{ "Event": { "published": true, "date": "2023-10-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-17", "timestamp": 1697587382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b323a97f-ddee-4abf-898d-d4fc3dc89279", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f4f486-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524089, "uuid": "d7431f4d-52aa-4d2c-a051-0feca9e3d614", "comment": "Malware payload (AgentTesla)", "value": "bfdf5c6ffbc15820dc5d5a6756ebfc25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524089, "uuid": "ec793e95-e171-4f03-8a3f-bd5cf04bd9c0", "comment": "Malware payload (AgentTesla)", "value": "0007ed17b3ce378e3bb495b06bcce6f79e8292ebe4e3ed913b708aeb70640f44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524089, "uuid": "19f41a6a-0972-4af6-bc19-132bc134038e", "comment": "Malware payload (AgentTesla)", "value": "7b709a3b7356de2d3aefa9095096af1c732c3e07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524089, "uuid": "30cdf75e-9886-4d58-afc9-5bfb9a5f3a2f", "comment": "Malware payload (AgentTesla)", "value": "e298ccbf00112db847197f47d55f5f80b0e0dec84dc82baee789ff4386d601efc219f73b0522f5d5badf322fa6e9dfaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524089, "uuid": "15543f82-f2c6-46a0-8b5e-0daafb56b003", "value": "T10614E152F6C2C915E91647364EF697EB2322FC416EA3874B3358B71E6AB05C08E13727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524089, "uuid": "762c8745-abd6-4070-a877-3849ea04b260", "value": "6144:uY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVsTga4vxlGN/rI7Q:n3bVsTgZa1rI7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524089, "uuid": "f99b62d5-c1bd-4592-93ba-8044576d5d64", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524089, "uuid": "ca8b04dd-0c21-43b0-9970-e882757c9903", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524089, "uuid": "f6a6dfb7-9feb-4fab-9849-b06df720ffb3", "value": "MEHS QUOTATION.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38b68e0-6ced-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697547840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547840, "uuid": "c444eb60-bbe0-48d8-a98e-312a05999a9e", "comment": "Malware payload", "value": "1127ea3761c05f4922afe99b82449caf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547840, "uuid": "f430f583-b43e-4d54-9415-f50f60f6b2ae", "comment": "Malware payload", "value": "01387012295f6839e3e0c37ddabbb11481c95dfc304723c326962a5359c99316", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547840, "uuid": "69eb3fe7-507e-4c35-a02c-0e60ed28a6a1", "comment": "Malware payload", "value": "276b0e437756db57a095639ea7197b644184de1d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547840, "uuid": "0eb08976-ce61-49c1-9fb9-ba15c5675f5f", "comment": "Malware payload", "value": "d98acecfadacc6d9f56a02a2e22a7359af8500170bbc926209590af86f9707dddcc174b10613d0904466358868ed290f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547840, "uuid": "66dfb35f-efbd-4df1-96c2-bcc751fbc229", "value": "T12061F97C9128AC12EF6300F762BBBDE7852BF19202C7A0C55104ECA101BF157DE16E57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547840, "uuid": "b3205269-bc49-4ebc-a9c5-3bf9aa43471f", "value": "48:lzmS2IayY2TFKviniFrWsrv40HLkjI1o1KfgCsZOcNyxonGMFubtWdF5S4sTTBc:BmSzNuVFrdj4MoMoKg+caonGMF3dS4g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697547840, "uuid": "fc6b23c2-79da-499b-9652-6b4193dcb421", "value": 3321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697547840, "uuid": "8aef87c4-19ca-44b9-bb7e-19a20fdb956f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547840, "uuid": "5c540336-e7fa-421e-bb23-7fef9f6aa8db", "value": "Order List.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f604e875-6cc2-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697529510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529510, "uuid": "6da38f25-e7e0-451f-bd63-47508b38eb31", "comment": "Malware payload (Smoke Loader)", "value": "9c5466d1e5622506c3bfae4eccd153f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529510, "uuid": "6bae3122-fc20-4641-8daf-8bbbadafd305", "comment": "Malware payload (Smoke Loader)", "value": "018b7dd01d14cc2336625263ecb252807c00bc1de7cd7d0c89a1dd32e05e032c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529510, "uuid": "0028cb38-07e7-4f95-841d-12db84c57060", "comment": "Malware payload (Smoke Loader)", "value": "1d9e62f02d6a906cf7cd8e9f0f9e27e885923909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529510, "uuid": "e4e1cbf0-b7e9-46e9-ad38-6afec0e216cb", "comment": "Malware payload (Smoke Loader)", "value": "fa7219e7c2b95179151d9c9f9c3dc1d976c42c41a5924201e1d00919ce60852fc84c7ac96def4025e8a5ee7682b98fe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529510, "uuid": "2e03570a-c355-4e5f-b94b-84c2f4ae122b", "value": "T1B8552321FBE99076CDB22BB169F302A32B31BDB05D348B97138659191EF21C5487A737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529510, "uuid": "a6def078-4574-48fc-b49e-54af599d194e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529510, "uuid": "40dafddd-5080-4d8f-b5d2-7be6ccf12eef", "value": "24576:Wy1RFxC5npMGUJC7qoszRIJuMtFPf9IP6DAPztroGGokzH9b10r9S4oSxXm:l3C5nG00IJuwQzhY/bST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697529510, "uuid": "eeb476e4-6a95-4c29-80ac-e851e0106851", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697529510, "uuid": "48f944fa-6389-406b-b8e5-9d68e9b0a9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529510, "uuid": "de520182-bc64-4cce-8a71-09708d7b1817", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6de4c20-6cfc-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697554422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554422, "uuid": "025d64c3-bcff-4668-85d1-07453ff0944d", "comment": "Malware payload (RedLineStealer)", "value": "91ae15742da07882d4b65866a113fdd9", "object_relation": "md5", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554422, "uuid": "1f9dc4ed-e9e6-4f8e-91b7-f8c89d54b773", "comment": "Malware payload (RedLineStealer)", "value": "0223b3f214133a667aec7b18fd966074f2a8d2a546ebc80e0cbbd8c447c68c2d", "object_relation": "sha256", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554422, "uuid": "8c5d0c49-9e99-4037-8de3-137d9af5fa19", "comment": "Malware payload (RedLineStealer)", "value": "79c41b5499ec4a582cc0f40ac40b5c4d7bb8226d", "object_relation": "sha1", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554422, "uuid": "6eca50d9-9108-42fc-8b5e-1e2e4c57394a", "comment": "Malware payload (RedLineStealer)", "value": "04592655004a828988d35a243a10752d5fe2e82f25952d1d07b4b9d8c49f78ad6a1ce68600501ca26091286ce9bc8722", "object_relation": "sha3-384", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554422, "uuid": "571ef924-3907-470f-b29b-263a4b40ece5", "value": "T173863357EB879E81C7DC6A8131A0E7150CF2C739C06D6EE59FEB05A215FE89A1643F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554422, "uuid": "6417d338-b59f-4f76-abf3-b93e89428068", "value": "196608:iie01TLuOjWcL4t7/tpdML8w8gSv2wx0oFF:iihxLuOjvajj2Y13KWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697554422, "uuid": "109ae2eb-f67b-4674-b44c-26c45fb6cf93", "value": 8208376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697554422, "uuid": "1863d0de-a8a8-4c50-a834-0222dd4ecb42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554422, "uuid": "8db4a6e6-7a3d-431b-aac7-365cf8896d7f", "value": "EngineChromium.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4f991e-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697523237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523237, "uuid": "e2c5cc45-dd3d-4aa5-9832-76f9e392fe3c", "comment": "Malware payload (LummaStealer)", "value": "d7a2e61da863e3b02c273887f8d19052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523237, "uuid": "3a483fcc-6cf8-48b9-b570-b44e1c725209", "comment": "Malware payload (LummaStealer)", "value": "023d9f7659c8ce00c07dec2a423012ef486cc93ff546520245054332c06888dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523237, "uuid": "f1ce7c22-5c50-4582-bbf9-6f612cc1cddb", "comment": "Malware payload (LummaStealer)", "value": "986cb7b4ac45e1cee14568303c90133dd8cce0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523237, "uuid": "22543fb2-3055-48a5-9645-dcd189f08135", "comment": "Malware payload (LummaStealer)", "value": "b625a52ec220e2f2aeb4f799681c2eb5c5267541653005be4191dd3587e50cd91f3b0e1e33fc42522ee4a574a3bae04e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523237, "uuid": "7a2d0c63-1458-4fd2-bf4e-703bbe714b75", "value": "T1BC55339A8DBAF443D0B87B3CEFBEBD6B80087E369587C4D36181404A3670EB49F511A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523237, "uuid": "a438eade-a16a-4813-84ef-0e6d74497e44", "value": "aca716f363fb7a524642f48889d59477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523237, "uuid": "7bb40cfd-2686-4651-96bf-e8746942a5ff", "value": "24576:XHNC1FRtPu8zLP6RDA1AVTZ5puFWg5Qcjvo+zct6n+kz/jF/lTTkauDyU:d2tPu8zqDB/usg5QOQ+zyWjTkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523237, "uuid": "f7e252f9-472b-4b47-89b6-898ad51fd054", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523237, "uuid": "3f9b8554-8015-4bf3-b525-d5c5b17b35d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523237, "uuid": "0601fd1a-eb4e-495f-bdd2-844ce31dfac7", "value": "d7a2e61da863e3b02c273887f8d19052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a50d176-6d2f-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697575956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575956, "uuid": "d7f8fbaf-e761-4683-bb50-fb8c2f489072", "comment": "Malware payload (MarsStealer)", "value": "a864389b69cb90a2a739e90b88862805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575956, "uuid": "e1cc461c-0c60-432a-b51f-e8e57443d03c", "comment": "Malware payload (MarsStealer)", "value": "023f925ef2d5e952dd5d28c1337b51d1ef0243c628c303770010cbf0c60140b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575956, "uuid": "200b9b2e-7d4b-424d-a968-c88e2190334c", "comment": "Malware payload (MarsStealer)", "value": "14eb2f5f3a5dcd0d1ea25c098940b6cb0eca4e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575956, "uuid": "5b02843b-4a2d-45b8-8ea8-19d738794640", "comment": "Malware payload (MarsStealer)", "value": "749ae895faf726e133c0d9d5ba1c92ed6b12426cf10427582f236dd52de93574b4cc1abc79528f1347a121b115d4eb5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575956, "uuid": "b45905c4-1e62-4637-af51-814eaa2c3ef0", "value": "T17B444B939291BC54F916CB369E3FC6E9762DF5508E4D7B6A2218AF1F08B01F2D273211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575956, "uuid": "93c26e54-3eed-4eac-9859-780dfe7b619c", "value": "fe0b386ed1fd8c25368aac6a4d3a2597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575956, "uuid": "538bda3d-3caf-4635-a51f-109c3c2636ef", "value": "3072:s4GE96JNXLwfaRIOj2SJS78GdTEmp9Pee9X3Z5ATT9P1NltM:jB60aRIoRqTTPB30/N1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697575956, "uuid": "654f9194-fc61-461a-8fc3-0ae3150c7cfc", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697575956, "uuid": "78e63e9d-a24e-4830-b889-64dcdd3c2915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575956, "uuid": "af1eddfb-b54b-4f82-8c43-677cdb34e13c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86116aa8-6c89-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697504841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504841, "uuid": "b250efc5-cebf-49cb-95d8-36b7e0b33a96", "comment": "Malware payload (njrat)", "value": "a60c2e8459387329e1dbe2d3625ee2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504841, "uuid": "fee9aed9-f5fa-455a-acac-3cc375de64b6", "comment": "Malware payload (njrat)", "value": "02668d2f92b7ad5863a377be0dafdf605b137b0cb4e07fd95bf494b76e58e40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504841, "uuid": "675d12ba-1561-4fad-88ed-cbfc94029553", "comment": "Malware payload (njrat)", "value": "fe09a7f0b28fc92bc5246a08b79dca47a0458273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504841, "uuid": "c01b7a09-fb65-4e01-b6eb-ec570324ecfc", "comment": "Malware payload (njrat)", "value": "b6ccbf5fdef39bdd5b10795be470463b4a4337fd869291db4b25fa13b2cde127fb695eb35f4a6f3ead326804af5fe348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504841, "uuid": "32317ea1-fb30-431f-be0a-2a7dfbc8d24a", "value": "T117C2195D3B908166C2EF2BB006B2DB2502F2E10B5A17EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504841, "uuid": "ac5a9365-fad3-4779-ac8e-a9c2efde7c48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504841, "uuid": "e124c2c9-c72c-45d9-9a97-46c15276f199", "value": "384:nLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bNtVvGD:Ll8AA/6T5e/gsEEVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697504841, "uuid": "1722d402-48f6-45e4-a6b2-162eaf160628", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697504841, "uuid": "5a99bbae-890b-40b0-a63f-007e5aee6c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504841, "uuid": "a523014f-1e46-4077-ab66-a96e19604de7", "value": "bQGy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750ce2ff-6c94-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697509536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509536, "uuid": "ba3a2017-ad73-4d2e-a4dd-8bb333fcd0fb", "comment": "Malware payload (RedLineStealer)", "value": "cc1fb53af62ddd7a654ee46367fd5139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509536, "uuid": "209ac168-82b5-4d15-9342-410ca4c9173b", "comment": "Malware payload (RedLineStealer)", "value": "030a908f4481c981769f2ecba7ad8b3a5ff06c4fe202b4b05faf739fd6497a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509536, "uuid": "483a9444-9f03-4137-9396-b81a2d09884d", "comment": "Malware payload (RedLineStealer)", "value": "a8d8c78f81fa175d2086ea0ff77358e2b122f320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509536, "uuid": "ce3d8627-2037-42ad-8b69-07a15eb7ea98", "comment": "Malware payload (RedLineStealer)", "value": "69600cb51c36fec61d33336b4094076c6f53959bfb5ebee08906376e8f0cde027f34aa7004c75b7fb6b8ae3c28f6045d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509536, "uuid": "6652ee8e-e02a-46c8-bef4-2565dd22a064", "value": "T19E04BE55B1C0C072EAA2193509B0E7B15E3DFC740F60AFBB7BA40A755EB02C1DA719A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509536, "uuid": "c6744b43-022f-4cf4-9214-3c3274cc6535", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509536, "uuid": "d46460d7-80f3-4be3-98af-058b293ef6c2", "value": "3072:iDQ9nizKw/kal99mdVeiOEru0PIBtcZq+SrdSqpjxnd:ikK3l99cV4ExUddSgxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697509536, "uuid": "3aa29466-bcf6-4885-88f6-2d8b5e5a3c5e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697509536, "uuid": "b52a4f3b-f30c-4bbb-a8bc-f6549e09e835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509536, "uuid": "99281fec-de21-430f-a2a6-cd4cb5922c86", "value": "cc1fb53af62ddd7a654ee46367fd5139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0079a3ef-6ced-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697547566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547566, "uuid": "810bcfb8-2702-4107-a11d-95a9449319dd", "comment": "Malware payload (Healer)", "value": "d534bccd65f4d7cb7e7a00809fec8732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547566, "uuid": "beab980d-4234-4d79-8cfe-4bac359d237d", "comment": "Malware payload (Healer)", "value": "04140a07f858242aea2e5060fd52668d03619185d20f6c8b2c6debfe4a5f7b6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547566, "uuid": "d24f7c57-13c6-4429-82ff-7a5439b802f7", "comment": "Malware payload (Healer)", "value": "bd88bd428b8f9f5fb6ecb7e76b8323b94faa745d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547566, "uuid": "cb42cda8-10cc-4c55-b07a-b531ed2fb87a", "comment": "Malware payload (Healer)", "value": "36ec7ebba78df2c03ac4a5618522fbf273f6c5b3f530871c868e3ef12715d8921126dfc498178a52bbcdfb3ddda9a65a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547566, "uuid": "dc8f9a27-d92c-46a4-ae4a-a2a46529cfd7", "value": "T1AD152301ABED9473D9B4177188FA46831779BE628DB8874B2344895E1C73BC4E27273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547566, "uuid": "d53e1f9b-fc27-4045-b686-124442d346d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547566, "uuid": "6f2401e5-9385-45fc-9930-c364745c73bd", "value": "24576:ryvJJkCTQHmXNqP2T1YrBicnyBaG6+IyM1fAIv7Eo:eYmdqP2irBicX+IL1ftv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697547566, "uuid": "fe07611d-edcd-456f-ac2a-cd05a68ba603", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697547566, "uuid": "5ced8812-52f9-45b3-a3e4-bc28d95296f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547566, "uuid": "4c4253e7-4614-4106-b25e-d66be96d8c12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f220927-6d27-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697572528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572528, "uuid": "5310d30e-d9d9-453f-9306-26c207b4160b", "comment": "Malware payload (RedLineStealer)", "value": "16028051f2cff284062da8666b55f3be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572528, "uuid": "86116495-adf5-47f7-baa1-cddf2233fbef", "comment": "Malware payload (RedLineStealer)", "value": "04ec519ce641c6986f15134d8c49fb1ccf21debab72b65e165cc8cb158ba7ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572528, "uuid": "d35932c6-6000-4709-a371-5aa861cd67bb", "comment": "Malware payload (RedLineStealer)", "value": "ba3f5f9065ecb57c0f1404d5e1751a9512844d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572528, "uuid": "5f853f49-a73f-4f02-b0dc-66f9c9c4fa0d", "comment": "Malware payload (RedLineStealer)", "value": "f0499a9bda91ab72c9d536d2624cb7389550918e5742b8f422cf648770316528ce15058350f6d9d01196f80de3eb75b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572528, "uuid": "67a635ba-138a-48c1-a5e3-f9af18922c39", "value": "T1C1945C4D93C5FC0CC79D35BA1D40D2A0D04B2D4A56EFC6B6BBD682D1AB88D7AF630942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572528, "uuid": "1d5e1cba-b82e-428a-a6b2-98d16a7e13ef", "value": "42dc4b97f00c0e49be924a48eec20081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572528, "uuid": "8b32af37-ddd8-4855-b0e1-dc6eeef7505a", "value": "6144:qDRukv2RaOzLG+c3uOlv1eSNZElwSGF+76nr0LaM7fuR6vCE9q:q1uAOfKNiXis7s6vCE9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697572528, "uuid": "fb2666f0-f749-4b37-b0bf-3fcf7a4af1e6", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697572528, "uuid": "fc3ac80c-dd6b-4b56-823a-fc0bb0e56ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572528, "uuid": "ffc1a1af-3b6f-4eca-a411-91a4d0c4bc3e", "value": "16028051f2cff284062da8666b55f3be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a696a01e-6d1c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697568031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568031, "uuid": "3ae82082-0bad-45e8-9a82-9c7e2d791a47", "comment": "Malware payload (AgentTesla)", "value": "19c63979bbd415c55aec42b1d7027216", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568031, "uuid": "6c9a1ccc-d0ca-4977-afee-9ecf66236395", "comment": "Malware payload (AgentTesla)", "value": "055aa8e2816ebdf77f441bc3dd667aafd2aef85a24941bf94761620f9291fe1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568031, "uuid": "46273699-ae4f-40df-a6d5-a76e674cae43", "comment": "Malware payload (AgentTesla)", "value": "e6402d3bf5f5dd041fe962f29192b99aacb9dc6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568031, "uuid": "5bc49aa1-bc6b-414d-b213-90fd3d229a80", "comment": "Malware payload (AgentTesla)", "value": "d2bb57f47c0df1c6caedc48a80bde6ca9933d5d5fe4bebec441bae5fbb13dae28948ef66a7dbaba7f2c041ad4f658506", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568031, "uuid": "91bb6247-9e38-47a0-b28c-50cbb47d52ac", "value": "T10D257E3D29B9273BC1B9C3A9CFE1D827B154996F3521ED6598C353A60342E4639C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568031, "uuid": "399c2c89-e8f9-48b4-a404-7ec8c16d91e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568031, "uuid": "8b09b34f-10d8-43c8-a980-45ee623864c4", "value": "12288:Q2ef9spVkGauqLuUL4focRlJT7LOJIZlh8j4pWY1osPE7NT:49UkYqKm4foGJ798j4pWYAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568031, "uuid": "064cd83b-bbc4-4c4e-bde4-30cb8a70dd99", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568031, "uuid": "7f0eb296-84e7-4c8b-8be8-47b3e968b758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568031, "uuid": "dda2220c-f40a-4aa6-a4eb-3e7a3240eab3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.15625.13562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02dfcc7-6cfb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697553928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553928, "uuid": "72a7057f-5f53-485a-b020-a23240731699", "comment": "Malware payload", "value": "54e794519642ffda7c08d8e275b5bf3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553928, "uuid": "9ad98562-1d43-47b5-9fcf-a100d271e52d", "comment": "Malware payload", "value": "056f7b0504c5239892402ac1062636bea12a176934bf33fa7383c275a6c9b075", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553928, "uuid": "0dd14733-7ce8-4eb0-b40f-2c355f59cc08", "comment": "Malware payload", "value": "f4b7556901a674ab1277ffe391879c20dc2597a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553928, "uuid": "aacc6b22-e3c4-41a2-bca3-261ab433b915", "comment": "Malware payload", "value": "0bf5a8b9b6e769fc664d2d01be6364a96a4771ec7b9b05e083c3000c9e8479a5ef38135c076c89e82f4ae36d1621f9af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553928, "uuid": "e920162d-510f-4f2b-8e6f-e53fe3b1574d", "value": "T1D755F126F6918437D23329388D9B76A49835BE503E245C4E37E81F8D1F397823B5929F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553928, "uuid": "95f74069-96b1-45b0-beef-e764a0b0329e", "value": "aec94a0f6b56569be1fb44b408c9236f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553928, "uuid": "70614d22-282c-4118-aaaf-725de91e4aea", "value": "24576:IoOEiAA2FeKxWgd3oIkibGOM1sdpi4nO2unODRpiWs:IfsFlqIkiri9gji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553928, "uuid": "1862cc3d-2115-4662-b542-5c4ccfd802e8", "value": 1399260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553928, "uuid": "f74c111c-ae79-4354-94c4-7e88377fd098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553928, "uuid": "f4de4b6e-a4e0-4ebc-981d-7abe0790a3dc", "value": "2iN.