "0ecd7e05-1ab7-41f4-9ead-500238afef8a", "value": "T1113633337770C6B2C2472E35B460D69C363370776A7A8B8E735D582A0F681E3869729D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525813, "uuid": "41ebdd89-e07f-43c2-9995-49cf3fc9b802", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525813, "uuid": "ee1b2ecc-5b65-4e10-807b-c472baa16da7", "value": "98304:LodHV7fgRQcIa4KLMCgYTBge3DUs+8Kh383CcE:sfgTkCgYT2eTdcs3Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525813, "uuid": "4ae201bc-0d14-43da-9313-98263184e1c3", "value": 4899840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525813, "uuid": "2c9758bc-b6fd-411b-ae13-68f15ad45139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525813, "uuid": "ca5521c6-3672-46b7-8e07-ddcc97f141a3", "value": "457c7a3bbebbc47e3fc7b69551f23573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ee1191-d21f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680526670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526670, "uuid": "e7beca85-3c10-4d28-8030-7784cdfb3dab", "comment": "Malware payload (Gafgyt)", "value": "356ac0eaf8f46457235a55ede70beffd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526670, "uuid": "154b9c93-30af-4692-baec-b550a3e1aa3f", "comment": "Malware payload (Gafgyt)", "value": "f76a7196905234bd49cf73f736a043883ac5762c83f485355500ecc88ccc3d7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526670, "uuid": "66c96835-d6ac-41ec-b31c-0be0a9c15ace", "comment": "Malware payload (Gafgyt)", "value": "51a34eac4608c207bbba473faf1bbe9aa1034912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680526670, "uuid": "0c7a497a-7442-4a72-970e-b7cb54e3151c", "comment": "Malware payload (Gafgyt)", "value": "28a60fedf7d82565c16dd124334e1f606c58be22cf4923d3105015f676a13f5b86f945322fc7db3df292ec9ee09c3a91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526670, "uuid": "16418643-507e-4416-85a3-dbf4f3459648", "value": "T154933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F390987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526670, "uuid": "ebaea324-e2a8-4007-9ba7-5b83a1170bcf", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emeGMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8rkeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680526670, "uuid": "8ebe35ed-eceb-4fc6-b1de-a140f52df419", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680526670, "uuid": "4827be6f-88f0-4819-9cd0-ed0ad8e733b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680526670, "uuid": "c1df12e7-6050-46d1-acc0-411759182a0f", "value": "356ac0eaf8f46457235a55ede70beffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a364c257-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525596, "uuid": "ab7784bd-cce8-42ee-9f97-d91d633b6f1b", "comment": "Malware payload (Mirai)", "value": "b86787f16befde95beebf6f1d78ebd1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525596, "uuid": "dbf8bcb0-5e9f-4c1d-99b5-c2b260a7620f", "comment": "Malware payload (Mirai)", "value": "f7eb0a8b1209cd2c0d4880e793f78d848eace95a79154f0873ea599281b945b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525596, "uuid": "ba2a3fe3-6ca2-4be3-b533-74cadf937363", "comment": "Malware payload (Mirai)", "value": "76c471353499105d5ff35c2f132d251b48b4b7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525596, "uuid": "c41df98b-4a41-400b-861a-6932bf319748", "comment": "Malware payload (Mirai)", "value": "4e51108a08933b3e334d780be679a5c214fc7858759bd4656d68492fb9f425946e4f6253fdc5693e80f746a2d95fdefa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525596, "uuid": "649c82f4-3c34-49e4-9431-1904f37cc151", "value": "T17AA2D025D345AEF4DFAF9D9492C1C2C27AF547C6278AC8E340FEBF016606046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525596, "uuid": "ba196f9d-9a69-4a91-ba0a-445f025f17ef", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5pyM4uVcqgw05VxJx:9RxsSVsMD6xiJJE5zRWNjp4uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525596, "uuid": "8ac58a51-cc15-4b8b-b4dd-b2d765c86ab0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525596, "uuid": "9eb93a1a-da3d-4779-a70b-37edccd5c7c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525596, "uuid": "ebb9484c-c8c6-48fe-b062-73d577fd1af6", "value": "b86787f16befde95beebf6f1d78ebd1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839cdd73-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680525542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525542, "uuid": "dbc8dfd6-ea0d-4004-9666-9cfb32a534ea", "comment": "Malware