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabda4c5-6cb2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697522619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522619, "uuid": "6272f23b-e399-413c-9657-1f290bca7092", "comment": "Malware payload (Mirai)", "value": "44c50c64bd66a38aba5648cf4d8c85e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522619, "uuid": "26b8d0ea-eb2b-46a9-b74a-08dc5e5238e9", "comment": "Malware payload (Mirai)", "value": "075b104b09a4c2a2963d4b19b4b253d93329c862490cc9bf078aefa40a4916da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522619, "uuid": "5cf36ba2-f9e3-4e34-b46c-4661977bc2ad", "comment": "Malware payload (Mirai)", "value": "75547a8d7634dbf337a5ead68920df2f0571a82b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522619, "uuid": "a03e80a2-7161-43e9-89e7-d8d568a703ec", "comment": "Malware payload (Mirai)", "value": "7a23ef7bb04ee6862cfbbe8c1331d1be3f6413d3b45abab16284d66ff7f7cf0d98b0882c0d993b989945d3e721565208", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522619, "uuid": "6094eee7-722d-4b01-a3b0-5fbdb992ae72", "value": "T1D1936CC5F643D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522619, "uuid": "5ae3e440-2ded-4e03-bce5-f977b83f7c83", "value": "1536:xpmWc2AcighsZ82fJxfcNHv1mSsM8qioFgBQ9TnkISGtAdB0xZ:xpmX2riED2frfyHtmLFomQ9kVTB0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522619, "uuid": "f4f09162-a7c4-4dea-be4c-75dceb883003", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522619, "uuid": "b533cce2-7b4e-43f8-a284-586037eba385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522619, "uuid": "2c8ae994-aee4-484e-bdef-4cecd5197a6f", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad69067-6d15-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697565005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565005, "uuid": "19e3cbdd-78e5-48e0-aaa4-79dfe8c2d1c7", "comment": "Malware payload (Mirai)", "value": "2e09705ee4423b0b6b42a09df58d72cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565005, "uuid": "cad6152e-0fa4-4bc3-a5da-66fa9ed9450f", "comment": "Malware payload (Mirai)", "value": "0800bce0357efaa7f5e54f4d343cc6c6cc50e4285260c1023598e1bb4bc18d3f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565005, "uuid": "c1a1827f-de06-4799-8f20-91a7a0f74f3d", "comment": "Malware payload (Mirai)", "value": "80b4ca253171e44ba90023ec7a4e5d4c9a42be91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565005, "uuid": "782adeb7-8240-4baf-9f76-46ac2e4f86c5", "comment": "Malware payload (Mirai)", "value": "c8d91fb9f9ae8bc6a698cc8d0e36a71930889353a794986cfdd40eb9ca39e1ff604f27e246316319fd0a6ba80492cca6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565005, "uuid": "f2f28850-278b-432a-b02f-c2da89310da7", "value": "T1C233026227AE29E291B05777FC32EC5A57AC17F4986730DA38F05A1577C58024EF27C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565005, "uuid": "2f4b90dc-acac-482b-a300-3de54bd7b5b2", "value": "1536:s9O/ZMAXIxNUk0D4LcPqF1aBexo4opKZb8:s9O/ZNKyP4LGqFUF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697565005, "uuid": "c073605c-b41b-4c0c-9de2-90626e63c360", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697565005, "uuid": "54af42ac-9a3b-4ebc-911f-86897db8f075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565005, "uuid": "1b3383bd-c390-4751-9ed5-474d23e1cceb", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81b3912-6c80-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697501086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501086, "uuid": "4ab9128d-0959-40c3-9ef5-fde0277798f9", "comment": "Malware payload (RedLineStealer)", "value": "6399f63cd517a007416aa5ff5b40c7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501086, "uuid": "a132bce7-3209-4fc3-af22-da7631215c4f", "comment": "Malware payload (RedLineStealer)", "value": "08981b68ee7b4be5553877cec41f185b078d3b0b9d11816e149428a53dbb2138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501086, "uuid": "48e8aa85-1e89-4673-951c-4af18fc52ce6", "comment": "Malware payload (RedLineStealer)", "value": "21160942d544a9e2a16c183a7454c6e316020889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501086, "uuid": "9d294220-997a-4f43-9fa3-41514ec2ef58", "comment": "Malware payload (RedLineStealer)", "value": "e31e1797cdb2c6fa6eaffe2a9ccaea56a156d51e96434646905074622cf8d0e7403a5f887461473776782fe7bfd591ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501086, "uuid": "3f21e496-235c-4d75-975e-ca73b5c1283d", "value": "T16C352302EAD890B2E0A11BB45DF201830F39BCF25869D377934A896E5DB3694D63177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501086, "uuid": "d67975e5-8ad4-46c9-aca3-7b1245e1fe38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501086, "uuid": "7818274c-6900-425c-94ca-0840c1eb4ebb", "value": "24576:Dys5qE9RCllAMr85iPZI189XYwDsV7GyOJjHSc2M3fWFN2VNW4NP2e:WsBJMr85UI18dDstOJjHMM3+FNQNR12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697501086, "uuid": "6614b5b7-afbd-4804-a92a-375cd8f1c067", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697501086, "uuid": "1d69789c-11db-4f84-9dae-5cabaa59fab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501086, "uuid": "f1980990-4d5d-46c3-95a7-d2ba96803811", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac3a92d-6c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697505117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505117, "uuid": "4239c834-3e50-4f4b-b112-b26e43e0a850", "comment": "Malware payload (IRATA)", "value": "63c9c824c4a2cbb46df3867aa5a6ad63", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505117, "uuid": "f882ab8c-cfe5-4dca-97b3-4bc72683adbd", "comment": "Malware payload (IRATA)", "value": "09162fad6bf2bea7ad9a56a64cd2b3d568bf377c8a7fe736daa15c9ee4707f08", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505117, "uuid": "3674151c-1d5b-4160-811f-1787ef961a49", "comment": "Malware payload (IRATA)", "value": "d128a28188410aef712b7ea3da90cb42005fdf2e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505117, "uuid": "11d31896-a76b-4656-86d4-64f2bfb06d0b", "comment": "Malware payload (IRATA)", "value": "587daf47941177bdf76144ddfac638afdd7bf1aa9af9fbcdff2ac5f1bc2257bb8348e089fcdba07ba4e5ba18e39b9015", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505117, "uuid": "a9008466-cb83-48e3-b81f-1755c440fdfa", "value": "T15EA533CAF255C525C4EBE2741619C3D1047B6E324E638F4BBD297B38493B9F6E38A118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505117, "uuid": "0677a424-5383-40f4-95db-a1d64631ba1a", "value": "49152:AEap9AnLTJROfdV93iUaIjmxuD/HYd4i9f3mkccJbmgX3x0II:ApDALFgfdV9d9ay/4qi9f3mUT3x0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697505117, "uuid": "f3fc7db2-a281-492e-82f8-0301106245b5", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697505117, "uuid": "43662dd3-18a9-4d57-818e-ae35a685c529", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505117, "uuid": "d58924a8-be5e-4307-b039-232252319349", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7baf1964-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697537465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537465, "uuid": "db20451b-87fa-42f6-893d-a8826c580c4b", "comment": "Malware payload", "value": "802dc7edf5ab5246f4674ad5a5d67bd4", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537465, "uuid": "d4e4072c-096f-4da0-a3e3-be0b13158895", "comment": "Malware payload", "value": "09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537465, "uuid": "12c0ab8c-a98a-4d94-9e19-849d7cf3113e", "comment": "Malware payload", "value": "7480111ee7d1e5786ea7a60e3ea77c1d34e91ea3", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537465, "uuid": "92c59a63-d5f0-4de7-9c8f-33f89fccb326", "comment": "Malware payload", "value": "1a0cd765066c7aa4fa7ad0a55e4827429d10f88627b1722877d3e2064c7bce5cc6e3b951af0d204092d8783dd83e681d", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537465, "uuid": "2a7f4587-49bd-4e1b-b078-9bea03670ec8", "value": "T1078302638B76104BC0C9B92A47F5FDC37122543B5A6C89334A537AD71807881EBEB57B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537465, "uuid": "b6f6a385-c514-49cf-9ca4-2364189c3909", "value": "1536:UdiqxOyhPgO8X1ZLq9z1WuPOxkqz3uZfT4WsNPjtwS5BtZrGzv5FHvDrD5:Sq1Vc1WuPqbuZfULZ/59GzBp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537465, "uuid": "aa748ac9-9ffa-4295-8954-27d5d3577031", "value": 85728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537465, "uuid": "0f17c0d9-bbe0-4dbb-9691-44fdcc649d6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537465, "uuid": "28083971-3057-4bfc-be3c-d7bd3bf9012d", "value": "xahl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858e6b24-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697523308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523308, "uuid": "85406ba8-d5e7-4dca-b0d9-6a906e36340a", "comment": "Malware payload (AgentTesla)", "value": "e4a28d894f456e7566deef0f7f61adda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523308, "uuid": "cc5c47ac-37ce-4b52-b243-3f13fd33c14f", "comment": "Malware payload (AgentTesla)", "value": "0972105c3cb2d74e7cb3f00ddcc6cc96089524d5625b62f71e27d5857c6eba40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523308, "uuid": "4172544e-87ea-4e58-98a0-978af6ff95c4", "comment": "Malware payload (AgentTesla)", "value": "4448e21504537335407c872242c23c317321ef9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523308, "uuid": "706a8db0-59a5-4e79-a1f3-586029ffb816", "comment": "Malware payload (AgentTesla)", "value": "366522cecf1dbe0999356067f64c83fc4b54ad5bc35a45cd41ec56ef3182f7f6be82db46737f49b0c12bfd55831239a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523308, "uuid": "ffc2b802-d88f-4746-b216-58c134e83e03", "value": "T1B59412A967A8CF31C71F0B30D55606500138AA33A90BF34D5FCAB0A63E732476E599E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523308, "uuid": "05833177-be52-47ab-b25b-a6f740a36ba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523308, "uuid": "8b48232d-5d93-42eb-9cdb-256093d8043b", "value": "6144:g0nMBIKD2SJMzodRpUZNFvzy3ZWPB8IbllDoDF+tq5x73J66vDehZdk6ceh9X3PS:/MfD2S+j5yJQuIBlEDFDxLShXk6ceX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523308, "uuid": "39cdc03f-7673-4cbb-b344-7d03d73178aa", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523308, "uuid": "ffda2cef-b9c7-40e7-a0d3-5a4c6ec8e39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523308, "uuid": "034b339b-5322-48c1-82bb-de921f6f7f86", "value": "OR09865456789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216523c1-6ce3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697543326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543326, "uuid": "1c7ba9ca-fa3b-4ba8-af08-3be2436e6e35", "comment": "Malware payload (AgentTesla)", "value": "cf00bb2d9b2d8422d7926a6f8f482a89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543326, "uuid": "07d45b89-5b0a-44c3-b277-b7420f2172fb", "comment": "Malware payload (AgentTesla)", "value": "0b97c43d0eb22c21c8c4be37b6b45a1fd2acc9aa8c2a30012a06c2a0fb23a1f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543326, "uuid": "fd73a33b-1925-4f46-8338-db029b1b85da", "comment": "Malware payload (AgentTesla)", "value": "d5ac94d151de8eb856aef924e1eea5c9f1867125", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543326, "uuid": "fb11a771-2dbe-42df-8db3-29e5ab198286", "comment": "Malware payload (AgentTesla)", "value": "e7ca005f2043f9515ff8cb47b99de298a452ce481b4e6a78e49de64520acaaf53d3b5a6dfc5d9c53738eece3dc6c4315", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543326, "uuid": "1957291a-23ff-47b2-b72c-3d9a8d033776", "value": "T166D4231077AA43AAD6754FF418F5E0154FB1A4B23E31CB6A0EC9B2EDC42A70A5901F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543326, "uuid": "f0cbaab0-c14d-40ea-a2ea-ba461f446735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543326, "uuid": "8be32813-06ac-43e4-ab5a-34aa95cb330e", "value": "12288:0mDJ92Iw5AnosvA9jmOh+bDOMLr3isz6bWos7QBy6N+NWlS5eF1:1/Y5AnHsjm2y6MLrJG6ossB98kee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543326, "uuid": "4aff5e50-1285-441c-b476-3caf42da1044", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543326, "uuid": "2a69df13-7cdc-4374-802b-38e8189151d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543326, "uuid": "8d006c3b-17f3-4b89-9a32-41f2836b0a4d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.8853.31406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b783fea-6d42-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697584226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584226, "uuid": "ac39b821-c17f-4b2d-bf67-02a82fb4a11e", "comment": "Malware payload (Amadey)", "value": "1b0e45af9bf9339d1d2c9a03f23a945d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584226, "uuid": "cfa66da0-31e0-4cd4-abb8-284944e33eb4", "comment": "Malware payload (Amadey)", "value": "0ba250f6fde2b2b72c9deace26fc66d91aadfce7e68b1e386a1ba7da183b7fde", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584226, "uuid": "69b0ee1d-5b89-4c09-81f4-517ed029b169", "comment": "Malware payload (Amadey)", "value": "03b37944c9e66d75f075a4c6d13160ded72b1f70", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584226, "uuid": "97803284-05a7-4e7d-9241-56d7cb795826", "comment": "Malware payload (Amadey)", "value": "496a25e4d5a7fbcae391cddc40a2677e0bb2962773168b32562e22dd6df422f3ddee2234ba4402b5ad43b32c83cc588a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584226, "uuid": "a88c9b9a-8bb7-4bf8-a925-0ae94e988af1", "value": "T14CE39E01B5D084B2D57239350970EFB15E7DF8300F54BE9BB3D816B94E246C09A6AE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584226, "uuid": "a0bc2bd1-1adc-43b9-bd45-0e90b7a9d0b9", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584226, "uuid": "6b23636e-5f7f-4170-ac55-11aa9d700ee5", "value": "3072:BWnYQAJsU12HlWCnUewNzrQuUUpBt2973rC9kmaDWzDPoJ:aY9JsICnU9Q8cynPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697584226, "uuid": "5770f327-fa6d-4811-af00-87ea3243ad65", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697584226, "uuid": "99e29fa4-dad1-45fe-94b9-e5a6e2b71130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584226, "uuid": "8c531392-1fb1-4120-b124-e29c98e0e821", "value": "1b0e45af9bf9339d1d2c9a03f23a945d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5fff88-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697523752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523752, "uuid": "b6a44617-9739-4a83-b310-54e9c54fbd48", "comment": "Malware payload (Formbook)", "value": "c2c6e875a3d93c19dd7928dfccd6130e", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523752, "uuid": "3a717066-37d8-4cec-b73d-4a04ae0ac40a", "comment": "Malware payload (Formbook)", "value": "0bc828b37702b1342fd5ab2a1dce09b00ed271a0b42965454de4605aeb27d63d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523752, "uuid": "24cf0490-f58c-4daa-968e-cc75670f07f6", "comment": "Malware payload (Formbook)", "value": "75064e2365e7b2c40a02c2a21f36a6531aa8a397", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523752, "uuid": "923ac096-133c-4969-a048-c12787e07be3", "comment": "Malware payload (Formbook)", "value": "6cc6bf0795bd26eea0b877226a7c9da46d7fb1ae773f14990300be3cf17ccef88c4e34ba2a12aea82260b519085668bc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523752, "uuid": "cdfe6eaa-2699-4930-b596-2925028ce3fd", "value": "T10055E003E9448B83D40D83F57E633EE91B1EBF15E9D26ACB11567F4B3A306A2091B51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523752, "uuid": "c9da10ae-b588-47a7-aa4b-71c3d6c7b2d9", "value": "24576:wWQmmav30x9Zyuw6VT3bVYo5Zypw6VB3bV5yyUoqv5g2QcXQ5ssOSvSw4x:FQmmQ305K6VT3bVNd6VB3bVQxi2rXtSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523752, "uuid": "e4a82c91-df66-44ab-9d70-20db645fd758", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523752, "uuid": "0eb467e7-5831-4b06-9a33-8b79adc78ab8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523752, "uuid": "e4ad6801-274d-462b-8ced-7c2656d33f36", "value": "PO 4200165979.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becae31f-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (Vjw0rm)", "timestamp": 1697539725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539725, "uuid": "66ac2fb1-5bcc-471c-8c97-b48c925c061a", "comment": "Malware payload (Vjw0rm)", "value": "f51aee23c560560ae8bddb813dbc69fc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539725, "uuid": "e5792712-6a6b-493b-b45d-51bf33b814b4", "comment": "Malware payload (Vjw0rm)", "value": "0c3ecc4baf3fc3a1dcc446a8f979fcf61a0d4ef1cfd4cb84c99cb7f3b3e170c1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539725, "uuid": "48cb325a-e822-4cf3-92ae-d4d97f9110da", "comment": "Malware payload (Vjw0rm)", "value": "fc26a039ed4f48b957463d6dd20bc5c903337268", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539725, "uuid": "13cb9fa2-7403-4d3c-bc13-7c5fab271e55", "comment": "Malware payload (Vjw0rm)", "value": "9d5633fec47b3cd5af3fbcfe394a0f88e0b5e761855ccbf5741ae7ddd963a5c264ab7e5541fed7e3435eecd41c053106", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539725, "uuid": "a4ec2662-ff39-4c6f-9a29-e463e4569936", "value": "T152952AE4788D78891B960746903D58AEEF7CCBEAD4A4939FE88174057B63C08D3D287D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539725, "uuid": "ad473192-77f6-455a-9f86-dc19c825d757", "value": "12288:TCbvguAMWCPI7nreA07d7x3zqAEiQ3sm0YrYTdmEKGcrtHg2qTecw+z2Om:Qgu37tqAEiQcmGTrKG6t3qTRJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539725, "uuid": "0fc128a5-9147-47ed-9d02-83440d7d1c50", "value": 1989663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539725, "uuid": "c3604388-c9f8-4c57-9310-3e65da49451c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539725, "uuid": "b6c48b64-5600-4131-9277-a294f42a8afa", "value": "New DHL Shipment Document Arrival Notice Shipping Documents Original BL, Invoice & Packing List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19030a7a-6cf2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697549755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549755, "uuid": "3d8233c9-c6dd-4193-a08a-d645094a7d54", "comment": "Malware payload (AgentTesla)", "value": "47d0f09c0bf7e1811bff110ab81321b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549755, "uuid": "c2d24223-1d50-4745-98c6-856c2456cdc2", "comment": "Malware payload (AgentTesla)", "value": "0c6509de077fff4ef7548e682f672a5169136f7ce470b420f2f33890228bf0a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549755, "uuid": "e1f1a71d-6e2f-4193-8e73-139c5c66f087", "comment": "Malware payload (AgentTesla)", "value": "e70e0c4fb6d2f5b3c967014087d5f4a01a08fe8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549755, "uuid": "d1f9bf1e-3ff4-464b-b915-9f453b10ee87", "comment": "Malware payload (AgentTesla)", "value": "9a80aeb1331493afc385d65a3c6dba16e40a8e9b77e04ce6a825ccc38ee5c670a95bcace25573c12e6947500fe765d4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549755, "uuid": "c0849576-af5f-4635-a07c-85f012d18ae9", "value": "T10CD4121173FCEB65DD3E93FB58B2814447F9B11AA1AADB8E1F8520CE490AF5140B921F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549755, "uuid": "de459c57-4115-40e8-ab06-d139ccfae595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549755, "uuid": "6adc0920-3cdf-4d05-ab01-8235fdfdf125", "value": "12288:pBLXmsrJM1FQkGi8KnZx48wrUyBwVS1zeHrFGNtiB9bWfh:DLWiMHQkGmnb48KUyBwVgPNELQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549755, "uuid": "0e4f6367-17ac-484a-991c-5ef3d1a5527c", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549755, "uuid": "f876b461-dc0d-4bd2-97f5-6feed64d65f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549755, "uuid": "c0433b6b-f60e-4348-a746-b82193a523bb", "value": "Payment Copy (MT103 _171011).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8d8d5c-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1697523989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523989, "uuid": "c136a244-844e-48a3-ae3b-99095a006f40", "comment": "Malware payload (zgRAT)", "value": "7ba214f8174004943d83942dda0f9731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523989, "uuid": "2ba72853-d68f-4fa8-b98a-d4341bf62997", "comment": "Malware payload (zgRAT)", "value": "0cff69c9468dfe7337570c12c44510f162de14e08c0cee8f5d8f699e3013bb40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523989, "uuid": "186300c7-abce-465c-8a7e-a8ce708740da", "comment": "Malware payload (zgRAT)", "value": "85cd390a22288377642a986a230b997618f25d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523989, "uuid": "f63701fe-1e2e-4036-95a4-2db4514faeba", "comment": "Malware payload (zgRAT)", "value": "069301606ab4b8152a68934ab6eb6e99d451a2adae960b61c9270a50e59c32a696a943df5d0b325a78e708a05372bdf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523989, "uuid": "f04e6f31-06c1-4593-8348-3a3956041512", "value": "T1B1E44A43E746E8A1E238A7B7D096740483E0E58057EBC51A7C49B2F79B12795FDF028B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523989, "uuid": "84b94bb2-177c-4b68-b4c1-ae4f90bf5a76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523989, "uuid": "a08d872f-5464-4e7a-887c-e249c04b3a9b", "value": "12288:NNK/wV8oSStivGrmU6KQUGUrLmUWBJb+Ayy4nBkAexc5XyaPY3wOpchdlgapFzGX:zK/a7tAUIoBqyhnPYgOpidlpVG55dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523989, "uuid": "20c5165c-b4a4-415c-99cc-eaaf37833280", "value": 711776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523989, "uuid": "0f79e59d-733c-4d8f-8168-e09dfa1fe81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523989, "uuid": "78f35898-19d9-495f-a172-a6d502bff5d8", "value": "7ba214f8174004943d83942dda0f9731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93bb7fb-6ca1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697515207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515207, "uuid": "c2059048-40df-4b6c-843b-b763c0fbc47a", "comment": "Malware payload (Mirai)", "value": "fed5215f58ac70fcd29bb1518d3a8210", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515207, "uuid": "95e5206c-a4a8-4da0-a7ba-d4d58ca41ae7", "comment": "Malware payload (Mirai)", "value": "0d0e6bb5ccf31901d763c201f8194531fd3b9d03b61c3a9bb2de0a6ed61f58fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515207, "uuid": "04bd0fb0-d628-45e1-96d4-95ba544b0791", "comment": "Malware payload (Mirai)", "value": "7fbedf4e4ac3203796d1d960b4bedbfcdb977b58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515207, "uuid": "b53d6699-b06d-403a-a6d7-260d7ad174e6", "comment": "Malware payload (Mirai)", "value": "4e411f91f491e59be3dbd57b8e18af674da47d0e439e131f48f2986e7b814df821a85f6b43228857825be8a273ab48a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515207, "uuid": "0d87bff7-9fbb-4a49-ad6b-c8bc50f36419", "value": "T1E6C2D03096E91CB1C7500932E7B866C6BF530FBDF9FA6880214196BA7941D0529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515207, "uuid": "350c23d5-e2c2-493d-af10-320acbd85cc0", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEmbXyz0hymdGUop5hr:ERsoTAZ3alkXLvFh8nNEmbDs3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697515207, "uuid": "ee55bac9-a3e1-42ce-9b14-4a0eea18461e", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697515207, "uuid": "c5f37f9a-e874-4cab-a7ba-c3c717817e6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515207, "uuid": "17e99c89-3771-4633-8d2e-4c324f4cc16f", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46aa1186-6d2b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697574313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574313, "uuid": "98b87fb7-582c-4b3a-bd71-53cfb4df7d02", "comment": "Malware payload", "value": "c61f14dff693caa4378e4533a378befc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574313, "uuid": "92196dd2-8d54-4339-9844-d81fe2d512d3", "comment": "Malware payload", "value": "0d8ea04dffda1afbcdf088a195c512b263ffab0d10bf769846319323a3ba8de6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574313, "uuid": "be34f255-70a2-407f-8118-8291e4f3cebb", "comment": "Malware payload", "value": "140278cae0f0be0171301efdee4c103d2029c264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574313, "uuid": "3d61fa84-b1c2-4dda-9cf2-af102005ed19", "comment": "Malware payload", "value": "2286d22d24ab2d9b6377fd5479c63febc9db697233207e266ac5f6579ed12221311cb9d87b4c0b89925eb32565c0bb5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574313, "uuid": "68840be0-a6ce-489c-9969-eaa9d59e2cc0", "value": "T10B35236367F86537D8BA637055F607932E373DE25C7C92AB3780284D1DB2984B07272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574313, "uuid": "7206b394-d315-4aa1-8059-9df3caa324db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574313, "uuid": "f607e7bb-8826-42d1-8685-3e7627843a05", "value": "24576:oyWKi1jpoGqknOZlL+PoLfNSd55F2sHKzScH5o3a:vWKs1ojdZXk5lHISEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697574313, "uuid": "1658e871-28ec-40a1-b1ed-9ec4bbd00377", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697574313, "uuid": "575ecd8c-e82e-4c06-84da-4d7415207349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574313, "uuid": "88ac50bf-c452-4605-9d33-bcf8b10612f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a30ccb-6cf5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697551007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551007, "uuid": "f5f38077-83bf-4696-a64e-1439c03b3617", "comment": "Malware payload (RedLineStealer)", "value": "72440298b7e59c130f786c8c33ce7812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551007, "uuid": "de56ec36-7e5a-4dee-8dbe-c565924b102d", "comment": "Malware payload (RedLineStealer)", "value": "0ea266f277bac4ca8fa7c5e4dd4e2abca813c203fd9b4fb31a950ceed5ac5e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551007, "uuid": "43994946-52ea-4f90-8ca5-18236229e8b5", "comment": "Malware payload (RedLineStealer)", "value": "481ab984cdd70b9d0580e5f6543cf4a24b2cdb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551007, "uuid": "d3df2b68-642a-466d-8178-40aa82bac2eb", "comment": "Malware payload (RedLineStealer)", "value": "cd81107ec7617648f483da4edd53c991d72e130e34ac4fa0459a4db1e08708f185e4475f715b8135824967b03a0194ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551007, "uuid": "fb2f4165-fa14-4147-b6aa-bcfb420c567f", "value": "T130352341F6D49633CDB5AB7048F703A31A35BCE4AD7983672791998A99B2FC4C03235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551007, "uuid": "a927cf36-50cd-4f4c-ad0f-2c608c97c1fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551007, "uuid": "9d820d6f-b034-4f46-a302-a0bba8817134", "value": "24576:OyHl95mF9YN4SGJaXj5k/i5ORVK5Vs7CEh:dHlyyV6UOm5Vs7CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697551007, "uuid": "07606fad-1222-498a-a223-0c3dbff7d8f2", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697551007, "uuid": "6007684d-7bcf-4da7-a409-b632d3293403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551007, "uuid": "e5e6399e-2e61-45b6-9323-21cc7bedfae2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181bcf0f-6c89-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697504656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504656, "uuid": "dedf3a34-55a6-472d-9ebd-92f6591be79d", "comment": "Malware payload (Smoke Loader)", "value": "91b7684bc466e3a5dfba9743bd49381f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504656, "uuid": "2509f093-be8f-4c3b-8fb6-e126b2a90e22", "comment": "Malware payload (Smoke Loader)", "value": "0f8721767a309b62a166170c8d734d8532b3f18d4948f35629f988a53b871f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504656, "uuid": "8c3bcf2b-364c-40b1-8e86-5c06755e1c5f", "comment": "Malware payload (Smoke Loader)", "value": "be1db3cf64cf658c358b05ed412566b81aa1f6b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504656, "uuid": "1f5d3e60-6052-4df4-a82a-263e55f73057", "comment": "Malware payload (Smoke Loader)", "value": "f48bfc2e23835674c2af38dc659bac1cc6f232f2d8e9c75038e4349d527b4c7cca06978a1005360a053f1b9361eb1f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504656, "uuid": "2a216f67-5d33-4c6e-8cdc-80fd85b688ec", "value": "T1FF352382DAE44033D9F4677059F346830B76FDE56F38426723C5991A2CB3692E8327A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504656, "uuid": "d8de4259-734a-479e-b7a0-132f06a1e04e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504656, "uuid": "1cfa9c26-fe30-47a7-84db-c0c634d9a8d1", "value": "24576:9ybc/Uts77tZO4bwFPDQfjsuuH1QZnAmkRrO64D/nOAlcfJcC:Yi7DO4bwFmjuYAmkVO64znB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697504656, "uuid": "36ddc2fc-04c7-4a0b-94d6-a7cbcc05e7e9", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697504656, "uuid": "d4fed66f-77df-45c7-a04d-e7c1b8af3362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504656, "uuid": "c5dabf16-9583-4eb0-90d9-fa14c385cf51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9b8040-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1697523754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523754, "uuid": "f44560fa-7c18-4631-a87d-09a6717f8faf", "comment": "Malware payload (Loki)", "value": "e9920907b056bdd214b6c23f47b2909e", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523754, "uuid": "ec0d36d8-58b6-4635-bf75-e1d91f8c6f5d", "comment": "Malware payload (Loki)", "value": "1221074a4a7b3af86ed3901e0a805062d266f3e6126d909a38aeea990bca5ecc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523754, "uuid": "f9486176-d011-406a-915c-c228813b6028", "comment": "Malware payload (Loki)", "value": "80788153589a48f7c7dfecec565e586e84aa84a3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523754, "uuid": "da9f8180-e799-468e-b03e-91183700afec", "comment": "Malware payload (Loki)", "value": "91b2ca79a472b4113a18927e55578f50a4579434619cdaa353d1044c6c95210b54bcbf0102dc10a5b87218e83aff2d52", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523754, "uuid": "02b3bd64-16c4-46a2-8b0e-6b23ad44a561", "value": "T189150103E944CA83D40D83F97E533AD91B0EBE25B9E569C715927F4B3B30BE2085B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523754, "uuid": "a1b8f1b8-9200-4f13-975d-adc95d7aee19", "value": "24576:qWQmmav30xOZyvw6Vb3bVtic1XtbWq0T4xcx/Iwzv:PQmmQ30GT6Vb3bVR1lWtTpxgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523754, "uuid": "db800a61-add6-4041-9c64-f5039f054299", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523754, "uuid": "c18139b1-698b-4a79-90fd-613b6f407cf1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523754, "uuid": "0b38d1ee-2274-457f-9b9a-4365a43a25b2", "value": "MV YU FENG4 TRADER_ISO 8217 2005.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4b81cc-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566865, "uuid": "89138f47-a64c-4a6d-a17c-aa762dd34b12", "comment": "Malware payload (Mirai)", "value": "26d7a83f38847a68f44f05e79c55e237", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566865, "uuid": "df699641-4d42-4792-9919-913ab932783c", "comment": "Malware payload (Mirai)", "value": "152954a82347d03b46264d4da2da1d1f1e9b4cef3253619b4b16f1713fdf8614", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566865, "uuid": "23e69dd2-5351-47d0-8001-8a8dc37b5006", "comment": "Malware payload (Mirai)", "value": "873ec2f42ef31cea7551893322df64c1895d75e8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566865, "uuid": "96915ef2-6e2f-4910-8e05-b7198e384fd5", "comment": "Malware payload (Mirai)", "value": "d2e9edaf9ee4a1491d51c82d9af0cc966f7af6b178f752ae23812d566c842f0c3484dca886c09887d97c0a01d913ce54", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566865, "uuid": "572ae6b2-ae95-47a3-9495-ce2b99a586ee", "value": "T1FED2E0E7D2F7A2F4D4F2A8B1346ADD80F69630778324175A016FBD85EBA734C5530A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566865, "uuid": "871ba7e7-a5c8-4f04-bda0-3398a66cfcd3", "value": "768:NYSoXdJZgicCHD+C98MP7L1YVPb2XFPsSx0sm:NYJdJZuCj+CiE7L1APbaFP3tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566865, "uuid": "8ebd374c-3048-4f6a-9468-1818a8afde43", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566865, "uuid": "a614d3d9-6773-4ba6-bfc0-10a775cf5154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566865, "uuid": "689d7bce-a522-4bb1-9c8a-12b962f625c6", "value": "26d7a83f38847a68f44f05e79c55e237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961d48d3-6d20-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697569721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569721, "uuid": "31ddab1b-8b35-424c-a61a-4fefab5a40d1", "comment": "Malware payload (Mirai)", "value": "e6b8e2faeea10ea466291e37c677f2e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569721, "uuid": "432c7361-9400-42f2-a6c6-b719512631ca", "comment": "Malware payload (Mirai)", "value": "155a108ad7b4a5da445b22a79404ef4d95442e6eeccc5befdf6e31ec6cb4e1c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569721, "uuid": "562f5e8a-bda1-4b4c-8841-02e40ef199bc", "comment": "Malware payload (Mirai)", "value": "2861168c29962145bae24b69c5c9dd642324c63e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569721, "uuid": "bbcdf72e-8a23-4f82-b15d-597c07f75611", "comment": "Malware payload (Mirai)", "value": "851ec4aed8db230541236dc5edc5f8c7dfa76ac0b2ea2c725316c8e004ec4aa317337b49833c85d6697b13e70b1b70f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569721, "uuid": "6cbae18b-c748-441a-874b-bf5752d8aa88", "value": "T1D0735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569721, "uuid": "01ca6469-b8f5-46a2-9964-4979dba65cce", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8P:YwfdNu4cmZvFqI3w7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697569721, "uuid": "d5b71877-3b9d-4241-b59d-386d602d8396", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697569721, "uuid": "772520e3-4c9b-4ebd-a8a3-f862a9ff593c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569721, "uuid": "1ceb226b-71e8-4fe5-a5c0-0506b823cc54", "value": "e6b8e2faeea10ea466291e37c677f2e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cdbe79-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697523017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523017, "uuid": "e07162e6-853e-49a2-b6b2-13b4aa000d1a", "comment": "Malware payload (Mirai)", "value": "85515afce78e8b877b408cbea52a95a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523017, "uuid": "98c08ba9-247f-4780-8c68-83aaa6ea0b33", "comment": "Malware payload (Mirai)", "value": "15797628fa14f64688c33f68417ddd79d1f48802e5c4bf062689160549c48f1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523017, "uuid": "86626aa9-626a-4d7d-b868-630ef764b37f", "comment": "Malware payload (Mirai)", "value": "0d2297c27c791d3d493238d53088d5c8a228148f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523017, "uuid": "931b6076-ed91-45c5-8e7a-48d96975c349", "comment": "Malware payload (Mirai)", "value": "dd5febeb81d3d2183b505a28a3d4a8e3482d732f53c66c3edfeb29e9a2dd42c283c375cdf00c7270b533d6ddb0393a89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523017, "uuid": "79631b61-9952-43a5-a772-0ec1d1b30a66", "value": "T18ED33A17B5C180FDC4DAC5B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523017, "uuid": "2eb1c0d7-eba1-4f37-b8d9-59786ee26a55", "value": "3072:tGtwnNiaOnUTKFiPT9OSQ7AOaogjV2iZlBWCgDiAlQPdL:tGtwnNiaOnUTwuLyZlQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523017, "uuid": "75c030f6-bfb0-4c12-8eb3-383221b00bdd", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523017, "uuid": "e05c7364-33b6-4eeb-8e75-d189e931f7e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523017, "uuid": "a5255e68-2b78-4ae3-927e-0c911ac6565e", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63db4346-6ce6-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697544726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544726, "uuid": "46985b6f-015c-45f9-b0af-2ce601792b70", "comment": "Malware payload (Amadey)", "value": "4062111c1f8337a6bf7546f0609137cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544726, "uuid": "23e76270-b41b-4703-bba0-18e2148e367a", "comment": "Malware payload (Amadey)", "value": "172d54adb81b52b317ee5563f6731f6ddfadb9b548f7e27da74172ddad0dd85a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544726, "uuid": "26f1684a-e137-43f6-87a7-b21b0cfd2d92", "comment": "Malware payload (Amadey)", "value": "ee2c4e9a4ab2d71ccee8b03b86686f5fd297a4cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544726, "uuid": "a0dc0391-146b-41c5-97dc-ae47b655a11a", "comment": "Malware payload (Amadey)", "value": "5b36787fd0281ac42a10cec3c7a75466e50515c8f1a97928865330aa460e6d3da7d500b0cb741b18519d3cab9ad252e9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544726, "uuid": "ac7b4311-bc22-4e0e-8858-b3c63ef707f4", "value": "T1E6452313E7E94072DDF513B01CF60787663B7CA18CB88B6A1A95D86F5E325A8913133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544726, "uuid": "e36d69c4-7a33-4f8f-ba95-5c5bc2f9ff22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544726, "uuid": "761d96cd-0702-4ce0-827a-58fa2e072f33", "value": "24576:yyLdRj+Gz1/aLWGM7oHZ0ZKgSlRFG5IVf4f+rL:Z5FtgrMeZ0ZbIg5IN4fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544726, "uuid": "e180eb31-b3bd-4222-8c34-3ba34e8b0c11", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544726, "uuid": "af87cb52-cb9c-419b-afba-a019020237a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544726, "uuid": "dc5b37db-c316-416f-8bca-841fe1286e9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e6242d-6ccf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697534957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534957, "uuid": "34fd5bcd-d03b-4cca-85e7-c72f142bef9a", "comment": "Malware payload (AgentTesla)", "value": "2842a70b7f5d8395c8ced73d1a04397f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534957, "uuid": "f750981c-3bc2-4893-bd24-0354cfb415f7", "comment": "Malware payload (AgentTesla)", "value": "1805fadbb2dec763a89e6ac89aec5e0bba6421ba4921ca2a89fb993216df3e05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534957, "uuid": "965f3f24-ceb5-412b-ba5b-743efeff2475", "comment": "Malware payload (AgentTesla)", "value": "d0ff4826beb63bef19a131ce85eef80c09e77958", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534957, "uuid": "6cfac201-524a-4b5b-890b-bb301242a769", "comment": "Malware payload (AgentTesla)", "value": "e01b953a226f50a750c0af7220ae8b1ae3aab76e099ed019d2d85d17d579b9dbd44add883225921fc39927225a70d660", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534957, "uuid": "86ecebe9-dd93-4e14-a5ab-3a55fe8f8783", "value": "T1AD353339FD4FD5DAFC8E3010613B79E8A4423989085711687EB2CEB071066FB79B2679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534957, "uuid": "38083172-bcda-4e03-8481-0044ccaccccb", "value": "24576:Csa5l2/38Wcek/ISPxmNQMrNGID0/M7ZSMuy3sOs9kQ3:C/lYkQS5swID0/M73u+sOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534957, "uuid": "c768352e-0d72-4cc7-b15f-d9eba860eba6", "value": 1096952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534957, "uuid": "32bcb56d-5e88-4280-8ba7-ed72fefe81c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534957, "uuid": "a212935f-3265-4061-97cc-b20f14365262", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867a3627-6cf0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697549079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549079, "uuid": "48be4d98-ac97-44bb-bd4b-cc5f6563d0e9", "comment": "Malware payload (AgentTesla)", "value": "8ba08664327c5034ac129d137add2d18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549079, "uuid": "e9a777a5-4576-4d47-9955-5d5bc7e57426", "comment": "Malware payload (AgentTesla)", "value": "18262db12d06de1d0f28e100a803d617cc1fc78758362287f5905777294d0285", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549079, "uuid": "0d8abd8f-f2d8-4b4b-8b43-006dcc151936", "comment": "Malware payload (AgentTesla)", "value": "345ad9e48566b9fd8556f92ceacda97edd599f63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549079, "uuid": "15f111a6-0bea-46c1-b721-ab82319a6f65", "comment": "Malware payload (AgentTesla)", "value": "61906ca3a9d632b9f08e9980f73207423df01e9f4a3351450a1948444f2a0e9e867a0132f1fb876b0b30f96a5c2a74b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549079, "uuid": "4e381ad4-24aa-4a3b-bb7d-0710e72cf708", "value": "T19234DC437E48EB11D6583D3B82DF6C2493F2A0C71673964FAF48AEA529512436C6E37C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549079, "uuid": "2d1629d3-d96c-42e6-bc4e-ad806452f86c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549079, "uuid": "31ad1685-eeeb-496e-bd46-4e2e9c415a9c", "value": "3072:R5KrNbbCbGRjq0jbustGomBFOfmltz310o:+rNbbQGRjqab3GoSOmltp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549079, "uuid": "9d607dda-d183-4958-85bb-ede464e8e7cb", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549079, "uuid": "d6481505-f9d6-4e76-90fd-87f025b83e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549079, "uuid": "ea7125eb-e52a-4d17-b655-c85f80b84f62", "value": "18262db12d06de1d0f28e100a803d617cc1fc78758362287f5905777294d0285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2ad9a3-6d25-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697571636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571636, "uuid": "43b7a81e-be87-40c4-b31b-1db061056c34", "comment": "Malware payload (LummaStealer)", "value": "f22a54b71f03f525ff7e6fb77693dc39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571636, "uuid": "6490b34f-c02a-4405-b833-c4e0def6e82b", "comment": "Malware payload (LummaStealer)", "value": "1936abdc527129cbfe86fdb76d7246b6d6ad6719b57a99a8acfb1ef8ee5eaf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571636, "uuid": "619b6b45-ddd6-453a-84b2-c02a0770cd13", "comment": "Malware payload (LummaStealer)", "value": "d21ebdccafb4bcd03c0090da08a6c54fa1d1e236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571636, "uuid": "bc124284-8e56-4d08-bb62-784db0e3f846", "comment": "Malware payload (LummaStealer)", "value": "76b95588fd8198e1e82a44820eff3e216d98a7c10bc131c46df19d5160bf6cbb470ae412cda8898f40be705eda9c1b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571636, "uuid": "7a55f1a6-6709-4158-bf47-6cd227027328", "value": "T15444BF0070D186F2D872153239E0EBB51A3EB9280BB55AEF67D41F7E4F383C19635A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571636, "uuid": "a230b635-65b1-4db0-b338-ecf7aeec2ceb", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571636, "uuid": "0e421d56-8c1c-4a8b-b6b4-d3333fcc40ea", "value": "6144:cR5lyb6crtLHthXcEnc/ilUpEhWqAOijSqGayf:cRzyb6c5LHthM+/xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697571636, "uuid": "99c91c22-d070-43ae-908e-7dcb6d2bd1c8", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697571636, "uuid": "f4dd021d-a7c0-4792-8591-75046fe57866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571636, "uuid": "5d9a34e1-542b-48bf-bd05-ea4935d3b79e", "value": "f22a54b71f03f525ff7e6fb77693dc39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d293c8e-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524099, "uuid": "cec3782e-bec2-4bb1-803b-3d7889550bb5", "comment": "Malware payload (AgentTesla)", "value": "24c96da3438b663a9ace920aafe28800", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524099, "uuid": "133bb957-c977-4078-be4a-f39d03e1c993", "comment": "Malware payload (AgentTesla)", "value": "19403f2b28f601e662b3b06bf15dbfd58f3c076443bcefa56da455fff592c194", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524099, "uuid": "843da0ef-73dd-455a-8587-5c44c3cb8267", "comment": "Malware payload (AgentTesla)", "value": "69b49ade134bcd93df7471e4ef31c00800c6177f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524099, "uuid": "3d515a9c-df4a-4555-92e7-7cb8445da51f", "comment": "Malware payload (AgentTesla)", "value": "38a3864badcee372478a50b777627e01dab2a254db16e8a31e22e0d26189b67b868fe1d8603d4bbc30b1f98567532d18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524099, "uuid": "a94ce153-8547-43ca-9fdb-ca2028e08d54", "value": "T1EAE4337DCF77107DFA94034702F088C84A09E9DEF5E0CB577628D992EE6BA84A4B8156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524099, "uuid": "061273a1-39a6-4d42-9b47-a4c58c3711ef", "value": "12288:C8miMUAEH4Ij6FI0HJEo8C8A2rgM90xwydfQBPnRYiFHlfWvfDazQIoImYnCbNog:rVQHpF3bbigm0xYB/RYiFHlf+f+vfnCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524099, "uuid": "efb6dc4c-debb-4cea-b164-62909bf36d03", "value": 706116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524099, "uuid": "01c4b0ae-d88a-4c40-b8a9-b61509ed23b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524099, "uuid": "bac62615-c986-42e6-96d2-e8c55495397c", "value": "Purchase Order Copy .