payload (Mirai)", "value": "90c0fd8539fff448dbb6aebb3468f034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525542, "uuid": "7f4279fa-05d8-4eac-af50-d42295f1db83", "comment": "Malware payload (Mirai)", "value": "f7f9667ee7c360d752fd4c2109f78e87faca02826e116f0ac147648ba7f1a70f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525542, "uuid": "075b92f4-892a-4ef8-b832-eb1c06c70375", "comment": "Malware payload (Mirai)", "value": "c70a72f5c37348ea8556d368180a3841a689d4cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525542, "uuid": "6b530c24-5444-4fa3-856e-fac1b83a3016", "comment": "Malware payload (Mirai)", "value": "7248efff0bae1058bf66f484510f9fd3946c24272559a09882d496b8c545b60c9134450e6e57fbe5613ede59b3aeb148", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525542, "uuid": "a81fdcf7-a68a-4698-b5b3-e3edb2482402", "value": "T1D8B2C0CC61543084C94D7C7C178D4A675F6CA1D0BAEE9B26E354CDD8B3B9A4F3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525542, "uuid": "b1b99de6-c74f-4e56-bf91-9190c0436e1b", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpp5ZqSWv3:4QlS07FUXqIYSXQKqupvqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525542, "uuid": "d7475022-252a-4991-a156-def861a657a4", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525542, "uuid": "2b56bb9c-4fe7-4782-b234-da2db6c6999b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525542, "uuid": "00c20de8-4495-485f-abb2-327f351cfec7", "value": "90c0fd8539fff448dbb6aebb3468f034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056c64c9-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496125, "uuid": "df6d51fe-75ec-4b4e-8afa-58e2f0091d8f", "comment": "Malware payload", "value": "e7d53d7ef658669b091af796de0c6ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496125, "uuid": "0cf14c37-9aa6-4196-ad3d-e6ef86f1efc4", "comment": "Malware payload", "value": "f8bd9d5c4e36a3605cd8bee6d75c3d97b394dc4ed0b8ca7ac1d94cc597d25dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496125, "uuid": "ba95331d-b4b4-47e0-8f0e-911b4b4025b8", "comment": "Malware payload", "value": "064d8a62fb0381282d7b23282bbb2cedc631bc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496125, "uuid": "f3abe253-d9e3-4146-83f7-962a3af6ed8a", "comment": "Malware payload", "value": "b5e04ebc754939a8da9bb22a185ddd30167677a1f913ad3c08c6b8259d43106040846ad96269cc25333d4f1ff3a51183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496125, "uuid": "c58565f1-4255-4d1e-9507-b39f115b7f5a", "value": "T1A1D49E1377F1A041E8AB22F14B9AC36DB73ABC386375974B1A903E561350D079B3AB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496125, "uuid": "394be6ed-c0b0-4cb5-8ec7-39c9a64814d8", "value": "12288:8Wbch62cIwrw7L+MdIzUqAgiIqVfhpUQpUqlQFbG:xbw62cGldIzUqAgizXuQioQFbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496125, "uuid": "8472af34-b068-4ee7-a326-3d41747a5656", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496125, "uuid": "2ebb9adc-11d6-4848-9e76-26c068887ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496125, "uuid": "dcbf0eb3-3361-4819-8500-548bda111b34", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1318457.7411.31780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91001fac-d1fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680512250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512250, "uuid": "e2b1030c-705c-4d47-b9d3-4b997ce5ba15", "comment": "Malware payload (RedLineStealer)", "value": "4a6039bfdda3a74030d78acb4ff14829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512250, "uuid": "506f7128-2acf-41c5-9fec-3a0a10f450c8", "comment": "Malware payload (RedLineStealer)", "value": "f9a34a14c69e1c21529800bbdf4b9d7f357d3105e41acfb0aaca1b9d22122893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512250, "uuid": "69c86fdf-3456-441a-89c7-8d04cec85969", "comment": "Malware payload (RedLineStealer)", "value": "02c677386d03c4eeb4cfa0d93eef58952f197876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680512250, "uuid": "9a166494-769d-4639-929c-49625366a5e5", "comment": "Malware payload (RedLineStealer)", "value": "0c2ca9e1166fedae4d21adf2d818e66a4b7c8a2158035e8900526275b4345a0d75914ebbbe59b8e0560144c93594c9ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512250, "uuid": "d8bd8e40-abad-4b9a-b033-2e16aba4b90a", "value": "T1C3852302B9C5C9B2D1A30832567A5B11A93D7D202FA6CDEB73943E5EDA71AC1C3317B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512250, "uuid": "55da379b-b506-4c78-9752-fc8b4bf4540c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512250, "uuid": "42d99abd-b064-4af9-abcd-a0fc725ae440", "value": "49152:IBJhlk9ZODpsUr4cmoq2OwqcY1DkPipZRr14h1D:y2fU2pcmoMr+2Zne1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680512250, "uuid": "e4cc8b11-66eb-4f3c-b52d-a66464b9f544", "value": 1759904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680512250, "uuid": "718fcf9c-e3d4-4561-88fd-0c79ab287750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680512250, "uuid": "e1b47c18-2e45-4fc5-858b-93f2e8f8eeba", "value": "4a6039bfdda3a74030d78acb4ff14829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0565f904-d20e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680519318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519318, "uuid": "da0b45ee-b634-4b40-ae48-838a87e95776", "comment": "Malware payload (AgentTesla)", "value": "3c308e3cdaca76b70e3f528f38e95253", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519318, "uuid": "1249b64b-fd6d-4e95-9516-336f511aeabc", "comment": "Malware payload (AgentTesla)", "value": "f9ece6c41ff8aa96a976a4767083a72679eef6d85fb0abb4d7a1b19e6dff3a44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519318, "uuid": "e3aa5b9b-8a24-47e6-a08a-86acc2564f42", "comment": "Malware payload (AgentTesla)", "value": "9225348b6c216c6bbb3370450d27ca3d6c239b7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680519318, "uuid": "8a1ba8eb-773f-4401-8b0e-804c363d3421", "comment": "Malware payload (AgentTesla)", "value": "a2ac21db48db5dcfa3250caa3af5cc1803710c7c9bca715df1a79d88d153396d5e36cf0a8db7944a1d11d186a0d56c45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519318, "uuid": "1f5dff4b-506c-4600-ab68-2a7af8d1ceee", "value": "T145F3496C92F98F12D71C41F4C5A0115816B2A1439617EB9E4FF1A8FA3E4A3D3362EC76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519318, "uuid": "43012114-c325-4e0e-addd-b49ef4ee776e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519318, "uuid": "be0432bd-8af9-43c9-96f0-9b0102562040", "value": "3072:R7x26ZcR7vy21qrIclCpWZjefQ2uLITFaQRKl1jPEFiAKR:i6q7qkKIcopAjcukhjKlpPZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680519318, "uuid": "2bb98dfd-55ef-40f5-a0d7-1f8a5b5d042b", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680519318, "uuid": "42f962dc-3a85-4005-b9b4-27af8b5b3cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680519318, "uuid": "fbf2a314-face-47cb-8603-b0cb59960ae7", "value": "f9ece6c41ff8aa96a976a4767083a72679eef6d85fb0abb4d7a1b19e6dff3a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b056d243-d1e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680500706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500706, "uuid": "53597984-6d1f-47cf-aa7a-268d28f5f908", "comment": "Malware payload (CryptBot)", "value": "9009613f9a20e23f94c6775bc6129bbc", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500706, "uuid": "e930af56-9bf8-424b-adf5-31f2ea2f485d", "comment": "Malware payload (CryptBot)", "value": "fa566d1c34190526eee9627c39515faefa3f87712e394f963baf01aa2ce65f9a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500706, "uuid": "fd122ec0-d860-455b-b71e-567cba983da6", "comment": "Malware payload (CryptBot)", "value": "4682ea3408648d859fd5ce0ef7acdf9fed06733f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680500706, "uuid": "e9592308-5cf4-4cff-912c-8b2c6c4b662b", "comment": "Malware payload (CryptBot)", "value": "27b7a62f463e65aa38701393b864c155c4348dd29c5b2c04d57c3c3138dda228c5f6846591328a8f8f91fa57507ee3ea", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500706, "uuid": "88b8150f-15a2-4add-bb85-02b0a9615f59", "value": "T10E065A38C0325F97E84352B0F45A505C384EFE8843A4A2B5AB554CEDE1BE550BFAE46F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500706, "uuid": "dd1986ce-675d-4c4d-bd6e-2963ac3f1bc0", "value": "c619cf85c1f54eb17034f1ff57904fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500706, "uuid": "a8d76504-0d62-4a2e-b5a2-0f70007104b1", "value": "49152:clYt2bLRRrcT4Ag8TyAU6775JKVQxbiam/i:EDZ/8e6x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680500706, "uuid": "7708cd01-25fd-4fa9-8167-ba294eb8bb73", "value": 3735552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680500706, "uuid": "f85f19d8-ddca-4419-8431-de160d57dd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680500706, "uuid": "bdaed5dc-4a50-4d8d-8f25-5a4afa8fd7d4", "value": "9009613f9a20e23f94c6775bc6129bbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120dabf5-d1d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680496146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496146, "uuid": "652c4e04-ff59-409a-b6fd-07d650bcbdd3", "comment": "Malware payload", "value": "e26f45b71993cb58c729ccd5b8f4d5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496146, "uuid": "86189617-ccc9-4ec0-bdfb-738aea2fb856", "comment": "Malware payload", "value": "fb0125b2e3513067fd71268e1ff1cf222cf399b92dd8bbd6fee7cfc9657980f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496146, "uuid": "31d5c57a-8b8e-47ce-bb48-b372ab916e0d", "comment": "Malware payload", "value": "7c9c9be87059314f61b60a013d2ff17fc60deac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680496146, "uuid": "e0d187e2-8cf6-471f-a41d-4303367a6df6", "comment": "Malware payload", "value": "de17f36bc72cdde7ba146dcc7fe65c6d5f7fbad9694568b996369a46a64c6261e37495e010a580d2c880b8714a3be49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496146, "uuid": "4bd61288-f0a3-4553-84e0-b739990278e7", "value": "T1CF939213FA248309F55900B865164E6238961E38B415ED67FB81AE8D2CB5BC3BCF5B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496146, "uuid": "0e599c97-b464-405b-a433-3828bdc4e87a", "value": "1536:eyeMBsVg/Vj4dAWKMb74Wy+u/OR0ZXHpIUQY8NMQO9fPkuzu:eGBMg3WKMbRy+2ORSEhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680496146, "uuid": "d62d5c3d-4789-4bb4-843c-84b7f4b403ec", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680496146, "uuid": "b52d2ccb-552f-4f9b-bf5c-35adfd53b81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680496146, "uuid": "29706892-62fb-4266-97db-47e7f10cbde6", "value": "SecuriteInfo.com.Win32.Evo-gen.22154.24552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6b7f78-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680525527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525527, "uuid": "79fbc0dd-bdda-4ec8-843e-f11e1a8f3532", "comment": "Malware payload (Gafgyt)", "value": "7678e0489746e43ee67c8ff66c3927de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525527, "uuid": "2e2d5252-9930-4936-9ce3-11ffa8f6173e", "comment": "Malware payload (Gafgyt)", "value": "fb07ee1143dd5229faf1453fa8834d88f5bf1eab77ed73ad623cac70f619c777", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525527, "uuid": "d1e65e93-b536-4b1d-b461-ee8ba8683ba4", "comment": "Malware payload (Gafgyt)", "value": "995e3b17ad49c7bc276011567e181d31c7200ed7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525527, "uuid": "d9d34fe3-b3d2-4de2-a2fa-5e1ace91b7e4", "comment": "Malware payload (Gafgyt)", "value": "ba70788a4e9790f2ab328cb88cfb1563679af984766fb49a8bad02a3941cbb1eb0c4b033bf8ab48cfb205f883d3417de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525527, "uuid": "d77524c3-aa8d-4bf7-b218-cfbe6e3f4663", "value": "T196C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525527, "uuid": "018b3074-27b9-4a28-b500-fbaa022227c7", "value": "3072:H63VpNeuWDGeQf8sRCLt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCLt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525527, "uuid": "33230bae-d0c0-48a3-9fba-85455933b399", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525527, "uuid": "5ecea8c0-3791-41b6-ac73-6c6306783ef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525527, "uuid": "65705dba-92cc-4917-a29a-0143a3309756", "value": "7678e0489746e43ee67c8ff66c3927de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fad03d-d21d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680525820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525820, "uuid": "be54d888-4089-4457-9ba2-57582acc56af", "comment": "Malware payload (AgentTesla)", "value": "a2d66e4146380e9e6567abc6e21747dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525820, "uuid": "efa7be1a-6923-40da-aefb-822fd9b1b557", "comment": "Malware payload (AgentTesla)", "value": "fb373eca894b2523afbe1c0bfb7df775820e458d493a1e6df94e5da79ff7e232", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525820, "uuid": "c2af3685-c1ab-4698-9182-b768fb229465", "comment": "Malware payload (AgentTesla)", "value": "fdb55f6cd135427979b8b1d13a7257cb44ca0273", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525820, "uuid": "a6ee9e4f-af49-4c25-b408-fd41e2e275a2", "comment": "Malware payload (AgentTesla)", "value": "82af0e66913df138db0c2238bc30b1160605c3f788e2a1c3aa4b419fc66824ac314b3d1ee1399763cdb6fc3aaa9b47b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525820, "uuid": "7b66b26e-0d2e-4edd-8ba1-73ca7da51c69", "value": "T160F423192B1AF332DA7E97B76093511843B4EA171053F37E5CEB68DF4823B848A91D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525820, "uuid": "3fe59b76-6928-4d50-b6dd-1399af186dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525820, "uuid": "e2b60253-3e68-48ca-a3ca-4f3dfaf72a79", "value": "12288:C5CBWKdq1FbwwJLwre7d7u/wweahzyUX6FHCBDzpGey15KZ2ZLZiAXx:tfrpOopeaZJ1z215eqzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525820, "uuid": "83371194-f696-4829-aa86-10b4d283f6b7", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525820, "uuid": "43576676-820e-4aa7-a99b-472b5026b1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525820, "uuid": "ff252816-e309-455d-b887-b9a9cc72f867", "value": "a2d66e4146380e9e6567abc6e21747dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d584b4-d223-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680528418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528418, "uuid": "f1225ea2-6cee-423d-a45c-ab15b5a7905f", "comment": "Malware payload (AgentTesla)", "value": "1d2e530be1bc9a98c41429524a89c79e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528418, "uuid": "2b2d5627-3e89-4d26-a510-dad511c1bcd5", "comment": "Malware payload (AgentTesla)", "value": "fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528418, "uuid": "52329fb8-1782-4048-aa0f-634b4e449528", "comment": "Malware payload (AgentTesla)", "value": "bb11e3ba94fccdd21877c7180298c1df4f22d56b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680528418, "uuid": "c30e25ad-49d6-4f48-bbe4-c288aa05c707", "comment": "Malware payload (AgentTesla)", "value": "f869ee7797dabcf38cd3ebb2b8f8609a86030fa6acad3fd5853464ed1d2447b34c74aeb483d79cf03b56c518971d21d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528418, "uuid": "e9fa695e-712a-4484-bb38-e9dfcd2f3645", "value": "T11625C4AC366432EFC467CC72CEA85C64FB90747B631B8607906F11AD9A0D887DF151BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528418, "uuid": "01907adb-7b0e-491a-a182-f7839ed7b13e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528418, "uuid": "ad26339f-78ed-4cc7-9ba1-591009413893", "value": "12288:tUERECXjZB22OBZSw/dSamjZkyywVPjZtYx2jal5+MDfoRVmhOAPxysgzfkBKQza:tUSRz3LOjt/mywVr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680528418, "uuid": "2b73c444-7f23-4914-8319-798b8e04fb54", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680528418, "uuid": "846d5b57-5cd3-481d-9f24-3f27643a5134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680528418, "uuid": "b0206783-c250-4320-87a7-3d34526a5681", "value": "1d2e530be1bc9a98c41429524a89c79e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad5c690-d220-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680527058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527058, "uuid": "daedfb48-f852-40ae-b1db-479398a57a3f", "comment": "Malware payload (AgentTesla)", "value": "feb570bffcd8d8ac2065edfa8117217c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527058, "uuid": "cb37ca18-9809-4d76-9a6c-f4e1bc310a55", "comment": "Malware payload (AgentTesla)", "value": "fce3edc1cf76792c761a9acddd97fc3700db91a23926491cfb3e00ca4eea234a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527058, "uuid": "d5e7edc7-b69c-48e3-a38b-56be15943d2d", "comment": "Malware payload (AgentTesla)", "value": "3eb75d1f94f1e219ee465e2726d49a315d5bba2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680527058, "uuid": "eba38732-cd45-408b-8d2e-651ae8fb2858", "comment": "Malware payload (AgentTesla)", "value": "f076818780d09e5a3266bf35f9346eb54bcf1b5d51d8d460940d9543ed5abd9257e7571f982cac692ce071b75f1e795b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527058, "uuid": "28c7f3ad-f00b-4db2-8a97-aeed68c6a386", "value": "T1A105E09C3120B5DFC86BC87699A85C68EA60747B971BD213A05709EEDE1DA97CF004F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527058, "uuid": "33a8f35f-49bc-4c08-aa25-bfbd70c287bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527058, "uuid": "ada84408-b60b-4496-92ff-23955a41114e", "value": "12288:A7L5CBWKdq1FbwwJLwr3oJin2jmf4H2QjBJ6KTzbzWvkE+KTIN3VMkJkDPImZDO0:1frpcpjmfW6wzWkE7EMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680527058, "uuid": "c463122e-b9ef-452d-b601-aa16bd94aceb", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680527058, "uuid": "edf74ab6-0412-4a5a-81a9-37b7268afa2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680527058, "uuid": "3d9a503e-016f-48dd-acad-564dfd005d04", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6717e246-d21c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680525494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525494, "uuid": "6a72d2ad-ae9e-4eb6-a75e-eca33dece4cf", "comment": "Malware payload (Rhadamanthys)", "value": "d0a8e9383b3e36dee5f9222f827c7615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525494, "uuid": "a2c7269f-f242-46bc-be7d-e0a777170252", "comment": "Malware payload (Rhadamanthys)", "value": "ff500d61a43e135f0b3ca48e8c9e760e6d08fc0d9fc9b36ae7790dc2dbfba071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525494, "uuid": "afd0431c-f91f-4490-8fca-3b0bc95ded06", "comment": "Malware payload (Rhadamanthys)", "value": "516812f265f8b3ce1af787bfa1dd1bfeb426e2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680525494, "uuid": "6b756f35-1e2b-4be9-b69f-8cdcb872b0b7", "comment": "Malware payload (Rhadamanthys)", "value": "91079b4955b351a3b6730e79faa836a8b50beccaf443f687bef3626480725513fcda71cb67c4062e6803eb3c169bd9e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525494, "uuid": "c5aeabb4-525d-47f0-89ae-54264317594b", "value": "T1A744E1A07BA2C4B1D81785787822D7B0663FF8719FA1C68F33981B7E1D702D15A76226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525494, "uuid": "e71feb5d-ae76-4879-b4a8-fb15382ef374", "value": "93af49a7eb518a2e0b7bbbb909dbb2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525494, "uuid": "51e20f2a-68c4-433c-9879-c7befc1954cf", "value": "3072:tHYBEo83Gk/hdEdqaensiWFwV2JVZWmDNncsW5fkD2/O9iT1QPS5/8QS:6KP2g+0eFzVDZ+Six