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b7dea7-6ce4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697543978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543978, "uuid": "8c474c01-07df-4686-8477-75f084392712", "comment": "Malware payload (AgentTesla)", "value": "13334f5c0eabe3d42da0645a606a1946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543978, "uuid": "fc46a3f9-4045-4f7a-a745-5f3e51571260", "comment": "Malware payload (AgentTesla)", "value": "1941fd80fd284baeb6d794cf73f6d0dd2a37fb419bd4739966dc6182842a3517", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543978, "uuid": "1adbf244-9cda-4d34-b1ed-82c0d0244893", "comment": "Malware payload (AgentTesla)", "value": "a835f3e860962fe0a72981554a135d63100ea439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543978, "uuid": "e5d422c2-c52f-47ab-8f3c-cf9b354d5a7a", "comment": "Malware payload (AgentTesla)", "value": "55c6ffd5068ebe8961144b75dd3773cb5dcf9f708aee4781fa52d228a9b65bea8e8b27db8516be04ad22fb799e958405", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543978, "uuid": "84dc4136-81e7-48d7-9562-4e4b35f9aa81", "value": "T15705E18936484DB0D83EC3339322F1438D3D6FE59BF1D61E54C1B7AA67762C8968B246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543978, "uuid": "ca0ba459-2a5c-451b-995d-9df1bbb08296", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543978, "uuid": "d26f9f03-a2e8-4736-b0bb-6c7b99cc047f", "value": "12288:Lf3D5Eu4x2ev1ls3k/KVglhRFmMK986jtDmEyudq+gOxwr:Lfsv1l3ygpKCmFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543978, "uuid": "77726c15-381b-4dc6-8211-6ab83602b0c9", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543978, "uuid": "b2e46c91-6a46-4e18-85cf-a58dc3e37950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543978, "uuid": "8c9a130c-3566-47b6-8982-e1de9be8c64c", "value": "13334f5c0eabe3d42da0645a606a1946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8394ab-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697523778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523778, "uuid": "97875c57-dce5-4526-acfd-506796673b0b", "comment": "Malware payload", "value": "90bf43830eb35be9af84c6eaaef3c103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523778, "uuid": "7abea12f-a456-4edb-a3e3-928808c25830", "comment": "Malware payload", "value": "1994b5aea0ffc20364530c024facd27e8f0733818f1ef59776256f2d7b384b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523778, "uuid": "2622241c-298e-4290-8880-681d85e9d20c", "comment": "Malware payload", "value": "e3f898a52f4adfc187e3537d40858c902cdf925d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523778, "uuid": "67ccd654-1655-4f7e-bfbb-3ee234f47649", "comment": "Malware payload", "value": "e8193a84b340a5b6b5336e4c01ab2a3fa596f13c2f8bac980b3275a77303e52b8fd591dbfacde8123e58afd32c5a9c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523778, "uuid": "0b8c0171-793f-4bfe-8420-3186740c53f9", "value": "T198458E52B46240B2C2052731ECE7A3FEA9788F6A0F318AC39764FD785DB15E1973714A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523778, "uuid": "fb4671ad-34ce-4499-a696-c9a48a0362ad", "value": "7c23581b37507842bd454e05a03cddf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523778, "uuid": "d545da79-5f14-490b-b615-d35b73234c3a", "value": "24576:cAEXKiDI9T4512XfHRX8SbaWR3kM4AyQidz5M6:ceTTtRXPpNkHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523778, "uuid": "ab9cb973-e7a7-41bf-854c-2c5329575726", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523778, "uuid": "ea4ac48b-61e8-4e4a-b014-e17ab07f2b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523778, "uuid": "5e9b5262-080b-496e-b934-13a02dbc28c0", "value": "90bf43830eb35be9af84c6eaaef3c103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb4ed7-6d01-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697556168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556168, "uuid": "e561d71e-ee6b-4525-834f-a181752c4259", "comment": "Malware payload (AgentTesla)", "value": "b6f892c73fa0f491072592d7baf0c916", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556168, "uuid": "b526044c-2e6b-4fd6-b6af-a9beea34883f", "comment": "Malware payload (AgentTesla)", "value": "1acf61ab5912011c1e3bed1fc4bca2b17f1d9098245976415e2d8d40ee3e472e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556168, "uuid": "d2f0edaa-f3af-4ea3-9b0c-e00c609b54dc", "comment": "Malware payload (AgentTesla)", "value": "15c441bf49de3f0a8e7913c7e5b78e7b01019980", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556168, "uuid": "57c4ded2-ec05-469c-83b7-af143d13c555", "comment": "Malware payload (AgentTesla)", "value": "e537e50bacf0f775447e5c5dee8b6bba636ce64ec4d435c06c28471cc4bd8d3171a6f1a80a07cae1602bd9774bc7cf0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556168, "uuid": "4a883aee-e8c9-444d-8033-64b5699e3224", "value": "T139340E02BE48EB15E5A93E3792EF2C2413B2B0C71773C60B6F49AE6524517825C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556168, "uuid": "e69dfd56-ac3d-474e-9d54-d26927528407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556168, "uuid": "99d1c473-5b74-4359-abb1-83b878197e8c", "value": "6144:mtNv3nffb1DpuSYHqD6xD/ORFYWUZPXR:0v3nffZDpuSYjxDMqWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697556168, "uuid": "3c25e22b-bdb0-4ba0-9ff4-c05c352ec47c", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697556168, "uuid": "ef88cb3d-258e-4256-a073-9df7e1e05319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556168, "uuid": "fa8281ad-b6df-4159-a259-c87869ff659c", "value": "16975561666e9292737f8e01bfac06f2e75ef3d4c438b3d210e4258f8f7697cd7f3528cd79896.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1650669-6d44-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697585337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585337, "uuid": "c5c3b182-c181-496b-bba3-d1336fa29cd6", "comment": "Malware payload (Amadey)", "value": "019443cdf5cc72ace6030d6283781f0d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585337, "uuid": "55f838dd-dd1d-43de-a19f-07e7435efe57", "comment": "Malware payload (Amadey)", "value": "1bf0a70f74c8ae159f145be87eddf2ccef31255c0bbee3dfb1056b88d66c79b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585337, "uuid": "2433f6b1-4a29-464d-8e9e-36624cc58962", "comment": "Malware payload (Amadey)", "value": "5e53bb9e7d66aba45f0657e9de587c79e67ed74a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585337, "uuid": "fca54ea8-0274-49af-8173-75ee44cd5f9c", "comment": "Malware payload (Amadey)", "value": "6edade52e9f6b68615edad54227d513c967018011d667282735c2701d11beb69cdf109503537fe5f0ebf8560f735de51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585337, "uuid": "a352a119-f9a5-4f77-ae55-c4fc76936c28", "value": "T106352313ABE48877C97127F428F653E30E36BC52DE788A5F1395A98B04B3684653137E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585337, "uuid": "eed04c9d-92c2-4238-a90f-b8722435c8b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585337, "uuid": "9f6e06b9-4f5a-4faf-8055-c898b233bb15", "value": "24576:xyIN/nDZTL68GxakJ+evoqkjgJJevPI2F99a/vSYRgws/t:kIxnDZT+8GxakJ+io9cJeHIqnaHr+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697585337, "uuid": "6f18b867-aaaa-4089-9481-2dc5a475e52e", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697585337, "uuid": "a6b6eeb5-a4b2-4b29-875d-02c797878218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585337, "uuid": "2252ce00-4a10-4b10-a2ca-8f9fd66cbd41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626ed42d-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524108, "uuid": "bee6948f-bb41-40fa-9485-57db1cccdf78", "comment": "Malware payload (AgentTesla)", "value": "84106a0eb863ea6fd44656095b4e6f1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524108, "uuid": "3dcd9933-2f0e-4e47-9d1e-8ffa4a297213", "comment": "Malware payload (AgentTesla)", "value": "1d4316b5e0e69055fa643f3d47b5ff1004623f20794db703736b45e69412d429", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524108, "uuid": "ddb24ba8-2e4a-4988-83f4-240478c7c45a", "comment": "Malware payload (AgentTesla)", "value": "5f37f81d2067bd7f138cd7555f4447730d23717a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524108, "uuid": "148e3ad4-cce7-4d45-bb4f-056948ccaa0f", "comment": "Malware payload (AgentTesla)", "value": "d5c540da5a5f816924a8d78343cbd7e105f93594a213c1cb5846417969ee0220595383cd6abd228b87944c90e8ece87f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524108, "uuid": "d581721a-167b-4e73-b515-78ea7c66c92e", "value": "T1125112E83FE051C403B9A7A731B52C77DD458CA41B58A0F6E53178AE7400F74DB4A9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524108, "uuid": "ac20ce1b-3f98-47bf-b3c8-fa6c8b2d9590", "value": "48:wtEWWrqqp6nEWOX6z4v2somuZdomJ1yUu6PP/ymADnzP9jq4d0nEtI3hRtT5X8:wPkG4OsomKdomiUu+6m2zP91dGEtI3hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524108, "uuid": "dd2787ba-0a4c-4dc7-8a5b-fbf6ac3e4f45", "value": 2746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524108, "uuid": "d27ae55b-49df-4f98-824c-132b37060552", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524108, "uuid": "0685dd2f-7b9b-4863-9ec3-a320bc8c743a", "value": "Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f98ad28-6d28-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697573120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573120, "uuid": "9366926b-1d68-4e3b-8bf5-ba333372740e", "comment": "Malware payload (RedLineStealer)", "value": "8cdaa29c0c0ada37ec011f278b170e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573120, "uuid": "3259d3e8-c316-42f1-92da-cd8bd5317cb2", "comment": "Malware payload (RedLineStealer)", "value": "1d66857bf69a3f55755dbc450bfa4e22685131211bf10d3545b58d209803ccde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573120, "uuid": "52592b71-a9b2-4625-abf8-8ff5d1e3304a", "comment": "Malware payload (RedLineStealer)", "value": "156be9a8f324782ae5c4b81445464b5daddefe4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573120, "uuid": "842a9bdb-7779-4f92-a67c-9ea494e1f5dd", "comment": "Malware payload (RedLineStealer)", "value": "41f2ae5893743823a219867db6eb66aa46ecfaac993ed5e0839d781aeb7475211887852d76b72a4b1fd3af7af19be846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573120, "uuid": "3e473919-cab8-4817-917c-29cb028a51ba", "value": "T185452357A3F810B0E8761B3044FA02D31F397CE10E7CD6267B9569A96E723847436B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573120, "uuid": "3ad35d03-22a0-4343-8b5d-465f54898a4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573120, "uuid": "9277f8fc-1819-4ebf-92e1-415fecc7b38a", "value": "24576:8yHQ/4imYc9pD0tLYwfiofge+XMXAYX9lsk39pHdgJAnRPC197j:rO6wLYwfBge+659lN3XHdgJkC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697573120, "uuid": "8940d6fe-560d-4d9c-a49e-c840c1a95add", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697573120, "uuid": "2a135501-580b-42d2-87e2-5e409ef0af7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573120, "uuid": "10e1219f-85d0-4b97-b232-2e5ebd60a2a9", "value": "8cdaa29c0c0ada37ec011f278b170e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f0da85-6d26-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697572330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572330, "uuid": "f2c49363-5255-48dd-bf13-32cb3acd292f", "comment": "Malware payload (LummaStealer)", "value": "503456b9cd7bd054897655d9bdd7cdf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572330, "uuid": "f468e898-caa2-43f5-8b92-3a61d4cc880d", "comment": "Malware payload (LummaStealer)", "value": "1dea9c6b0fc19dfd27ab6bf075d698ecd49d2dc7ef0c816e486129ab98dc7028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572330, "uuid": "d94da80b-5025-4a14-b704-9f3ba6a100f9", "comment": "Malware payload (LummaStealer)", "value": "2ceb0a8961449c5012ce960ff4591639a601d0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572330, "uuid": "662c34a1-c3f2-4748-9eeb-a34e62734eb1", "comment": "Malware payload (LummaStealer)", "value": "b5b3e9cca1f0d4992932982cc6a04a5eed563405c5bae820bb89be35685b57eab14668a7067f82dca060bbd7152ded80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572330, "uuid": "ff7095a5-9f47-4ac4-ae83-6abc808c1fe8", "value": "T1C0352346E3C86032EAB85B3494F607D30F35BE659D79975737889E8A2C73A81203536E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572330, "uuid": "46c87fca-b024-4875-a47e-b9bde2b968f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572330, "uuid": "1723fad8-fe29-40a0-8ac6-e723169afd1c", "value": "24576:+yk4yT3cvz0blErjKwfYCs5rNX1epqPkgcB1ll2F:Nk4yLE0b2vrSxQVB1ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697572330, "uuid": "a0777fc2-0a9c-4d4a-8f48-8ba586c7bc76", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697572330, "uuid": "1d96c9d1-1aa3-4084-90f1-1b3872e346ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572330, "uuid": "3c339073-fc84-4776-b995-2504978124cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a06e687-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697523718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523718, "uuid": "40e9d192-516f-4d5a-9db0-6a5945fd9e04", "comment": "Malware payload (Formbook)", "value": "8aa133a7c17fdfac47d771974fff146f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523718, "uuid": "cb786728-ab9e-4c61-9709-cfd68aa1d3ee", "comment": "Malware payload (Formbook)", "value": "1e0726ca49dea56d96644ff9aa6dec2cd1492c479cb046590a2e4f64b544d1d2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523718, "uuid": "c4af9df9-232c-45d6-b535-047c5fc2d4a0", "comment": "Malware payload (Formbook)", "value": "6529661288ded9cabc2ff31e2d15909954daaa05", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523718, "uuid": "a9235f27-575e-4499-864a-706de94977e2", "comment": "Malware payload (Formbook)", "value": "da7329b6881528bcc5c4ac1ab07c5abac72a341db6200c09ba3650de4b9ad7e8393b0ff0b142c64f0900b7765df39cb7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523718, "uuid": "e59ab639-368c-402e-a1db-39e9bfb2ca42", "value": "T14B45D0039804DBC3D11D83F87E532AE90E0E7F29E8D56ADB14927F9B3A71A63095E11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523718, "uuid": "246cf0d9-9987-4538-b49c-b9ce33fc7e5f", "value": "24576:OWQmmav30xKZyyw6V4+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXsG1NZy6w6VHx:DQmmQ306O6VN6QW6VHM6J7fwO6i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523718, "uuid": "c7a5e3b0-78ed-47b1-b5f5-0961b7106781", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523718, "uuid": "23164377-d737-4419-8da9-dc95f5f2b670", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523718, "uuid": "75872047-130e-4506-ad05-6d91ff144455", "value": "\u4e5d\u6708\u58f0\u660e 40981677.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbbb066-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697539911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539911, "uuid": "3f550818-e773-4545-99ec-990192f19dd8", "comment": "Malware payload", "value": "c8342f26932e193b128eec67ae9ec61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539911, "uuid": "224fdc08-48d2-4c8a-8279-17fb373fc263", "comment": "Malware payload", "value": "1e843b7b4d48335c083f18db2aaa1ac8c9b9b2e3aa3bc9f3f526115ae01e6935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539911, "uuid": "89031d39-f3eb-4a2f-b6d7-3c7550663627", "comment": "Malware payload", "value": "341c054402041e47d5dbcd9de39397c78aa80d47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539911, "uuid": "1745b54c-519c-4952-9dd7-ea06a4a8d243", "comment": "Malware payload", "value": "9ea315fa8d0026cdc646de83516de1fcec230409b81fc9ecad4334a284433031a6dbac1514313b4c590fbabf1a056bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539911, "uuid": "52b488e3-970d-4f11-9331-58223282a118", "value": "T1E064AE0438D5F832F8615B7622612BD2AB3FEC380E54AA5FE7D8453E8DA01C5F4D7916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539911, "uuid": "279dfb1e-86a2-453c-89e0-a6061e05c96a", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539911, "uuid": "44fd57c8-85d3-42c9-9b77-caaf5daa9f7b", "value": "6144:CAK3l99cV4ESC8MqXS0TGWZnqK8v6QaWiq6cu7UETiXR3xnd:PK199QeS0h0v6Zlq6J7NGBxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539911, "uuid": "e5a10c9d-20c9-483a-a0fa-dbf907b59792", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539911, "uuid": "2e1d16f1-b442-4cf6-a4dc-794990627b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539911, "uuid": "08143d84-15b0-42da-9498-34a0d730f5e7", "value": "c8342f26932e193b128eec67ae9ec61b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55799814-6d23-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697570902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570902, "uuid": "3dabd565-1e27-4b82-9531-202277430352", "comment": "Malware payload", "value": "6b853fda4210778be3bde1546866bfdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570902, "uuid": "51500828-2f08-466f-b306-26d0a567916f", "comment": "Malware payload", "value": "1eb861182ffc572ca9b4b2578b6a47dee807fe033e74bf29940e4ef073854e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570902, "uuid": "ed73e663-213f-4fad-b3f6-44b10f58f3c6", "comment": "Malware payload", "value": "7dbb163f84d3895872a89b02e6a83d73aa569cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570902, "uuid": "721415fc-77b8-463c-9cf4-67fe525d9066", "comment": "Malware payload", "value": "8f685727c8d6b741da66d3e431cea2fc73127c2fbfb9c93f0b01ad9abe17158095d90d6aba529d8f2d65456087c7032a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570902, "uuid": "69102bf8-9f6d-4715-b6f1-e00faf9a9e7b", "value": "T145352307E2E991BAEE7E27B018F607471A35BD19CE39935B7B849A090873784713533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570902, "uuid": "27095438-0f8f-4c40-8a67-66a5e6754b01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570902, "uuid": "23000c2c-f9f6-418e-a4ea-deb95929a527", "value": "24576:+ykvySXuVW0ul8uOdLFGkq82o0fbJk5dI6Dbp4hvRxGUXcg7Lua0:NWzKWfl8FFGV7ba/DOhvOUXX7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697570902, "uuid": "f6e447bf-0b79-48ad-bc9e-bb2faa17843b", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697570902, "uuid": "609a52c1-f1f7-4353-b621-7da9f1908a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570902, "uuid": "efa49898-1134-4274-b54f-83621dbf96b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0b4637-6d24-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697571312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571312, "uuid": "64b3a17b-523b-447d-b972-9314271cfc2d", "comment": "Malware payload (LummaStealer)", "value": "4971916109c7b79ab4963ae78b0c0909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571312, "uuid": "511b1183-0bbd-415b-bb6f-de357540896c", "comment": "Malware payload (LummaStealer)", "value": "1f5ccdc56c63f7fc5936b5d8e8efdaf497a941760235c4a0e3eb10c9b7433a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571312, "uuid": "94cbf043-6887-44bc-af87-8bf75ecbd1b1", "comment": "Malware payload (LummaStealer)", "value": "ed2798dd88620276767f8666357b6e8dbd57ad58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571312, "uuid": "f9c9999b-996a-4f63-940b-8f603f0797b5", "comment": "Malware payload (LummaStealer)", "value": "7960a7e6fdd0ae7ff0ee2a1327a3109e85a835a821c43397ee605c02b5fed0de2cfce7f9824aa8df574f57df40fc9f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571312, "uuid": "ff736df9-dc78-4f41-bd31-0d62cd67cadd", "value": "T13E352303A6D85436CE7627715DF607930E3A7D645CB9538B3780FD8A1CB32889A3672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571312, "uuid": "42f554b9-926b-481a-b849-b80f56590008", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571312, "uuid": "79864811-8999-4b84-9cf4-cbc4374c1f4f", "value": "24576:KyGoIbHitwIJ00B2fD80rXtGVOWjSqQfSlfYE0a0n:RGxTKG0sRwVOWjWfSlQ60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697571312, "uuid": "ec908c7d-5744-421d-8a4b-c394a6a6c3a6", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697571312, "uuid": "6d10aa2a-4c79-48da-91f9-7396d35ab0a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571312, "uuid": "66ae84fe-06ff-4369-8b4b-6011004a5ed2", "value": "4971916109c7b79ab4963ae78b0c0909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde13aeb-6ca8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697518275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518275, "uuid": "298ab5bb-554e-43bd-a7f8-02980a555476", "comment": "Malware payload (RedLineStealer)", "value": "6fe0f131647d79d3ba522fe8ba564402", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518275, "uuid": "dde6e5c0-74dc-4d9b-9a38-b90b5052c46e", "comment": "Malware payload (RedLineStealer)", "value": "203c314e7916381a2839cf85744febf7919d0267a33d7831f8239aa191cf9892", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518275, "uuid": "c55e22f6-4366-4ac9-bc38-6caf6c915543", "comment": "Malware payload (RedLineStealer)", "value": "78f5e4a96d6e4161c773fbea98a44f02bb1d7a63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518275, "uuid": "26431c66-9954-422b-ba7b-b959458c0a63", "comment": "Malware payload (RedLineStealer)", "value": "9cbdd42aa28fca6c31c5f6062fc9f839a52987dfc7b2e7e16335f0bb53f6d13ed5892ae218b45c5446a1fbc55605838b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518275, "uuid": "7b61daad-85c9-4197-8953-32a47cfe5a83", "value": "T11A943CF2659E8020F46014760ABCEEDDF64823D806F12D47AA9E9FEFB082559B4174DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518275, "uuid": "2d6d5474-a2fd-43e5-8850-f1aa18265001", "value": "d9695adf5088d4aed8e28d82cde0c102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518275, "uuid": "b42b7c2e-e22c-46c7-b3c5-87bde4d1eb77", "value": "12288:AmZHyd0upzBhNX5ppiJLlgtKeC4MxoO2:AE0LjNX5p0BZvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697518275, "uuid": "994c54db-c0d2-4211-b076-77afb83c7bf3", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697518275, "uuid": "8cd25707-eaa4-4c46-952f-a6560eaeeee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518275, "uuid": "172a28aa-457b-4aec-93a8-b2218a93b51b", "value": "6fe0f131647d79d3ba522fe8ba564402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a50c41d-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697524121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524121, "uuid": "e4c8690f-737a-47b4-90b4-fc99dfd18f46", "comment": "Malware payload (RemcosRAT)", "value": "fc1e09c67a3505f6d4a702e7f58deac4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524121, "uuid": "d1e224ef-a315-47f6-9580-2dfe690a2f69", "comment": "Malware payload (RemcosRAT)", "value": "211a0b24bcd2fab78797d162ed00409bc6f00bb4e80620c49e6f01d55c6c8a1e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524121, "uuid": "7008bc99-2548-4cc6-8f82-07b5c87fe00c", "comment": "Malware payload (RemcosRAT)", "value": "2c55cc45b0dfea16792f97b519332855e9d7f597", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524121, "uuid": "eee9d73b-760f-409c-b770-ad23fcc80c2f", "comment": "Malware payload (RemcosRAT)", "value": "4d9143dc88bb57493151a47954a4d70c1d99cf79941d4ca34d3d52784de099e6b0ebd10afbf11c50a91787495e577a79", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524121, "uuid": "db2ae69b-5af6-4c62-8a0f-0d6acdba70e0", "value": "T145946DB1EF58151A0C4B37EAEC414C81C5BDD16A5927006AFEDD17CEA10B59CA3BEB0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524121, "uuid": "381d0b67-e1fa-42e2-83e2-809709de05a5", "value": "6144:ujjeS3wAyTL1Ah3vkFQBxjhVVGPGqTUpWig9xUsbjTc2RmlLStXS/tEt6XFJHv:Meky31ulTVD8jvbPL6rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524121, "uuid": "b3194f2a-7323-4093-a033-85a42bb26e0d", "value": 437983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524121, "uuid": "4cecd7de-4684-425f-b48f-84d4a0f6a34a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524121, "uuid": "0bfef1bf-c662-4ad8-8a90-8b9f6a7c7acd", "value": "Wycena na tonery drukarki projektory.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273c81ed-6cf6-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1697551497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551497, "uuid": "e9f0d4bd-6a8a-4de4-8815-7b0893ed4580", "comment": "Malware payload (zgRAT)", "value": "e0154733596f482f5feff0f3b5b5cadf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551497, "uuid": "9ab906bf-4516-4384-9dd3-7df604883322", "comment": "Malware payload (zgRAT)", "value": "2143bb3e491fc837475ca29f2dc9fa67f4394c4a38da62ac45e4564678cdbe16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551497, "uuid": "f95f04a2-3609-410c-938e-930737d3c113", "comment": "Malware payload (zgRAT)", "value": "6f41e3d51d86ab551f1dbb91659e518c3ffffd31", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551497, "uuid": "5d5b2bbc-08bf-4985-8987-aa3b820e93aa", "comment": "Malware payload (zgRAT)", "value": "9d9c3c81bc6004da3c7b64688aea320d5dd350fb1eafe509c06a8f32bdea76378c4bb5229c562104e9b46560babb8732", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551497, "uuid": "fa353008-2b51-4813-90a7-fa3e92e16f4f", "value": "T14CE5BE05BA9ADE6AD3C42B3E612755284A39E2133717FB1F1F7C06743D923744A823E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551497, "uuid": "a3bb6f08-f838-47ae-b998-6ffffa3e7ecb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551497, "uuid": "7a86701e-57ad-4fb8-8a53-4253b5cbf6bc", "value": "49152:65bdzxx9zCKNNprxuDGGynmsvwzqZMSoF3SkgYybFaf2t60Wzw8rfv4YryVn:655Vzx7TGynJ3ZBbca6jzwKv4Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697551497, "uuid": "b8a11c38-927c-4653-a303-e0e9e04a9321", "value": 3252736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697551497, "uuid": "137511a5-f7f5-4898-9e4f-523fb0c3834d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551497, "uuid": "e36f3173-ca33-4d5d-9769-3271f098ac6e", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a0cf5f-6cea-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697546494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546494, "uuid": "42dd8502-8bea-412c-83e5-71aa0974ee4a", "comment": "Malware payload (Amadey)", "value": "789c47c2441ff4c13b4f6e1e4de0fa24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546494, "uuid": "82c891b7-01fc-4eec-a9bb-a04b582c13c2", "comment": "Malware payload (Amadey)", "value": "2159e74387f64f331878f65c567cc7e96db51032407d24493e2d24eb382ac7a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546494, "uuid": "3f164ae0-33ee-442f-90ba-4eab6ac55501", "comment": "Malware payload (Amadey)", "value": "97687f68a166cd4067d05d6e5fe67f541e966f07", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546494, "uuid": "efad0f69-b9c6-4233-b473-e56355626246", "comment": "Malware payload (Amadey)", "value": "1a886ca86516afa4d1c50b9eebbbe28aa5117086256d09cab2e22e3f08d2cc6560291dca6a2149740c3479ac0630f963", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546494, "uuid": "132f5e03-47f2-46a4-b907-c0a2ede7793e", "value": "T18C343AD392E13D55EA264B779E2FC6E8760DF1508F4D7B6922189A1F08B10F2D273722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546494, "uuid": "07b11c3c-0d8b-432e-bf43-5a6ae566bd58", "value": "16c23701599478a5f3c58f9b8290f3cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546494, "uuid": "1c0a6a9f-a302-4774-93c7-0f64645d6046", "value": "3072:oO12I/qTJ/5QTw2Vr29fhLoTV88PD51RfOdFNBkL:11HIJhQTrMoTTRGLoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697546494, "uuid": "a90c9b1c-43fa-443d-a706-6b5b8ac92ec4", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697546494, "uuid": "49c0a807-fe00-463b-91a2-3fc28452a69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546494, "uuid": "6aa4b0a7-a6ea-433a-b269-6d769f01515c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b526ba8a-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697522958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522958, "uuid": "f35165de-1bf2-4862-9126-b8ba04807a1a", "comment": "Malware payload (Mirai)", "value": "cfad0733da90b32503548136cdb61d0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522958, "uuid": "5394e815-9571-4051-b013-fa37d7bfd021", "comment": "Malware payload (Mirai)", "value": "2172a03480108e7ee5bc014ce42cc5c98e7072901ed03004d231463e45f261b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522958, "uuid": "ab44a055-9a29-4d49-8141-bb9cb42589f5", "comment": "Malware payload (Mirai)", "value": "141a62bd71a328a170b96050b569459e077167c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522958, "uuid": "556d2b37-4d9d-4db5-87fb-8b55eec94ee0", "comment": "Malware payload (Mirai)", "value": "361b677e06934977d84ef5f87361cac09cb9701ade51760514200723fcca451dfc1fee78b23e5838737ab48a9d0de537", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522958, "uuid": "412dae67-9fb0-4c9d-9eaf-1e6f9d8341ac", "value": "T1E9D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522958, "uuid": "ca0dcb84-d0b6-41d2-9441-82be067fbe1e", "value": "3072:AHZ+XPAo7xFOV48wlPJHQRTaPuU8RSON9LSoibM:AHZIAsAV48MPJHOJ92oig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522958, "uuid": "d9d6ccb8-d6b8-48fd-920e-6b2d738b0a02", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522958, "uuid": "8bca047d-4a5b-4ea0-ad75-e6ce7a9a373c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522958, "uuid": "0065b3df-2dd0-4c2c-935a-749cc4d0e96e", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15417cb1-6cb7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697524408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524408, "uuid": "dcb3d2cf-7921-4e68-ac74-038893041254", "comment": "Malware payload (RedLineStealer)", "value": "26cc3e7fc96a0b851f60b5feb36b0e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524408, "uuid": "7241db2e-6539-4835-ab45-a72b2518bb19", "comment": "Malware payload (RedLineStealer)", "value": "23a4181ee39dcead841bb6132a536ad0412245babedf9b7e24d8e9bf542ce482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524408, "uuid": "85987b85-fc63-4412-884b-085bd72bed31", "comment": "Malware payload (RedLineStealer)", "value": "83f80698d0d9f7c22a6a562ae7bde05abab9c4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524408, "uuid": "db4bd80b-03c5-4c05-807c-218274a3b939", "comment": "Malware payload (RedLineStealer)", "value": "d9962efe148ad111db3b070159b1d7047b37b4999775f538c40f9802bcbd8ddf110fb28bc21dedfc6ac12ce8ed64efff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524408, "uuid": "c688c968-48d6-4c7a-8758-40e18aa50a3e", "value": "T1A555230363D14172D5F91B3058F207830A21BE529E7865A63F4DEA9F2A726F4797133E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524408, "uuid": "59ae5e2d-22e3-4fea-b78c-b6b92d75c833", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524408, "uuid": "db325d89-ff66-4dda-a2e8-95e69f2122f9", "value": "24576:Yy1fzSC+Rv1pZqmDiyngcovwUWe21hnCxsdDAApDHH:f1r9+1rgcGWeE1DFZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524408, "uuid": "58ea666a-808e-4c04-863f-c252104cc789", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524408, "uuid": "278f4495-4b87-4ce6-9ce6-8054746caa02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524408, "uuid": "edd15372-596e-4e37-98d8-c72bfad0df95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdb5989-6cba-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697525869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525869, "uuid": "8cd8905d-75cc-41eb-b386-829e00a5e334", "comment": "Malware payload (Smoke Loader)", "value": "40d6dffd041520837a747b09cafc1147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525869, "uuid": "62a2668a-1896-4459-a80f-1ea5a073998d", "comment": "Malware payload (Smoke Loader)", "value": "23c6e695b71041eda3dc7a6dd33a2f11bbe31fce4b1a6c94f8140bc525075eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525869, "uuid": "7bb0caed-736e-4e53-bd63-a85d0d31c6a2", "comment": "Malware payload (Smoke Loader)", "value": "2f67ed5302d902cf4118f86494096940d69fbe98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525869, "uuid": "3a6f3941-a0e7-43f4-8945-9a4c23116898", "comment": "Malware payload (Smoke Loader)", "value": "cae4926684eab75b6e324e374a71cb5fc482cfad87255037c7e183f1ce850bba528088e01f315f3194f34fa4057a344a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525869, "uuid": "06b836b9-d61f-4c16-9bdd-c34ba1dc1afb", "value": "T165552313E6D81436F5F527B025F64643077EBDB22C70836E6794983A6DB3188A13A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525869, "uuid": "afe62174-d0eb-41b4-ad81-bb7e9920d0b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525869, "uuid": "35c74d91-fd30-4623-97a8-7642c4f6eb01", "value": "24576:0y5QYpyFpreRfSbr8j3IXuL6OmIJwYJKDbrQnVFylIrMmgq5CFoEz3ePwSruugc:DzyFpO3knIJwBb8VstFfFoEzuPPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525869, "uuid": "67f07975-91c4-490a-88b7-aa3a641f73ef", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525869, "uuid": "618ff61c-96a2-449c-9844-144001420ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525869, "uuid": "42d7c7bc-686d-4a3a-89a2-b12fb5f0bf77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee8a39e-6d0c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697561281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561281, "uuid": "4e55b6dc-4b53-4474-9341-4d0b81da3ed1", "comment": "Malware payload (RedLineStealer)", "value": "5d6dd84b762493e609b97c98aad95b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561281, "uuid": "7b7048d0-1229-4060-b8e9-b1ea735d5586", "comment": "Malware payload (RedLineStealer)", "value": "2434a9706c210bbda5c8bc42d5245f307d288625722889a79e784a4af11c6723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561281, "uuid": "10b8073e-da93-498b-8889-227119eb08dc", "comment": "Malware payload (RedLineStealer)", "value": "99604c36931ad0761d6132069e69abe729191267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561281, "uuid": "a240128d-22cf-48af-9ccb-89a02c3c53b7", "comment": "Malware payload (RedLineStealer)", "value": "cdf2965c172a6f556322356d7a4c0c5c3b35ffd01f618ab9183c487581c0ea33ca5aa820226269aab0715683da0d5d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561281, "uuid": "d3c45a9e-ecab-4be7-b32a-59d268f4b303", "value": "T1B0252306B2E45031E9B5437069FB53A30A76FDF29E68426A33D5D95A0CB3AC06435B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561281, "uuid": "1c0551d1-3f35-4f36-be61-bbeb52e1bd47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561281, "uuid": "272db160-1811-4290-b156-f0d4988ce8d8", "value": "24576:iyHKHHr8R0Q0dXedx99WT5Gk+WjS4PQ0GqXxr:JHKHHgRX0NYz9Wp+WjyCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697561281, "uuid": "f5b53032-0d38-4ec2-8df4-0009b530dc38", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697561281, "uuid": "77bc67c2-8744-4cdc-b697-0512453a914c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561281, "uuid": "03385586-01d3-4b4d-96e3-13d255ba7f37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c416dd-6cff-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697555494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555494, "uuid": "a023fe0e-690e-47cd-ae8e-cd1f17ce273f", "comment": "Malware payload (RedLineStealer)", "value": "2f943946efaa3e446ee3cbd43a540f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555494, "uuid": "24a881f6-2864-4c12-9451-ac3996a1704d", "comment": "Malware payload (RedLineStealer)", "value": "24583182ec1b84afbbe4df0f74bed1c0a378905f7c2a9136eb6dbd65c0811e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555494, "uuid": "01f21d7c-5700-40f1-985b-6723279a3bec", "comment": "Malware payload (RedLineStealer)", "value": "9c6638c26d541001b572b22a4ffe44c12d925120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555494, "uuid": "33c17c54-5f17-46ca-8d71-351a6dcfdbf2", "comment": "Malware payload (RedLineStealer)", "value": "c2498afc5f50ff803060df3fb59eaf8477f2729a4271bb6677884f9bea34c8bd93bb62c28e845c65fad7ae5b1fa42c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555494, "uuid": "a5a335be-b8a4-4c34-b8f6-578f937a8da0", "value": "T1D3F6AD12B3FC01A9E5BFC278C9A74517E7B278491720E7DF165486692F23BD09E39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555494, "uuid": "41403809-0af8-4679-9517-ede1915757ed", "value": "6cec7edefbae8ff608d630f3b5df02de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555494, "uuid": "7e2610f9-ee9c-40e4-b74f-246a0b825009", "value": "196608:ZU3EEacrhPmCVA9NG6YrYgWepN1YWtJlrnzFtrWfEFF4ch1g:ZcpHhPmCVAe6gVYWtJRrrWgKcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697555494, "uuid": "22bc06bf-1237-4224-b886-b4f813b21bc9", "value": 16148312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697555494, "uuid": "1e87a6ba-7930-4cea-bad8-61d0a7855e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555494, "uuid": "43e05580-d739-4ac5-b81f-fb43aaa0b707", "value": "EngineChromium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9179d754-6cca-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697532777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532777, "uuid": "bad0d226-fc0a-435b-aff9-7662ab14c7c3", "comment": "Malware payload (Smoke Loader)", "value": "8264b091a0fcb236b04d8098773b751f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532777, "uuid": "e17d7d27-a664-41ab-be28-0327aba55a1c", "comment": "Malware payload (Smoke Loader)", "value": "252de0e367349a6a5f9fde4b7566f805a56987503c4a0ef8449c76fe08a79b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532777, "uuid": "f25441d7-25e3-4a1a-a66e-d7cbe903f807", "comment": "Malware payload (Smoke Loader)", "value": "ad4a01ddd53dea3421317e223494f3ab0fa0dd87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532777, "uuid": "4215a643-1b72-45ab-9510-e29e205cfc9f", "comment": "Malware payload (Smoke Loader)", "value": "c3d8939fdc272ac86702bdef8c12b03d8e10117a93ceca33a6179712642e0df823803c27ca4cc87b53541857b9fda995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532777, "uuid": "8b380774-b09c-4759-ae5b-92bd43b11842", "value": "T18F552385FBFDC071EA766B7215FB13870A353D919834825F0746EA865CB23A021B673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532777, "uuid": "86bbeb73-1953-4a7b-b5bc-8597287a1d9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532777, "uuid": "205408a2-4b82-4313-9d91-860e19961d70", "value": "24576:JyR577Okez/rLH79DRmphx5sJeasxZln0lJBfuiL/F506yroRRhve:8Rx7OkMzz794ptVv0vL/FTw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697532777, "uuid": "162ed5df-9b31-43ab-8a58-957585491798", "value": 1281024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697532777, "uuid": "a0be06fc-749b-4b0b-a2f0-b667c2e8ff3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532777, "uuid": "6ef446e1-7a6e-4544-ac0a-203ae2b1abbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f934f639-6d03-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697557432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557432, "uuid": "44fe35f5-364c-4265-8aef-8e2c21ef40d8", "comment": "Malware payload (Healer)", "value": "44fadc7ff5089a660f20e84491564413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557432, "uuid": "6ada2a0a-8e64-4d88-b4c1-fe6cf80055d7", "comment": "Malware payload (Healer)", "value": "274602f22d15c9edfaa9170361b6fae8593699ed5d37efd259e2363a66bd666b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557432, "uuid": "8a705acc-d051-4a8d-b58f-d49b7157595e", "comment": "Malware payload (Healer)", "value": "bc55f02398f9d4754267dd6ec32f8ce32b81a0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557432, "uuid": "0ff6d852-7992-46f8-8929-f22e7254a0a9", "comment": "Malware payload (Healer)", "value": "04363e030fa52c00b93393b92351377034a72c54c8566f578588d1aeae6490cfc506b2eefcfdf8c3bcfd18a0b22df499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557432, "uuid": "f572df23-c29c-4d35-a7e8-f543fa65c011", "value": "T1CA252242E6E40432C9F927B56DFB93431A3FBC615C2447623744D9AE8CB3291A57237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557432, "uuid": "976df5ec-f50b-4e0c-bcb0-d5c43a11b1fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557432, "uuid": "a22e4249-25d9-4fd0-8192-ea4f2981c2ef", "value": "12288:WMrmy90n/LFPEu33VEA1x/KkzNP73Yxbp4YM2ixo53HtT6Aro9UIUQZf0ZHp/7nC:EyyRVEAXKk13YohxQdeAro2INl0j7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557432, "uuid": "e20b87f5-db66-48bf-8415-2810f1c3a190", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557432, "uuid": "a236d9bf-529d-43bb-bc93-21f3fd6b0ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557432, "uuid": "94218abf-6133-4957-85dd-ecf1158717f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfb9fc1-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697523748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523748, "uuid": "2969265c-d12e-4471-b6cc-6c00a86cce14", "comment": "Malware payload", "value": "7c076ba52ee4bb2e22204512ce665b9e", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523748, "uuid": "d7b3f637-e312-4c4e-b192-9c826f28ce20", "comment": "Malware payload", "value": "2827bbea71a2c90a1b3ef41239292c4803b78bd3bc18b7ef810d31bd9952d39c", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523748, "uuid": "b8ccf11d-2144-41e8-b47b-fa1e20c0d4e4", "comment": "Malware payload", "value": "d30e3e26802d95f1931ecbbe5384c4ee78ee62f2", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523748, "uuid": "f559d05f-3090-4f6d-a9cb-326921a0759c", "comment": "Malware payload", "value": "b01e6cbf4bbe477c1d238b1fbc1bd6282deca8829116c8103016e0dfa4cc2337fe510148f0ee0e6eeb63e7f355201b8d", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523748, "uuid": "cc91af7d-b0fa-4a86-aff6-d6c29a1006fa", "value": "T18D44020432A5E08AC1F75939E8D688E70904FC378DA7929734C573BD69B2D4B866D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523748, "uuid": "466176dd-c521-4766-ab88-a7e69a68b8db", "value": "6144:HTOLsciuXARh0k5eE/3v/p7XXXXXXXXXXXXUXXXXXXXXXXXXXXXX3nwUyTyr8+PV:HTV4XiykbvXp7XXXXXXXXXXXXUXXXXX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523748, "uuid": "8e313459-7fb4-4bfb-86e8-c2846afec607", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523748, "uuid": "9d907816-75f7-41bc-baee-d80368c4534a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523748, "uuid": "fc56d66f-f642-4b34-8e18-de5faefa4bc5", "value": "Pedidos.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ad243b-6ce4-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1697543969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543969, "uuid": "37aa97fd-cef5-4038-8a57-a296e6149d1b", "comment": "Malware payload (Loki)", "value": "5ef78dac259378fa6e65cae015535f97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543969, "uuid": "8f25d116-0a0f-4d3f-8aac-ba32d78f2ef4", "comment": "Malware payload (Loki)", "value": "28339d3e1ef5ac3f3efb6d55183c7e67107e64a9c660b2771a407eca09be4a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543969, "uuid": "3cb27dfa-b6f5-441e-b526-e96a6ee985ab", "comment": "Malware payload (Loki)", "value": "28e015e194a71b2e22074b5db8d14520142342db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543969, "uuid": "79e85d39-454c-4fef-b5c7-730b5a28fd43", "comment": "Malware payload (Loki)", "value": "5fdb77acbd17943b1812158411105c41e65104b8056522edb7a7c93a088bb7b6565a60252b8ab01f34f54c2b3cf17cc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543969, "uuid": "50f159ab-b14f-42f5-8444-dfc53938ca73", "value": "T1BD344A13D2E17C44E9368B728F2FD2E87A4DF6508F497B65261CBAAF04B10B2D663741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543969, "uuid": "e566af14-d070-4d5f-90b7-8cec70d6e438", "value": "da3e442c2d2024285cdd03f77dec5d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543969, "uuid": "aab6a211-c0a6-45a7-8a9b-fea3816fc1b0", "value": "1536:TrAg9fag7qyUY4msp/nmxYbUtjYFV6wEddj6U/RB/6RvVzb9KW+jj+F37DIJVHS/:PTzNd4OYsjYRE2FhyWDIJVHSmr5UhxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543969, "uuid": "79165ff4-451b-4334-b3ab-2afc5d1bd30c", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543969, "uuid": "126bfb2f-da8f-41ee-a769-7215dbaa87ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543969, "uuid": "0e57134b-3fc5-420b-8c52-d20763816016", "value": "5ef78dac259378fa6e65cae015535f97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df75b283-6cb8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697525177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525177, "uuid": "9251d03f-9bc4-44ee-99b4-7f0a54a35849", "comment": "Malware payload (Smoke Loader)", "value": "e4dbe13616b1fe52cb51edda23342475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525177, "uuid": "fbd92e5d-aaf1-4db3-bd1f-049033bada2d", "comment": "Malware payload (Smoke Loader)", "value": "2ac845aa6b9014740e3adf214539970a24dfcbb74e23f78b94a7fa5918ea13a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525177, "uuid": "08a4c213-b1bc-4895-aac9-310a3e4b61a4", "comment": "Malware payload (Smoke Loader)", "value": "67a0473f6fdd529efc88c4ec6611753b96ecaf86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525177, "uuid": "b1d6574d-8328-4179-85ff-f3c0311edc84", "comment": "Malware payload (Smoke Loader)", "value": "5e98936f86169b5abfcf9bf7e31722c3beead88f0c216f102236df65dea4a061a4aa6442480e7f48c2dd06b7f94ac262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525177, "uuid": "6122f9a8-d305-4d22-9d09-ebd564195541", "value": "T178552397B7F501B2F9E13B7048FA12931D36F8A65D3481A727E2944618B2B49B43373A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525177, "uuid": "bf51afd5-915c-4f75-b0a3-2d50c65887d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525177, "uuid": "03fd9de1-3ad5-430e-87de-a384130e672c", "value": "24576:4yDJKyT960JI0zYRNjemotHFIeT7GNsQv3qwG5TPQiZWvIqFlCEfT8fNH5ecFnqU:/DQa410aKmovIeTDQv3qwEToiZWvtFpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525177, "uuid": "e96bdddb-dfb8-466d-8877-380e3d0ca388", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525177, "uuid": "5beb7759-b993-4d75-82b3-ec04622829ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525177, "uuid": "570ebe2a-f90b-4bf0-ab0c-7e1450fed248", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85253f8c-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697523307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523307, "uuid": "8612ffb2-8527-4745-a95b-fd22a8eddbf4", "comment": "Malware payload (AgentTesla)", "value": "5f1c366fceea36d13aedbf6be98ea1b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523307, "uuid": "d91eed18-f4f3-4e12-aa70-fb084cc630ef", "comment": "Malware payload (AgentTesla)", "value": "2aeaad10ec2e9f4fca55539ac0b219bdf1286766c0c057673fdeb5902673ae63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523307, "uuid": "da3dbf34-9f04-4fd2-a10d-fc3815b7475e", "comment": "Malware payload (AgentTesla)", "value": "0d8c87eecb35ecd27a5e2ea0f06630bf4753ea96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523307, "uuid": "704289d9-96ce-4f00-beba-2767a1d1fecb", "comment": "Malware payload (AgentTesla)", "value": "dc42d35557b09915db89f4f8ffc6bdc99abc55f6f48521d1aec09644162f68394c1ec5a4f1333cfdf30c5a2aebf50c6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523307, "uuid": "06bbe80b-a124-4fe5-8a70-f07abbd94d61", "value": "T142E4233765FA9F004752316ACBD9C8F76B34BBC3D577C45487AE0A806DE040AA75EA2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523307, "uuid": "08d4e6a2-6de4-400c-9052-f56227a0e40f", "value": "12288:B3dw82EN97zncadvMAljVbcQcHZ0p77hrfUiUg+cXGwmIWsUsEvbHy/0L2gV6S:BNn2OB0AJZcQcHip7FrV5+5wmSUNvbHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523307, "uuid": "47717a79-031e-42b4-b725-8f54e21ffb46", "value": 665178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523307, "uuid": "3ad6fd48-ad8f-4def-b689-caf1d4e98dea", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523307, "uuid": "61b5b5ec-2776-456a-807d-7ab7e46be460", "value": "ORDINE CISALPINO SPA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c141ed9-6d04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697557545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557545, "uuid": "8cf4f3ed-6d56-493f-ac58-0027729fba1f", "comment": "Malware payload", "value": "ee94ffaf444d0b7d86160f316e72e1a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557545, "uuid": "3c5bcf00-9499-4d86-b99a-c93991fd3823", "comment": "Malware payload", "value": "2af3294c92290b7a5215d444910c018fca64d5d017daee5a8188f9b386e7cb63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557545, "uuid": "8bcd65ae-e938-4166-843d-2502103dce17", "comment": "Malware payload", "value": "d5788251a16da588179a0fb64881518ee4a87724", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557545, "uuid": "4172a5ee-ace1-47af-a2bd-f057e80f9841", "comment": "Malware payload", "value": "5748b6278b6df525132be1cb53428c418d9fcd22f36fa5abd5b39248e33cdacd07609702ff972644c073b44da0c17b4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557545, "uuid": "4f3a1d88-d24b-43e0-b17a-82aa44515056", "value": "T108D35B3272A2C0F2D44E517E08669B0A9F3BBE53DFA545C33BA43B4D5D712D25E3A242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557545, "uuid": "de763ea1-949c-49c6-bf87-faa159f02b27", "value": "ba30e0937cc5a98b403f8295a32ca3c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557545, "uuid": "5948b19c-5122-4de2-b395-bae71ca459d1", "value": "1536:1/UizSckS/vc2jUKkJDcJrV+Fcx3ckPsrgwS3noI6PtWJvg7f:1lzSc1voKcQVz73P3orPtW9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557545, "uuid": "cebdeeb2-7039-4862-b2bb-ec7ee9605899", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557545, "uuid": "c2e1aff4-d8fe-46aa-bb33-47b58a4df2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557545, "uuid": "b0bc7928-c1f9-4d2a-8be2-1317bd8907fb", "value": "SecuriteInfo.com.Trojan.BhoSiggen.4259.18569.29843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c511d05-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697523293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523293, "uuid": "62a79488-4e75-4c5f-b519-ff2a962e0b34", "comment": "Malware payload (DBatLoader)", "value": "5a0f82d211646ac86c26a88105a46adc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523293, "uuid": "8c7862fe-70bb-4388-b0ab-02c96cd31ed6", "comment": "Malware payload (DBatLoader)", "value": "2b9ac25871c45c3d48d4cf24956a392cbad79c08ccdd9ffc04e957cd354af6df", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523293, "uuid": "9f1235fc-b7b2-4bd6-968a-7d1f08acc489", "comment": "Malware payload (DBatLoader)", "value": "cd742a3993f7235a8266510ed6290ed27f5d3c8c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523293, "uuid": "a3cdde84-3964-4ca7-b2f2-4e1092505c82", "comment": "Malware payload (DBatLoader)", "value": "ef8e538a552c9131df2282fbf3015b5def851bc5b4a5fd76ad909ebe928c1922c4fc6f7c5293db8785138152927e9f26", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523293, "uuid": "1c31b765-ac3c-40ce-b5a0-ff4f556eb2d4", "value": "T1B325B023F2911532EA73C6389D4BA7695F257E30361C784EABE87C589F391463C29393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523293, "uuid": "f05dfc9d-93e1-45fa-ae24-8028276d6383", "value": "c13d32aa9888fe966e6fbe2088c7521f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523293, "uuid": "08e6f4a0-dfaf-4621-813a-09a19ab316b6", "value": "12288:SsIbHgwqDkquOEfffS0+qJQZJYfkN/PTD4Vc7LnvtfGSGDLyIBfMPIqr:ShbIurffS2J4IMj4c7bvteS+BfMPIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523293, "uuid": "fc386506-8e76-459f-baf1-64108dd10ea0", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523293, "uuid": "0f03ded0-f0c6-4d7d-874a-6fc23cecb9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523293, "uuid": "46b894ac-1758-4a98-9a79-07d583f64907", "value": "Prova del pagamento bancario.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768bd279-6c94-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1697509539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509539, "uuid": "feae741f-25f0-46cd-8538-a5ce9262747b", "comment": "Malware payload (Loki)", "value": "43f55a41a6ec2a858c28b796f0138f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509539, "uuid": "01f338e2-998c-47cf-8639-89eb133daa83", "comment": "Malware payload (Loki)", "value": "2b9f29f475b49afdcc26e603cc6ff6508ff3bd7666cd181a1e7c5fac231f677c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509539, "uuid": "d2f9256c-d64d-4ae0-b58b-121c7fcfb875", "comment": "Malware payload (Loki)", "value": "2dd7b05c3f8f580c00253ffef3ba6ece4bbc6708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509539, "uuid": "df1dcc9f-3f30-4fe2-b021-376c8eb5acef", "comment": "Malware payload (Loki)", "value": "0bf076ac950f05d36ce5a99fe88db85b09c1814845ae06561046d8c71f5296ad80f39bfe21660108ac3dcc1d87ecbd78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509539, "uuid": "f671feed-2479-4830-b740-3a4944fadd67", "value": "T14B259F63E2920637D173D638AF0BE3E95B2D7E20252C788D5BD86C489F395853C1A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509539, "uuid": "5c167190-2ae8-4846-981f-1e399822c124", "value": "003d3d12d28525a81de6bbbfc27b008c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509539, "uuid": "486ffbbd-5002-412a-b9e6-a2a6797e5c1e", "value": "24576:PKEbMgZ1x1BaPhO/TvtcY6Rs7bvteS+BfKZ5puZP:iEogpU6T+YoE5puZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697509539, "uuid": "a5e5f509-33cb-4758-b7e5-52b1cb28301b", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697509539, "uuid": "d6db992d-d6a1-4621-921c-ba68c375dc93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509539, "uuid": "d0638fd1-b38e-4cab-ac4e-aefbaabec3e5", "value": "Cjdeazryrjcnuk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3afd52c-6ce7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697545370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545370, "uuid": "7b635ea5-7a5e-445a-837f-85f0c351006b", "comment": "Malware payload", "value": "2ab1182948be1b9eb2a311556cbc9145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545370, "uuid": "6e65cdc1-5c55-45f4-9503-b6b045d1fc07", "comment": "Malware payload", "value": "2c67574c61b113326785606923ddc85f442766768c235f23e78bc833818d1dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545370, "uuid": "0247b896-1af9-4a8b-8c08-8249588eb40d", "comment": "Malware payload", "value": "65def5ff61629ee87698ab4bc22387d21c5c3fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545370, "uuid": "b57160a5-7a82-4c02-b356-0ad33fedf43f", "comment": "Malware payload", "value": "760955adf46812a2f2b8fa330fe254acfbb1899a4862d64afcb09f69cb0f58e6fa304ef0dcf2ef4052a53bbed95f99a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545370, "uuid": "c0bbf89f-4b1e-4cb9-964f-b523058f8500", "value": "T1BDF3BF53A7E98073ECB527B058F702831B35BCA19D78836B1791A85E1CB26D4B93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545370, "uuid": "65943f08-6f00-4a44-bfa0-1b7709a6780e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545370, "uuid": "c54d2500-b28f-4dfb-b152-b1fe054fc0cb", "value": "3072:K1y+bnr+O1M5GWp1icKAArDZz4N9GhbkrNEk1cuKAoP57SJe:K1y+bnr+zp0yN90QE6KDP57S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545370, "uuid": "4c3a7f37-835a-444b-9f92-d1b4c8d652b6", "value": 163530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545370, "uuid": "c72da23d-68d0-480e-a20f-dcb1098aee2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545370, "uuid": "d26bd41e-b83b-47a3-a62e-c79eb9ad9302", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340989ae-6c88-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697504273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504273, "uuid": "cec3344b-b942-419c-8f37-1dcf4661e704", "comment": "Malware payload (IRATA)", "value": "272d79cd96f77ae720899a2e4878f0fb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504273, "uuid": "92d688c8-daac-40f9-8a3c-e2173d1e3ec1", "comment": "Malware payload (IRATA)", "value": "2c997167b84d29f3e494fbea105547906c8a2aa0b5167f45c38a1c8fe73c3ed8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504273, "uuid": "3e32b530-917f-4771-acb0-136aece33f43", "comment": "Malware payload (IRATA)", "value": "0763f46bebed59e8a7e29182809bcb1bbce1e514", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504273, "uuid": "cbc55bfd-fff1-4f01-a6aa-b1fb1ccae179", "comment": "Malware payload (IRATA)", "value": "9c7b387c8c480de0f2cdaa051503b2a722e95bbfb75f0dfcc02a77b809332bda50b897191b0887469309ba9113de281c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504273, "uuid": "f30255e7-778d-4fee-9d1f-8cb6066c467a", "value": "T11136DFD7F399686BC4F39332817613A5515B4C228F87AFC76D28763C28BB5C41E49AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504273, "uuid": "23fb39a9-27af-40be-8e64-5d60d8a8b1ad", "value": "98304:MPFqjgt+88jegeucgLCrgnErC3ZoHZLff0ZhhrTpbahq:MPAJeq/EUEL30bhHRaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697504273, "uuid": "b7272c3c-5454-4b66-8127-98679d78ea63", "value": 4918329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697504273, "uuid": "05b0cb75-3dd2-46f3-81c2-47c1edba2f70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504273, "uuid": "7bc342d2-b553-4d27-ae64-4633b9378ec5", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bad1713-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697545947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545947, "uuid": "23dccae6-5fb8-4ce9-a631-6ff24259cfd2", "comment": "Malware payload (AgentTesla)", "value": "67234486b7e898ab97dc025fea05fa7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545947, "uuid": "f0d3e5f7-e384-419c-89fa-76132c8002e5", "comment": "Malware payload (AgentTesla)", "value": "2e258ed170965c8d26e5e284e9b6f0204b7be36b68dc0221d11f1a446e46e153", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545947, "uuid": "def7b5f4-b352-4671-bb14-118410d29781", "comment": "Malware payload (AgentTesla)", "value": "20816f174ad2e62cca3e2c9a7048df25c8c0c7e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545947, "uuid": "6355a702-ce78-4d75-8fe0-b647b5b18570", "comment": "Malware payload (AgentTesla)", "value": "789db55bd4ef227e24f0df77b4eda8e61235e26c02d162992c646207034e203fb035016977fb2bd4418f7368186094b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545947, "uuid": "ca6ed057-b1af-490f-b469-8943ec110605", "value": "T183C4127525DB1D1FC7EE423AD090955B0F31834E26B7EF19E8D920ABAE177C07283692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545947, "uuid": "17bc7f82-9aa5-4bd5-9f8c-748a91015d00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545947, "uuid": "530c35f6-3efb-437c-a676-ac261b487f75", "value": "12288:NdJlUICvo+GI+Zk4TyLCM5uS5748qNoU2QIuPndIg7L:NdJlvCvo+GIxLCMISPU2Qp/djL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545947, "uuid": "8c663bbc-beff-4784-9059-ec4e428432e0", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545947, "uuid": "0596d23d-5b6c-434a-84a6-50d99292fb6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545947, "uuid": "ccb59b13-5926-4a2c-9336-84c207345d48", "value": "L-409794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1200034b-6d02-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697556615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556615, "uuid": "0bb1e03f-f08b-43a1-82f2-913e89590603", "comment": "Malware payload (Amadey)", "value": "c17452fdba4d168132fe2363f41874b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556615, "uuid": "99a5116c-bfaa-42d6-aff0-d9b81b1e371c", "comment": "Malware payload (Amadey)", "value": "2eb2c60176fb29d19da9c54c065e863e5adc4e83a02bd69a1c641dc617cd3cc8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556615, "uuid": "512b0912-2fd8-4b28-84b9-f5cd5a5d190f", "comment": "Malware payload (Amadey)", "value": "38a02762f1af64872dd686f0210d8dd4981b841a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556615, "uuid": "81129a55-7780-4d26-b119-0d2bc63967ce", "comment": "Malware payload (Amadey)", "value": "2d766ccf32473328802886af145acbb3c1690884ba7511cb967e2b61d08f8fee3e9a471bdc4c9fb52629aa31981d9076", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556615, "uuid": "6ec16a33-e637-4bce-926d-d99da485474e", "value": "T142252313E6D19477DEB557B0A8FB06D31A36BCA58D389B773780981A4D62C80C272B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556615, "uuid": "63538c9d-84e2-4df4-8336-a9a15310e8aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556615, "uuid": "840288d4-026a-49ea-8140-1c02366f0ebe", "value": "24576:hylsALuntBKi4NO3egJJLyEORzgIaNyugoJgpERf:UZKnt8NO33ejBO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697556615, "uuid": "0a44b914-e1b5-478d-b6f5-c5a689f3d872", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697556615, "uuid": "34fa4746-1830-4498-af0d-9f228c689adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556615, "uuid": "c2729164-e19b-44da-87ab-f3ef0c3d8c3c", "value": "c17452fdba4d168132fe2363f41874b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49192964-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697545970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545970, "uuid": "8d5263ae-45fd-4413-b311-d27492b469bf", "comment": "Malware payload (GuLoader)", "value": "226bb8601190118bf09547d70e4ecb84", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545970, "uuid": "752f0726-6cde-4f4c-ac82-016927a3b96e", "comment": "Malware payload (GuLoader)", "value": "2feb6fd06b1fbe340d1f201c0e73ef2bfa8bae4628f3aa49ca774ab0b8cb023c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545970, "uuid": "625ed17a-d593-4a35-accf-9eae7f18c67e", "comment": "Malware payload (GuLoader)", "value": "817d92dcc44941743e51ff6789ba8fcc108dabac", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545970, "uuid": "4a63ea50-182f-4c92-85c6-0ac9fa178489", "comment": "Malware payload (GuLoader)", "value": "fdadf7eb3e25a80fce124347e9ed9bc1ab36e854877a1f23db87fa3dfe6c05ab05509421bcb2a9197fd69d7a1576f25b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545970, "uuid": "a7ce9b11-b809-40db-bd08-a3afdc0fc979", "value": "T14D045B60DAD9263D0E431BDEBF424841C8FD853D8325816DE6AE07AE52135ACCB7FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545970, "uuid": "403c5208-71b9-4e6a-9350-f8635f448b34", "value": "3072:OaDcAGZgLseSKxIa+TLOXxQ9W4S4YIsdk0W3y3z/fiySABnmExKKJedjS5bVIk5:Oao4jKlOXxESTIqk+z/JSWnmEdE2b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545970, "uuid": "1466c67c-d574-4470-a110-54704c8cafb6", "value": 173772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545970, "uuid": "bfaffe25-5d86-4088-b52d-5dff00944343", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545970, "uuid": "bca10b2c-f46c-4a13-aa6a-4385dee02d48", "value": "Upit Rekreacija doo 10_16_2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132afbae-6d02-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697556617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556617, "uuid": "6ef19856-cee0-4181-92c9-3e0f7827cd44", "comment": "Malware payload (RedLineStealer)", "value": "1046740d3f3c81c641f8b0e9123d70f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556617, "uuid": "0c486a12-2733-4dee-ac51-c0a3326d50b4", "comment": "Malware payload (RedLineStealer)", "value": "2ffdeeb31adf7041a2ec482778e66739b56750673589b4d462477c48ac7cc171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556617, "uuid": "9616d6e1-2501-4358-b7df-0b55a37cae47", "comment": "Malware payload (RedLineStealer)", "value": "b52ef783dcdffe4e9f7ef6fc60fad6b182b3ae6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556617, "uuid": "fc10351d-59f5-47ce-b1e6-fbcf64280d13", "comment": "Malware payload (RedLineStealer)", "value": "47081bc5b7bd57c4660225d207a52351940f0dc1a810265e4ddf227f3be20d1645be6daf85bdb1d5b5800bcac1bee74e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556617, "uuid": "fb0ce6db-0a9a-4dd4-ba91-c7cd3c3c6ae9", "value": "T1A7E39D05FCD0C472D562193204B5DBB15E7EF8300E60AEAF27A81B7A4F742D19A369B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556617, "uuid": "f8464c78-cbd7-4fed-87c4-5cb99b531547", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556617, "uuid": "54dcaf2d-c7e4-4e38-a711-5a8d4273b0f2", "value": "3072:eFbw+FTZINhlleMIkYo3TNfGqT9AVCqvIzUyIqZGvFbO:+LZINvl0yuPOUyIIab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697556617, "uuid": "26df26ed-f23e-4722-9560-cd2146ecf7f1", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697556617, "uuid": "75dcbad7-980e-4f14-892f-592985be57bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556617, "uuid": "143522ad-ef24-4d70-96c8-f5771070f0c9", "value": "1046740d3f3c81c641f8b0e9123d70f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401b87e9-6ce2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697542948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697542948, "uuid": "f7c301bc-e210-4c0c-a3de-65f8fc19d6c9", "comment": "Malware payload (RedLineStealer)", "value": "c6e542f7d8300b98e289bb8afb52f70f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697542948, "uuid": "0d1503a7-371a-4e57-9d12-f1fefe820ae6", "comment": "Malware payload (RedLineStealer)", "value": "30181149c1f3e545657d0d12ac7730bb0a3715e683a52402da6e94901623c6ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697542948, "uuid": "aa995c33-1a6d-46e6-9bf8-02a42ed88e32", "comment": "Malware payload (RedLineStealer)", "value": "00737a662f50e9d530d347d51a9eb2038360adb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697542948, "uuid": "32082a68-cf2b-48eb-8c7a-077f9097cafa", "comment": "Malware payload (RedLineStealer)", "value": "322d2f62565d3929b7f3f50ac4136ae85e75fa292eccff9cbeb7ceb2ac33dac474786a9734cca00c8f3fe382b4aa6fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697542948, "uuid": "9bc86a1c-8d5a-418c-ab88-3c4c351c89f3", "value": "T1CE4523837BD99672D9BA277008F74B031735BD93593586262325EBBB2C63748843632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697542948, "uuid": "b4a954ab-0aa7-4d8e-9cd6-7763ba5b4425", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697542948, "uuid": "e4bc73f0-18f0-48e3-be33-36db7711c0d7", "value": "24576:my3FQanag3xRu07uvAjvuenib4hpTBjAtnJMBUPpd0ugH:1jb3xtu4jFib4hpTBjsJMGb0ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697542948, "uuid": "e3b73077-a0c5-41ed-bfb2-fa7b9998f04e", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697542948, "uuid": "ec5ca5e7-be70-4b02-84e9-a2e7eeef03f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697542948, "uuid": "7bc56f64-be4b-4f29-aa3c-42dba9550b40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f8f7e4-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538402, "uuid": "30dfbda8-512a-4ff0-b8a5-c3cf57c0036b", "comment": "Malware payload (Mirai)", "value": "6119b5c7aea0285171885fd3e02cb5fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538402, "uuid": "5550f232-b764-4c3c-bd9d-823cbb1c6b8a", "comment": "Malware payload (Mirai)", "value": "3048c7b0958047419515b81eb1ef432e37ca57b92ac6f20bb346ff3b3fe4bc98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538402, "uuid": "af4dcef0-edf4-4399-87cd-99d275f8ac55", "comment": "Malware payload (Mirai)", "value": "34745b6cfb19543cfabec884d7136f2ddd897e8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538402, "uuid": "0b603f8d-e15d-4130-bd0b-3dd93c3b18fb", "comment": "Malware payload (Mirai)", "value": "c7d9af1132e9bdd5d1c2579bab4519eb855772a76276c50f0a55e6433a0c2f12681f4f8feb2d77e33c2044113182aa45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538402, "uuid": "f7f97658-20e4-4d5c-bdc3-33c676787174", "value": "T198E30A56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538402, "uuid": "66216f8c-742d-41ab-8cdf-0dc1cf02d018", "value": "3072:ZUIK7umUPMNrbAXx0Kfw0aHI5yjwDCO32ZRpX:ZUr3UuAX2KfFa8nH32ZRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538402, "uuid": "3724334f-b6b1-434c-a9ae-9f969d8511a4", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538402, "uuid": "0237dbd5-196a-46ce-8f3a-5c627ac61fe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538402, "uuid": "c524a22b-043b-42d0-bab1-9c52c8ca3bcd", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de40107-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1697524127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524127, "uuid": "39dbe054-f9ef-484a-87ab-2fe8e57d0a29", "comment": "Malware payload (zgRAT)", "value": "c9cb677819ed4877bb68fbfa37b119b7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524127, "uuid": "7d02916f-a661-411c-9b96-8f443e336d22", "comment": "Malware payload (zgRAT)", "value": "325b9b12095fe060be17d3f42b26df40c757d16e9ca808fdf08fd51cfa57038a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524127, "uuid": "4ba50c15-5e09-4db9-b134-c2a304658848", "comment": "Malware payload (zgRAT)", "value": "a2a50bc7ce4647ce0ce7a19e6eb19308ae3a962a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524127, "uuid": "11233755-b234-49af-9b54-4dfc0bcb5127", "comment": "Malware payload (zgRAT)", "value": "9b00b8f687fe01ff39af341b4c5b54d19bd3fbc62e344b788a9f1b3fe62220a896931c57203c0f9ea392a70c5e5719b7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524127, "uuid": "f1172cbf-446f-453a-9ad3-33ebdec7236b", "value": "T1BC44076026EFA14DB1B3BF572FED79EA8E1FFB61761EA09D710007068A11E44CD62631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524127, "uuid": "a5423516-0edf-4ac6-953e-840f29d3cadc", "value": "6144:DAAAAAAzAAAAAGVqV/VzVVVBVPVZVQV8VxVqVcVUVtV3VIVlV4VhVEVaVzVRVcVD:DAAAAAAzAAAAAGVqV/VzVVVBVPVZVQVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524127, "uuid": "c26332d7-91c9-4c28-9473-bcb361d8a683", "value": 258294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524127, "uuid": "1575f8dc-ec2f-4bda-b0d7-8804a71442de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524127, "uuid": "b8e0283b-fecc-4652-8877-a69245d5b5a4", "value": "Orden 77100.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555577d9-6cfd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697554580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554580, "uuid": "84c72def-6a4f-4a97-8cf2-0788c31eb2e6", "comment": "Malware payload (RedLineStealer)", "value": "7194083c36f78b406774d409c8ae18df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554580, "uuid": "2500b238-04ac-4113-ab65-75e0f331fcc9", "comment": "Malware payload (RedLineStealer)", "value": "3284e773190a76acd9195d6978089a1f8fb856c837efba6dbe5713de3d2c01a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554580, "uuid": "deece7fa-0ecf-41ef-b010-67a28737af99", "comment": "Malware payload (RedLineStealer)", "value": "c301196a2381d02396ac5016e5fcd57860839eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697554580, "uuid": "0566158a-e4a1-4e24-9e2a-1eb7159137cb", "comment": "Malware payload (RedLineStealer)", "value": "d04234b1e8de9e153e6001f1a9b02f60ed4989c23b9f0cff942a55d110a42375293724649eeba1ac0284d4d3e105df1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554580, "uuid": "eff2a10c-ecc9-4218-9cf1-c091e466ffba", "value": "T157252303B7D58161DEB05B785CFB02C71B367DA68E7186673722991A4DB3880A87237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554580, "uuid": "e529c07f-80f9-4ad6-8026-77e2f1fc996e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554580, "uuid": "19519ebe-f641-4087-8f0c-0e9793ee3a5b", "value": "12288:hMr0y90ga8LJi58EZUGTqq7eMeGlIWauC1i9oOFQITsuxatk8+KKMtNH+SsYS39b:JyBa8d3WferuCM97lYcIkEqI4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697554580, "uuid": "4966042c-4fd5-4f8e-a66e-f4c59f35b07e", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697554580, "uuid": "8df96165-16ce-484c-b91b-c67b179e6c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697554580, "uuid": "6edac4dd-8cc8-454d-b25f-41c8f220bad3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab974caa-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538404, "uuid": "a047674e-e741-4016-a24d-08e09e536bea", "comment": "Malware payload (Mirai)", "value": "7d9892f081a0f421a6cf52826a996830", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538404, "uuid": "da8ef2a2-f28b-4e61-9503-21bb8985487d", "comment": "Malware payload (Mirai)", "value": "333620c3fb4917c4408c0f75ba26f3b976069f2cf2ec25dcc77d94f3778134b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538404, "uuid": "1348fee8-e4ff-4e82-a82f-19e07485be1f", "comment": "Malware payload (Mirai)", "value": "d3f700a1a0e0b37aab5fe3ed584cca64151ebe8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538404, "uuid": "89383638-3de5-4cdb-93d2-398cc2d3a4b8", "comment": "Malware payload (Mirai)", "value": "4448fdc622fbfd73ab07fdc6792277e9c97b5eca184d6aede7355af3acd3ae3da6d01ccc6fa71a9b575127c39188f149", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538404, "uuid": "147342f3-6cab-44e1-852b-a0c7172db5e8", "value": "T1DAD33A17B5C180FDC4DAC5B44F9EF536DD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538404, "uuid": "c64383eb-d3ec-4d38-86e9-1427f02eb389", "value": "3072:tGtwnNiaOnUTqFKPT9OSQ7AOaogjV2iZlBWCgGiAzQPdL:tGtwnNiaOnUTouLyWzQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538404, "uuid": "35576b51-6ac4-4166-b05c-8e1aa5075d82", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538404, "uuid": "ddee9e30-0cca-4c12-b410-23fd5ef4d266", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538404, "uuid": "91ac1f17-4a27-41a9-a7c1-4f32ff7c4ad9", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee167449-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (StormKitty)", "timestamp": 1697523483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523483, "uuid": "b37c8c74-c822-4796-84b0-29a9f4004d4a", "comment": "Malware payload (StormKitty)", "value": "4e3fe90e13564d28455ea90a8cc0c707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523483, "uuid": "b54a21a2-e9a1-4780-acde-52cb0dd031c4", "comment": "Malware payload (StormKitty)", "value": "342bbf78132bc4dd1a2e3921c369a6ed1691f39059f01dd51adabdc7ba370202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523483, "uuid": "f177ffe4-8fd1-46e8-9ac0-f9ae2b2632a6", "comment": "Malware payload (StormKitty)", "value": "14e8753e6015ffc1ef7280559eec3ab61867f3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523483, "uuid": "4ff9eda0-44bf-4889-b4bc-1e04aa8a63ba", "comment": "Malware payload (StormKitty)", "value": "0e750baa61e7229dcd813b170b330f795b4b42e50713bd0f14e2084af54662bca1bfb8588fa5901e12fbca24ad011756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523483, "uuid": "eb558d2b-6a6b-41ef-8f6f-0feb3ff4329f", "value": "T15E32FC56B3D4C366C9390A74D5A3B3900EFCFE064862A63E7847231B6DB66844E776F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523483, "uuid": "1423a212-1d3d-4196-9754-21165b208da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523483, "uuid": "554b8c81-dddf-40c6-97ec-95944c028406", "value": "96:+FMjebmjnjnodj8Gj8pSj8kBibMq7UrtaRkbzpP24Sw5/HvChTwq993LdL4Qdim7:7oK1px0Akl/H6Wq993LdL4Qfjv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523483, "uuid": "c38fb49f-d2d1-4d6a-bbf1-80e90082578a", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523483, "uuid": "d3c7e85d-7d7a-4914-b959-6149aa6cef34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523483, "uuid": "563a17c5-b339-467c-af63-204ab3f1d1bd", "value": "4e3fe90e13564d28455ea90a8cc0c707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1348974f-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697537290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537290, "uuid": "1f85be8d-5c9b-454a-9245-a9a73ea13ca3", "comment": "Malware payload (Smoke Loader)", "value": "ac132a5f2ddbd5ce3b5be4c525ac66ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537290, "uuid": "0122efe0-dbe2-40ec-8c9c-b5057bf8a20a", "comment": "Malware payload (Smoke Loader)", "value": "35f36252d3cb4e2cab996d7f127f2bbf50decfe27f935c6fe6b164c033a2dd7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537290, "uuid": "f6cdb770-2e29-407b-981a-02265ce5e879", "comment": "Malware payload (Smoke Loader)", "value": "058f78032556b9b1ea4f7651a454eb7984aa9909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537290, "uuid": "e37df70c-f32c-4ec9-a2dc-36d6f97cadbc", "comment": "Malware payload (Smoke Loader)", "value": "2e7078e1f32a56cd306841ddb694d8d3763125131c2af2b46652f4099d8f8cd73f6c3caf16b53722a2c85d304fa63867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537290, "uuid": "3936d89c-a0f7-4160-a1a4-26db6616a2fb", "value": "T1515523136AF88063EDB0277459F706971A357E828DB5BA3F2311F84B0CB2690697473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537290, "uuid": "87981c95-2c6a-4b7d-8bf9-5aaffb1bd2db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537290, "uuid": "bdb3aa4b-96e9-44a1-8ff6-6a6df3067482", "value": "24576:oyZWkbOm/m4kPq48iwQWNIdPSJYYXxzS35c/j/kZDUXDmJ8/QM:vZWkbvmq48i4IdPKSJ6j/kZDUiJ8/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537290, "uuid": "6ff45c53-8b0b-4a1c-a911-a0921c537f2d", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537290, "uuid": "c8f2bac3-f27b-41d4-9dad-e7f39e2440e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537290, "uuid": "3aa0f8ec-b2f6-4723-921f-741bdc5fa8af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d5a03a-6cf0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697548882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548882, "uuid": "73cb10e2-7730-4f5e-a95f-d3c0365ec41a", "comment": "Malware payload (AgentTesla)", "value": "1ec270007fc13cbf8db046e5ee8989f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548882, "uuid": "74b5ff16-b002-48e5-9ea6-b0e6bc3394ab", "comment": "Malware payload (AgentTesla)", "value": "3668bfda289003db294d1a1cd542ae1779810daab317fbed4165c1b422f20c31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548882, "uuid": "d1782fd2-d1da-4a84-b7a2-4747c0cd28f2", "comment": "Malware payload (AgentTesla)", "value": "1e1fcd0f5ec5cde415085b3a56e38a7e1d48f372", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548882, "uuid": "cd6940ef-c593-41ce-bf73-904fa84aeece", "comment": "Malware payload (AgentTesla)", "value": "ec34bd8693559582a3e19a55a718109327d48dd4463f740fa3a0b7193c01ac86b84b9f0aa4ff88bae8a61bb62ce767ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548882, "uuid": "35e537d1-0d4d-46c5-83c0-d6f73b555c86", "value": "T11EE4231536AC43FED2BA0FB91C7854250B72A2727B20EA7E0DC672D4D921F067532793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548882, "uuid": "757a5535-23dc-4a61-a90c-c3897ede781d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548882, "uuid": "af606f06-6d41-4d3c-b43c-538fdb5176e8", "value": "12288:86DJ92IGaa1yJ9ZNs9G3cYml3cAPNQMelUnItRqXHj9yatxBhVq9aoA9:V/pQgjNX3cYml4xlgIiXjF5hs9ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697548882, "uuid": "9348a7e7-17ab-4159-8e80-333c5a9bf701", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697548882, "uuid": "ddd01f68-c099-4ad3-8da5-3b51793fbadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548882, "uuid": "550d9d4a-e2ec-459a-9db8-fe9619dfe951", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90096381-6d3f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697583026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583026, "uuid": "45b1e991-8d98-4077-ac85-09caf1301363", "comment": "Malware payload (LummaStealer)", "value": "fc28c6c3d7cb9e87ab92c09f88450dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583026, "uuid": "2e50115b-f83f-4fab-be23-b84aae233372", "comment": "Malware payload (LummaStealer)", "value": "37acc68fea5459b2eb2d3ed88962a13c75209fac1952bbaab1231389b98333b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583026, "uuid": "9214e02c-b8d5-433b-ae1f-966ffae9b28b", "comment": "Malware payload (LummaStealer)", "value": "51a7b7508ee048235e9b3d76bd5ef3317ffa6498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583026, "uuid": "9b5a2eb3-7858-45d6-a7e3-9fe186a2c80a", "comment": "Malware payload (LummaStealer)", "value": "a3fc8a7185aaf4173d0e92fb1a6dfad36b4d257101f9a7edbea9eec12f569a98ae2b3d566e8a3fdff932a8828186ec67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583026, "uuid": "a0b467cb-7f40-4c69-9e66-43b3560968e7", "value": "T1D744AE0170D1C472D472253605E0EBBA5A3EB8310BA59AEF6BE63F7E4F303D19631A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583026, "uuid": "7370be6b-5bf8-4d35-8ecb-587179e71708", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583026, "uuid": "edebd6ce-2cd5-4df0-8437-6279c130948d", "value": "6144:kX2gsRCjvhU3L14HvJjop9xWqAOlCZE+XNdY:kG/RCjvh6cUv0Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697583026, "uuid": "93163875-d2db-4653-8604-ab6b53f77298", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697583026, "uuid": "1e4ed514-f7e1-4e1a-8ce4-c09babab1270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583026, "uuid": "a30a2bcb-74f4-4f83-8f8e-5a60f2af52b2", "value": "fc28c6c3d7cb9e87ab92c09f88450dbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5106b796-6d38-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697579914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579914, "uuid": "7b5cb7e5-7497-482b-ba05-c77a9c9b2b43", "comment": "Malware payload", "value": "3518b2dc17cecfd0ce5c94ee0e09ae0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579914, "uuid": "92b32e1d-a7e7-4c08-b29b-a73b6097cfcf", "comment": "Malware payload", "value": "380fb32ab1e8e8b6586bf9b0b2ed42f52b7b3c1bdc92a3d3ec9a51c5d0e6948d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579914, "uuid": "5eb760f8-00d0-451e-b0ea-40ad0e5f37a8", "comment": "Malware payload", "value": "d3155c1601fc45ee51bcaed723e4fe67ce952a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579914, "uuid": "c72d48cb-3696-47a3-a834-4ea429db7396", "comment": "Malware payload", "value": "11ba4b16af2b989b0363e28d654e70d837577a79fd4444a019ccdd8c6b3d209039f6a9b90884bdbab1b10a2f1717c821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579914, "uuid": "fa705320-cc1f-436c-b153-5ee88b86c9b2", "value": "T16C352302E2E9A672ED7917B058FF0693173DBDA55934836B27019ECD0C73648A932B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579914, "uuid": "56073a14-e84e-4cf3-a7d6-709481318a8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579914, "uuid": "0806ee66-dccb-48e0-8645-f24f9772c40d", "value": "24576:UyTdGD++kwnRUfOuB5LATc6MTfr5R7LHI6C:j+++DnynsT3MBR7LHI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697579914, "uuid": "2aae5236-d99f-469b-a730-a9a702a7f63e", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697579914, "uuid": "81633eef-54ed-4f13-a20d-a784ac4b9fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579914, "uuid": "a9151bf5-c96d-45a5-adc1-06b2add1dd03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f45a1a9-6cc8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697531834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531834, "uuid": "5b452a40-4c9d-401f-be2f-118fc2184bd0", "comment": "Malware payload (AgentTesla)", "value": "d024959c42044ce93e84637c3b135c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531834, "uuid": "863756ee-d9a7-4ed0-b569-f02ee07eae20", "comment": "Malware payload (AgentTesla)", "value": "3838d700587705b7ca1c4841b7432f96dab120bf04920644df95493ddabe7ad2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531834, "uuid": "0f91f280-b7e0-4370-8210-879f99282b89", "comment": "Malware payload (AgentTesla)", "value": "25caf76213d5f4d9cdf22c48963fa7b8dce95926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531834, "uuid": "9f66167c-7cdd-42ba-a882-f77fc817c283", "comment": "Malware payload (AgentTesla)", "value": "6545a62ccd2f8e81a674bcd60055f5354f45c02c7848456bf15b7e25449a8cfe1185d51976d42193245f0beb40bd924e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531834, "uuid": "95645f93-fb28-463f-821e-c81fcabc2713", "value": "T188058C17F5B54562CE44C739D6F69D0083E7ED84A7E2D6292089BADD07323BE8F0358A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531834, "uuid": "a34e7a96-a778-4acb-8079-c86df2806d77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531834, "uuid": "cfba1761-f3b7-4e4a-86ff-d136976a12e2", "value": "6144:T1KbQTZNKYt7vIHgTuVJwvZ9xbPqJMhOds4KsLWDyavOtBj45WZwFF+sx92EF7Pn:xzHSCNJb4Mws4ae8IUFEmZQ3VO7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697531834, "uuid": "29d10bae-4b48-4486-9f08-3b5d44cd8846", "value": 795408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697531834, "uuid": "ec9fcdcc-d595-4576-bf94-2fd4f9edb461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531834, "uuid": "3821cf3f-07d4-4eb2-9f16-b24d9fe8aa47", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abef762-6d04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697557542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557542, "uuid": "a60b2257-19ad-460f-b4bd-ba3fde6d4c1c", "comment": "Malware payload", "value": "f13f6c19ff60cca23030710ce7753472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557542, "uuid": "18b6c21e-92a6-4f8a-96c1-ebd6a85e422b", "comment": "Malware payload", "value": "3948a39cb97d6fcc56397f545d4ba6bb1ddc117aace06edd1724b3c5bc6a7c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557542, "uuid": "66fcf7dd-fdfb-424c-9eef-eaf6d7447e5f", "comment": "Malware payload", "value": "4f97f0e9cc7a0641c56481f8b5f2f9a1b1c21d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557542, "uuid": "4dbd7644-cde9-424a-a724-1956ce5c61e2", "comment": "Malware payload", "value": "3bb9ef7c3f8d2ad6d7b84402905cec5763449465f1ce810a331ad6b2ef877d5925c3ec427c0a5219e62b051c97d11f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557542, "uuid": "5c8730ff-79b1-47e5-b501-6d29481f9d60", "value": "T1D0052342FF9F4E38F762753681250B299D06F828B3C94797162BADBC7E083AB1D51136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557542, "uuid": "3488d05a-4329-4dd9-93dc-f23436fd3900", "value": "12288:8pUxOi4pwrmlCKaHDPDF7+K5fdN5fHaX33hlrAA3XX2Q1MVrY8Y7ZYvw1Xy5oU:OUxe2mlCK8DRF1SX392QetYbdPC5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557542, "uuid": "e57e5708-03f2-4825-865e-f09d76dd7fe8", "value": 799872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557542, "uuid": "ef4b602b-2976-48e0-bf80-ee6c1d9021b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557542, "uuid": "7e591b3f-a182-49a1-8587-d1444e74741d", "value": "SecuriteInfo.com.Trojan.Win32.Agent.12842.20766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97204d4-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697540226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540226, "uuid": "1668427e-6fd2-43c6-ab9d-b5e28334d334", "comment": "Malware payload (AgentTesla)", "value": "a8e8d4667f96ea847d18eb7830fb1dc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540226, "uuid": "0aa77851-3cb8-4d4c-b715-0a18ff7fccc1", "comment": "Malware payload (AgentTesla)", "value": "39eeda113ece91266296dfc3b9d00a6740bee7b0e695c277e49fa1966b8dfda9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540226, "uuid": "856cb3e6-e690-4872-b20a-b1b51edcd7c6", "comment": "Malware payload (AgentTesla)", "value": "401a70be80965acc2f505435736561caed55158c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540226, "uuid": "1add9e05-cd41-4d70-a54f-1b517252e113", "comment": "Malware payload (AgentTesla)", "value": "2ba8a9e4a22f4dc16ad83cf983f487dc3986885b2e23d8c491eb13aa4257d13376d9efb439c1d7ade2efc0455d73d3c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540226, "uuid": "556b2107-d7c9-4d77-8c84-7d630b894c2a", "value": "T1BA34FF037E48EB15E5A83E3792EF6C2413B2B0C71773C60B6F49ABA524517426D2E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540226, "uuid": "2daa7e67-5cfb-4503-b066-3895b06ebac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540226, "uuid": "277db696-6a1e-41d1-a631-dc3123b32ce6", "value": "3072:yPW1gv3nff9cFdx/WaC/nhaXdTX/AZejC5lQ/QZNS9/:CW1gv3nffSFdkaC/nhaNTvAZip/Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697540226, "uuid": "18bb2e32-c11c-45f2-b9da-117010683824", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697540226, "uuid": "a724d1fb-d9f5-4880-84b6-0c1fa28be8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540226, "uuid": "569e1f74-e453-4e08-b7fe-10b8a88e3774", "value": "1697540225c86c95aba296dec771dc1572323137d713a18259a333b3b4488d31bad3f13229691.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3d4325-6d0a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697560227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560227, "uuid": "646f4794-f3d7-45df-a89d-f9033998343f", "comment": "Malware payload (RedLineStealer)", "value": "7c88748a2a0b4d08ef26f5ef6c89041d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560227, "uuid": "f0384116-a921-4f0d-a87e-64488c38481c", "comment": "Malware payload (RedLineStealer)", "value": "3afede5b298ceb4dd4e10398e2fb5ce84ced4cd9f1a5afeb14199e703fec9dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560227, "uuid": "b83dcca6-4c8e-4a98-aa10-2c3b4c74952a", "comment": "Malware payload (RedLineStealer)", "value": "9a5dee3cbf1b99b5b22e4af03dbd6e6825cd320d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560227, "uuid": "4acd8986-2595-423f-b24f-1ce1d73c2382", "comment": "Malware payload (RedLineStealer)", "value": "48aadee859f595a4cae2dc683a899baf1c364c714bfefea05cc62b23394b2c72d918d46766e6c52078bc333838b1e570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560227, "uuid": "377e9f7d-cb0d-47d7-a511-f1c74b2a633c", "value": "T13F44BF0074D1C632D873153609F0EBB95A3EB9210BA59AEF67E61F7E4F303C19631A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560227, "uuid": "1a2fbe55-ba64-46d2-9f3e-ecf2c8c168c1", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560227, "uuid": "8af6df9c-6b34-4a2f-8aa3-d8e6b0fbf423", "value": "6144:gIg3yb6crtLHthXcEnc/ilUpEhWqAO+j8KJFaJf:gIGyb6c5LHthM+/YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697560227, "uuid": "00822a85-4f6a-4e67-8bff-b71c913f60f2", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697560227, "uuid": "9dc1ed95-b9c9-42b1-bdd2-cef715339e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560227, "uuid": "08a777c8-715e-4004-b0b6-efa898c01047", "value": "7c88748a2a0b4d08ef26f5ef6c89041d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03681a95-6d14-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697564321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564321, "uuid": "f8378458-0e8d-4bb5-8a58-7ba53fd3c307", "comment": "Malware payload (RedLineStealer)", "value": "2150a5b74d72f37a9cea86349a222094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564321, "uuid": "e16a0e3c-7291-411b-b68a-c66d80f2a9db", "comment": "Malware payload (RedLineStealer)", "value": "3b75fef36f2d68ceed33969816c1c90b4094db8c1a2bc98d848857f904da21e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564321, "uuid": "ad2477a7-7acb-4da0-b184-b6e62ff93e0f", "comment": "Malware payload (RedLineStealer)", "value": "dc743842b32a96f5cd448a7ff0a0b8dec4751cf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564321, "uuid": "2f9bc655-691b-4a3d-a3b7-40ec12242b79", "comment": "Malware payload (RedLineStealer)", "value": "d2b719df778c65fdf45e95174806734124c1c843a33a2674b9fd3e041f447f658d8954441badb9eab9a92930e994490c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564321, "uuid": "43ec9bf4-65e5-495b-8509-759df15d3c90", "value": "T17F352373A2D86272C9B9277049BB43930E31BCE04D7D5366339E994D0D736C8A93A727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564321, "uuid": "91e80f8d-b34e-4700-8ae3-29fc4c6333c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564321, "uuid": "61a5b439-dd85-4d5e-a844-a32eccf3d86e", "value": "24576:+ym1203qZANOm9n1ykHy7tfhy05Rmw3W5P+yLRYZScdXIQ6p:NC3qZUOmFIkSxV6DAS+Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697564321, "uuid": "93b40d8f-e0e0-4d46-a672-d4e972891d99", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697564321, "uuid": "242e8d45-c25e-4b1b-b373-c4a134176e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564321, "uuid": "792fa819-1425-404c-bec5-344356d68457", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f49ee3c-6cd4-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697536961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536961, "uuid": "0af91911-8aad-4d5b-8c51-ecb967c598a5", "comment": "Malware payload (Amadey)", "value": "f33bbb46871975846471e52c2b60343a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536961, "uuid": "d9b9a8b7-3632-47c4-bfb7-a4ffc3d1d1b3", "comment": "Malware payload (Amadey)", "value": "3c0c51d03ba888e6faa5d930d0a747e21901af69250bc137b55e85c6e1d0d963", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536961, "uuid": "a05752ee-1abd-47c6-9220-9a4b80eb6020", "comment": "Malware payload (Amadey)", "value": "a211f7cd47a91f2f1654010e6056e630cc9b02d2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536961, "uuid": "7c00c695-fcf5-49da-854d-ec3899da874e", "comment": "Malware payload (Amadey)", "value": "f7f953e326d931a56489dcea5b53b0edffaa3fbb8cdb46290c81d5607de8748a7ff0b51a88ecce6624d9e7da82059492", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536961, "uuid": "39019500-20fd-49fe-9dc9-574387cbf9ce", "value": "T1A0343BD393E17C55EA168B768E2FE6E8761DF1508F4D7B6922189A1F08B00F2D273721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536961, "uuid": "cfa12aa2-d4fc-4e66-83ec-0746c9781ffd", "value": "e8b76dfd97b58fcc0350cdefeabf1153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536961, "uuid": "0d80187a-b194-400a-a272-875ffe2980d1", "value": "3072:JIio7wQGNVjxwwKGcbfF5UqH/g//7VR6c5+Q5JZCGNBkW:JIIZ7c5vH/6/xSQ5X5oW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536961, "uuid": "e863ad32-f342-4380-9c68-664d4b3afae6", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536961, "uuid": "1a73a031-ed39-46eb-b9bb-38339de2c077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536961, "uuid": "0890b457-693e-4c18-90ff-b3c8eafa689b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764e3a56-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697523712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523712, "uuid": "54083883-1631-43ca-80ef-90f38655854a", "comment": "Malware payload (Formbook)", "value": "8fbcd6bec78788ab73711987dd6350a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523712, "uuid": "1505f3bd-e741-433d-bad7-eeceb7f44df4", "comment": "Malware payload (Formbook)", "value": "3cadd545e00f461d514fe30ab202c0a2d71e71436db792e0c01965b1ec33bbfb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523712, "uuid": "4c0f77e9-fa64-4242-a38e-44e0263b11b1", "comment": "Malware payload (Formbook)", "value": "6519ba7f1d8af2a554e24c24cbc7a0c9a72c5af0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523712, "uuid": "9c641e9b-4b54-4d58-8fd3-c294f37be08b", "comment": "Malware payload (Formbook)", "value": "05ef64d3d3eb8779f685fb0358de05a25a34b4ffc444aa98f864f60c1fc47d9ec11334721f808b32e2a808783c281de3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523712, "uuid": "18a5713b-6f39-4b94-b831-8fd138032704", "value": "T11B53F169C34E01A9CF661337AB6B1E4542FCBB3EB24152A1306C837533EEC3D95252B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523712, "uuid": "8a978a9e-a4a3-4a7b-8131-b5ebf374c6c4", "value": "768:wwAbZSibMX9gRWjYFhYF445fUI+WYqpAsEXnyxc:wwAlRX7+BBdYqpAsayxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523712, "uuid": "3f7a1819-fb2b-4a60-9fa0-aea2e00b5087", "value": 63231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523712, "uuid": "d7106940-61b3-4e14-bec7-1b7a85f6fca6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523712, "uuid": "a85c40f8-e655-4057-a0dc-884c77ed9727", "value": "Bulk PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e360b04-6c82-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697501767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501767, "uuid": "f54f8c0d-98dd-4571-9c04-8b85355eb645", "comment": "Malware payload (IRATA)", "value": "fa0fbc4511a648c3686c4a9668c20a9f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501767, "uuid": "ebed50f2-67c7-43f4-9dff-d6c9b3564816", "comment": "Malware payload (IRATA)", "value": "3cdb556e5a4056db019149a166b22b09e30b57be4dc6dcc479e9b3515b488de1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501767, "uuid": "9660f178-98e1-443f-b0f7-91c6475157fb", "comment": "Malware payload (IRATA)", "value": "08e705f554fdf6f72396c5de2e2af818e0170559", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501767, "uuid": "be7fb6ca-d1bd-4403-a494-106b463546b1", "comment": "Malware payload (IRATA)", "value": "b63d74b69b78bc800200c47606041a4811717aa546e8a54723fb1141a7873977fd6d666cb9fde37704e45767845c0c0d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501767, "uuid": "50237315-af04-494e-845e-a966a41171ec", "value": "T155851243F666F957C831C13224022A3A215A4E29C542FB5A354C37FE6BB7EE84FC46D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501767, "uuid": "3cf2fc15-e16f-4a48-9588-daa6614a2ede", "value": "49152:Bs/ikkp7XM++7BS8ZwpdSLgggKeiGG/frF8:eikkpXz+7BD+fggLNG/Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697501767, "uuid": "49fad8ae-3cf7-464e-9eaf-e4bcf637ee29", "value": 1866998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697501767, "uuid": "a471a294-3bb9-4e19-83f1-2ffb7affd09f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501767, "uuid": "430ac1ed-ab41-4069-bf6f-b743378b4616", "value": "app1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0014ec7f-6c83-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697502039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502039, "uuid": "171ccde1-12ce-4f40-8868-74fb13402885", "comment": "Malware payload (RedLineStealer)", "value": "631353b794c5248bd170564ffdd8c10a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502039, "uuid": "571bf791-7b75-49f7-8814-9c1e9d996da4", "comment": "Malware payload (RedLineStealer)", "value": "3e6ff7f4763633fa438026ff01d169a893913bc8ec7439da594126868e79c1f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502039, "uuid": "7df315ab-909a-4b53-8e08-b2eb726da2b0", "comment": "Malware payload (RedLineStealer)", "value": "1bd2b0b6e28bef81ad0e48a1bf03e1f3f563c065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502039, "uuid": "41d972cf-dd4e-4905-a85b-9e2fe9502741", "comment": "Malware payload (RedLineStealer)", "value": "52e175e885cc68e4642dfa3737720a18c35d822bc5917746f0fbcc5282a793b44a3435a467171ca7ce5c63f1008e1ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502039, "uuid": "6fd1b75c-1f0c-4d14-8d32-9dcd1e68db26", "value": "T14604AE15B8C0C072FE62193109A0EBB15E7EFC340F609F9F6BD40B765E602D19A76DA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502039, "uuid": "f0f8ebe5-3b5b-4305-842c-0d60542b0a8a", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502039, "uuid": "7f868323-ed9f-4125-83d6-b171dd0f87d0", "value": "3072:BDQEGizKw/kal99mdVeiOEru0PIBqc9Xa3NPffxnd:BCK3l99cV4ECdadfxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697502039, "uuid": "9b6d2bda-ccfd-4326-aeb3-ec3bd6fb9178", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697502039, "uuid": "675c3ff9-aabb-4ea9-a976-29240833aa25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502039, "uuid": "c72d5efc-0563-4d9f-aa6d-911b394d83b3", "value": "631353b794c5248bd170564ffdd8c10a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e208d43-6d0c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697560930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560930, "uuid": "4ca73d53-9d62-46bb-a353-6a7eb9ab45d7", "comment": "Malware payload (RedLineStealer)", "value": "9abb6acbc472627f358b1c65c1cd403c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560930, "uuid": "0e33f5a0-d594-4046-86d6-7acde748239c", "comment": "Malware payload (RedLineStealer)", "value": "3ebe509de4e70605425511bb584501619afb7de303b71282c93b70ad1f8ddc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560930, "uuid": "5ec42a59-8888-4a58-9f0b-a0336fcce6f3", "comment": "Malware payload (RedLineStealer)", "value": "4b0b12f81d646b03f3e1c7c1cf1609261ab5861f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560930, "uuid": "a3d4cc04-9a2a-4a77-8426-3402daad3949", "comment": "Malware payload (RedLineStealer)", "value": "84cd3be809633728037c100cee2d1772acd175c293e7af963abd9939a59b7b8dc07bcca50f37d9cd89e30e3ec055e86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560930, "uuid": "2c06957e-c864-4477-8e36-bc401d0bf976", "value": "T121844A0034802E71F64A81F905ACFEFCAB3AE5160E646D8BF1E9358B95AE251FC41DF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560930, "uuid": "9fb5ef9b-1450-48e7-9e04-2e6f648f93ee", "value": "2bfc73722cfcd91024f1dce612d456d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560930, "uuid": "315934df-e9eb-465d-8fa5-380aa51087ab", "value": "6144:hFtzlihiByjZnt9XVNqOjs6aIPKPY9jfaHCKirQkdf3xf9ph:/Nlihi29fqOmy+i2kFxf9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697560930, "uuid": "b2742b1f-d65a-4665-adfb-52d9067bb586", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697560930, "uuid": "44c720d5-8736-4faa-92cb-b8efca11e2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560930, "uuid": "cc1b321c-e600-4c5b-8893-d5456cccbe7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a09fce9-6d04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697557541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557541, "uuid": "45a9b7b0-7d00-4e58-85a0-a2cb0dab2795", "comment": "Malware payload", "value": "d68d57f415818df8a89f65d8025f8856", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557541, "uuid": "78318be4-ff56-4434-8385-994d6c9407f7", "comment": "Malware payload", "value": "40167c3ef4b1afd2b897d89fdf612d1041c7e9e24169e5f32ebc0b00c7860c2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557541, "uuid": "907cd2df-0467-41d8-9c75-13d83544232c", "comment": "Malware payload", "value": "cd31d8b6a7e5050b3b201848409f6dc4eaac8568", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557541, "uuid": "b7fd0a02-d475-4904-b3b3-58aa25adcf39", "comment": "Malware payload", "value": "b9349ba81b42edae79972c5f7fbb999efec7068db6f6b09c15f86a0676ee6ed9f36dc44e4c6b4cccc8be26d985615521", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557541, "uuid": "b82a8841-4fd5-46ee-bdd1-49e5eb887093", "value": "T131645B053EDB9867C0F65A340B968BC8A9A1E0331DB3834B3994E25C9FB73925F725D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557541, "uuid": "9dc76374-7089-419d-a5dc-9c226f8067d7", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557541, "uuid": "0c69009c-4031-440c-9c26-a8d63f9ac02b", "value": "6144:+RR5rhZFQGrsUwF7vlPoSIXzsEiadXbg5GtvAgvU:+R5nWFpPoS8zsEi0Xrxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557541, "uuid": "c22d49fd-01d3-4aa6-af8b-4eda9054cdea", "value": 327575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557541, "uuid": "0adecfb8-85c3-4854-a24c-4cf2c41a3155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557541, "uuid": "0f22b1bc-76aa-416b-b94a-e520849b2ff5", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.24216.6871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c6fbdf-6d30-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697576719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576719, "uuid": "f87ff161-4ccb-4bb8-bcc0-dab4cbf5922b", "comment": "Malware payload (LummaStealer)", "value": "539ccfccba2c790506f5b969628fe918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576719, "uuid": "b4448028-f305-456e-8537-5f8b2b2f586d", "comment": "Malware payload (LummaStealer)", "value": "40489a02cbb42de8c6e9caae9becd38ef4c3361f929f6418d0231afedb83f9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576719, "uuid": "ab3aa441-1ec5-458f-aa7e-015d4ca04e8c", "comment": "Malware payload (LummaStealer)", "value": "43bebda0ef8a69c80d8832b9fd4108ed4e20057e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576719, "uuid": "acb2ba11-66f7-4c10-8d9a-be8230d3ed7f", "comment": "Malware payload (LummaStealer)", "value": "61f7ed923a83dc6542a9608ff5b03a670448b3172d16af03fdfb07508adc7e957c87df9e22f570333920692e69fef243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576719, "uuid": "d27c5f89-4783-4e69-b821-c5c95ecbea1f", "value": "T144252303B7E98476ECB5537068F72383063878699E34836B37898D561CB3991A67373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576719, "uuid": "47499eec-f0bd-4c2d-b43d-c0fbe85ccd5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576719, "uuid": "2477f94f-e67b-44bc-89cf-23e480cc4684", "value": "12288:5MrSy90B2Y/Fr5G+S2GIJ3BVhVMBUwvimXI9XiXzUf5xTyPp3wB6q/PInOzW+NTZ:bykG+S+JzhVUrI9yX4nWKnUYl06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697576719, "uuid": "856f22fa-5161-4517-b73b-ff8c92c185dd", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697576719, "uuid": "8d3cfbb4-ef67-4be0-a1f8-1e74883659d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576719, "uuid": "26608bb2-5bb3-4c82-ab16-b836561e794f", "value": "539ccfccba2c790506f5b969628fe918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a2622b-6d3f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697583005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583005, "uuid": "9a3e9025-1c68-42b5-8dbd-500dd5932f7a", "comment": "Malware payload (Mirai)", "value": "0038650302b3121dd614e0e6648aedd9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583005, "uuid": "9ff0fa70-4742-4c70-a7b1-43b349f549af", "comment": "Malware payload (Mirai)", "value": "40887b927156757582ce0528c6cbccbff2bbb433c9660b4e94b8fb63bc3ceda3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583005, "uuid": "f8af83d0-4952-46e0-98cd-37ebf81cbbee", "comment": "Malware payload (Mirai)", "value": "fa0e7b32d0ca2eacf9f8aa4e98cbbfbb4729448b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583005, "uuid": "16dcbfb4-f9a4-4ce4-87b8-59c586d9ea36", "comment": "Malware payload (Mirai)", "value": "cfba2e6fcaf386597ae0b98e92f6fc6d14f456b277138243ab9d9fdbf918d51815822bf4d10d03da42586b263eb6abd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583005, "uuid": "348dfe2d-ceb4-41de-82ad-9bf89bc89826", "value": "T18BB2E008564F494DDD2CA0B7F9698E9344572236DBAA4F403B4BCFE7A26352A9236C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583005, "uuid": "5659e04e-28b6-436d-a53c-96c5761facb5", "value": "384:MFV3MlsbHlq0vtzf1aQ/CjHaI6qyYAAEsy4IbPa6LRvO2gC4cLJgc3jxJkA5T8Rz:+Olr0vtj1aQ/01nDAAn76FvO2gPIgc3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697583005, "uuid": "c93c9cc7-f356-4809-8462-b38e32a9821d", "value": 24244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697583005, "uuid": "7645ce35-1328-499e-b008-9c49d5f0c954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583005, "uuid": "81fa2542-f1be-496d-8ea4-48097c0a0019", "value": "Eros.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a44b64c-6d3b-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697581218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581218, "uuid": "597c40d6-bc11-46d9-955b-c44b167c84d6", "comment": "Malware payload (Amadey)", "value": "0bf3328f810b517ca9da77e64c6951f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581218, "uuid": "cb116e7d-e12e-498b-bc4f-b58700e94e5b", "comment": "Malware payload (Amadey)", "value": "40b645afe1e0630d72e06c0ec749d6a74121fddc55c40a802b109fa6112d146e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581218, "uuid": "7a173e22-5779-47df-85aa-d680a59f7f6a", "comment": "Malware payload (Amadey)", "value": "5574f29b768b0662cb5d33e4e21a6c52316b87aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581218, "uuid": "ac586907-e745-47ee-a53a-f67e7aa03b92", "comment": "Malware payload (Amadey)", "value": "13682701b2e6172b0f42d438885cc453d7dac9dcd6fe542f220c01b59c58b857c009a4a76b8c468a737e52db8e7473a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581218, "uuid": "3e325457-3d87-4fd6-858b-349185fbb256", "value": "T1F7E39E4175C0C4B2D97219320AF0EBB1DE7DF8700F509E9B63D816B94E746D08A7AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581218, "uuid": "619e16d4-52d6-4821-99b4-a4fcf897f4b1", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581218, "uuid": "e39b66b4-7790-409b-b67d-6c2162fbd96f", "value": "3072:wWVZNJsU12HlWCnUewNzrQuUUpBt2973rC9BmaVcYKNj7lpdDPoJ:ZZNJsICnU9Q83V9KN/BPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697581218, "uuid": "6883dadf-8666-40d8-a2bf-842e08372202", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697581218, "uuid": "be8a7c63-e651-45b8-a84a-2162cdd462c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581218, "uuid": "91d73661-4bc7-4379-be9d-54f495d7ee93", "value": "0bf3328f810b517ca9da77e64c6951f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66ecfa1-6cd2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697536382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536382, "uuid": "7dd24ea0-cde8-42b5-8f77-9cb4cd7071c2", "comment": "Malware payload", "value": "f1c8192229b6047748966d7db857a3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536382, "uuid": "2c025659-f86b-41b4-869a-37f620b85505", "comment": "Malware payload", "value": "415109a24046048bc1d74abd2945c1476d4c8c308148a8c2f99e27acfe8b97df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536382, "uuid": "d0628449-e61a-4ecc-bd75-1b150415ee9a", "comment": "Malware payload", "value": "2ceb28922464eb5dc79b6658608a0cce46666d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536382, "uuid": "8b5eb146-ac86-47b7-852f-ffd7416c7262", "comment": "Malware payload", "value": "76b7e660752c4581812c74ddf105da9ff35212ffc403f0c17a95cea3e1a28feaa6954c13fbb76f5d2e8550b82137f331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536382, "uuid": "0b12d586-faf7-4b93-81aa-2dc2b25a4af1", "value": "T19F64AE243AD0B05DFD2745724D78B966571AE5384FC20E87AF81BF1E2BFD2835A01D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536382, "uuid": "988f90d8-2ceb-43ac-932f-769765f2084e", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536382, "uuid": "b9c5a868-87df-4f26-ba16-edb229e44c41", "value": "6144:PvK3l99cV4ETXhVVonX97PGkJDjfv/wdljmVQOFxnd:nK199iVElPFfUYxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536382, "uuid": "34429e5a-1bb0-4857-9662-42f553360b2e", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536382, "uuid": "7bae4bd4-3414-4469-abd8-65481d35ba9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536382, "uuid": "a8486c95-5ddd-4446-8ee1-ef4907ab7621", "value": "f1c8192229b6047748966d7db857a3e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ce476d-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697537376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537376, "uuid": "c723ab5d-9f8f-4835-b953-5299aa07c6c2", "comment": "Malware payload", "value": "5abbc1dfc2e958afe0892cdd636bf852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537376, "uuid": "14f2674c-4dc4-4f5e-8ec3-a28783823525", "comment": "Malware payload", "value": "4174b460ad82624bf1d456a0a5324fc36709730bfa87a4b238c50c2caebbe476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537376, "uuid": "b5f08b39-ac9d-41b2-94ac-49214c3ba643", "comment": "Malware payload", "value": "f9b46353b06691ca0d835cb8890bfff40776b8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537376, "uuid": "113c6d68-9fa5-4621-a140-bb1d6c911bce", "comment": "Malware payload", "value": "d9440bfde1f3d76d6e3e7d295ce488c48e0f20e240a93819d2c649414645bd651b113325fb2d405bd16354b0e5d1aae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537376, "uuid": "c8a632b1-0816-44cf-8c62-6fe4fdf17348", "value": "T13F62F957FFA249F9F7264239C4631C0F947471745323135B83BA96210E60FE2699B7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537376, "uuid": "3ea93a50-499b-4986-896d-0569bbf246a4", "value": "3c462a5dae4292289426cde61f1e4fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537376, "uuid": "3c2d1b36-f5a4-442a-9fbd-91d310b47294", "value": "192:fMq+84kI7/3lzGVNo0X/agR05e+udMpzuTUfepomPsQ5tfQrQ:3+8clzuldQfuc6AoomPsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537376, "uuid": "490d84b6-df1c-4dbc-a059-162e11022eb3", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537376, "uuid": "5cd9b211-692c-409a-9f94-9dc8ffc9fd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537376, "uuid": "b8bbbc2b-0b4f-43a0-a105-3d261c1239eb", "value": "wupdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5184b7-6d06-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697558427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558427, "uuid": "991f080b-b2b8-478c-af64-c49dd4ee17f1", "comment": "Malware payload (RedLineStealer)", "value": "a55e8d5d77b37fd169fc9fcfff9f3c9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558427, "uuid": "c4e629e6-6054-4470-bfc6-c5e9c98eeae0", "comment": "Malware payload (RedLineStealer)", "value": "41f5c89fe51314801a1a3b44c2c1ba0d6e7d608b321ebad8dfb1457e69ba4c6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558427, "uuid": "9a16f81a-211d-4526-9bc6-14b2a9bed410", "comment": "Malware payload (RedLineStealer)", "value": "1b4321bbf045ff0a609341de6814a35472d1dc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558427, "uuid": "185f6a49-c625-46f9-9d41-0f22da2e3068", "comment": "Malware payload (RedLineStealer)", "value": "a04c2fd2b2ed3fa5a188db3c5884fe3bd54701f32fd664ec5e08d7b21ccfee3077b2b1fc2d5a06327a6181cc4eff8f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558427, "uuid": "f59fc3a3-74b4-46ff-8c48-b0469ba47887", "value": "T1F4F412A6B7D55072D9FA17700CFA03930E397C618874C7AB27C5A95A0CF2998663373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558427, "uuid": "e767bc92-1ad1-480c-8e76-4c3a41d5a2bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558427, "uuid": "c6fba955-75f1-4066-9648-ce3744705419", "value": "12288:nMrPy90iO9Coc/5RcEYe93rJxRi5MDQmHEnI5phsDZGtwJ1RQD:EywCoicyjRi5MMmknkpLtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558427, "uuid": "f5533116-e9bd-4f2a-bee7-c7d86cd83e24", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558427, "uuid": "61f70d9e-7388-431b-8af5-ed614200c052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558427, "uuid": "7d2063cf-7973-4ec6-b99a-f5e784f98d02", "value": "a55e8d5d77b37fd169fc9fcfff9f3c9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f1e3f3-6d36-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697579197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579197, "uuid": "d64579c0-d7fc-4918-ae73-3292f1e95e10", "comment": "Malware payload", "value": "7598652779b963ba9188275f16e5f0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579197, "uuid": "4cd82f28-9d38-4fac-b2cf-ab77dfe790b8", "comment": "Malware payload", "value": "4206dca155bae61bc77d12b9d35544b0638c8d29faf5372153a7eb77c0cd6452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579197, "uuid": "51a3da35-67f0-4770-bbde-462c35c0b6bb", "comment": "Malware payload", "value": "701df5c67a299ce76311921b44cb1e5436b9e727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697579197, "uuid": "586a3e46-45d5-482d-b5cd-dd027e4b47af", "comment": "Malware payload", "value": "56221e4d336466ba065f89e05d2e8edda300633f74bd1c26ea9cc2523ce2da0eb6311c96b4d49f71c3cbdd0763909396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579197, "uuid": "0a5cf9a2-5550-4e46-bf6a-8b0a5b52a09f", "value": "T108352312AAD89132EA755770ACFB17832F35BDB39D79831B2B805D5E0CB3584672132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579197, "uuid": "f329ac80-23bb-44f1-b84a-08e986a048de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579197, "uuid": "0c8e4f6a-5194-45c8-9e31-dc5c9bf280af", "value": "24576:6ylUsXrKYLKMfuEACFQRs/wbfNGc53bGSzaosidZ:BlUqrKYL9fuETiWwl3SSzaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697579197, "uuid": "00525600-b432-4d61-a02e-e46a7e8077f6", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697579197, "uuid": "76335e13-6c93-4d6e-bab3-c2f093f1ac63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697579197, "uuid": "0eb07764-32c4-4c09-9e76-e2ed9a5afb4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75eda33f-6c9d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697513403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513403, "uuid": "05d0ffea-6460-4c62-b0df-0d3d769925a0", "comment": "Malware payload", "value": "49c3a1783950fa165b770f6cf5cc0619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513403, "uuid": "4dfc07b8-a551-42c1-aaa0-dbc099115b08", "comment": "Malware payload", "value": "4290c815db722f3b8accc02b6ea6f3a86f2851181533b72748ac4143ffd1edc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513403, "uuid": "0312fc43-594f-4064-a4e7-4aa600372238", "comment": "Malware payload", "value": "47704a2a06c92c1ea3a006e515548aa00eac8d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513403, "uuid": "ae16f1ab-e89a-4b01-80ec-bc4648bcf235", "comment": "Malware payload", "value": "8db41651e9679b147a53d1b79d5b5fefc1