8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680525494, "uuid": "1f471a59-3981-4a1a-915f-956aa756a676", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680525494, "uuid": "f839996c-0f5d-4153-9cb3-fbc3938318cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680525494, "uuid": "6dfee7e7-16c0-435b-82eb-e5dfa9e21475", "value": "d0a8e9383b3e36dee5f9222f827c7615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee2cf30-d24b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680545667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545667, "uuid": "dcccadd4-2347-4311-99f5-da4dab25c9e4", "comment": "Malware payload (Mirai)", "value": "1d442906c388131e3998354599553715", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545667, "uuid": "57dc8193-cb6c-4824-b517-c4913a2265d2", "comment": "Malware payload (Mirai)", "value": "ff6e50854ba0ed8a3c1a28f0558b09996daddfb9fe6e81a25eab90952b0b8524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545667, "uuid": "894ec9c4-28d3-4550-a029-ab81f875fe6e", "comment": "Malware payload (Mirai)", "value": "d39c4015fe1c0f841f56ca6670cb26104b8a1122", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680545667, "uuid": "f605f44f-1839-4502-b001-34b6b2680d66", "comment": "Malware payload (Mirai)", "value": "0af962874cd93fe3c5ee51a996c503fccc2591910471d76c34e881df672fb5ad66aba5d30b864b2791860a30fb39a711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545667, "uuid": "4435ed7a-b77d-47f9-a0be-dca802ae4ab2", "value": "T107436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545667, "uuid": "6df5523d-d8f1-46e6-86cd-ffd28f8f374c", "value": "1536:JeESt/basV2rcZhG6ySN7nalRe9xzWOIaEjrqMjs:JeESt/basVTgS7nalw9BtXESo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680545667, "uuid": "da9f44ab-b44d-4c02-b626-b2a9874df0cd", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680545667, "uuid": "c12c811a-e03b-4c7a-b987-5bf545452cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680545667, "uuid": "ddc4d847-1759-46ee-bfb7-f24d58883aa2", "value": "1d442906c388131e3998354599553715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ef2f02-d214-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1680522114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522114, "uuid": "b46eff41-a02e-4e2a-a931-3ef9ca2931eb", "comment": "Malware payload (Stop)", "value": "79f43585713826adfdf355a915889d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522114, "uuid": "f2a0b060-759a-4c54-b9d9-42bca60c37ff", "comment": "Malware payload (Stop)", "value": "fffd0a4ba42e48bbdad90b34359c97008f0ffc788750d41b9df18e31a480d7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522114, "uuid": "bf2268db-f356-4fec-a45c-e5cd88004d24", "comment": "Malware payload (Stop)", "value": "04234be016704b089984b1522b6cab44f53c9ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680522114, "uuid": "5d00adc2-ae39-40ff-808c-4423a298e677", "comment": "Malware payload (Stop)", "value": "8ffc7ae83a8f42363e816f110a6a30f1ec3801b76d645219851e52175a2e04880d69ef28ba88762fddea3f70ee1f9da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522114, "uuid": "6e04e54f-4b95-453e-adb5-bd900eb79d36", "value": "T16DE41231F9A2D17AE06B15752426CB619A7FB4B1979286C733084BAE0F747D02F3934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522114, "uuid": "689c4137-b392-4472-ae5a-6665192530a2", "value": "0ee9a5ef4366f789036d2435034645ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522114, "uuid": "784aa8e8-886a-4fb2-b724-e8478549e08e", "value": "12288:pEbcK6f3AohNYnk3GeKLknj8QIah2cMSN7Fc1NK22dQRqrJW9vC7g:pEbh6Iohyk3SLuEad7S1Q4q9WEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680522114, "uuid": "a084d606-151a-438b-a25f-630532fcf081", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680522114, "uuid": "7075f6d9-bb25-4fa6-9616-3a0a973f09ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680522114, "uuid": "78021f5c-4fe7-43b3-847f-3d87bec5c8ef", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }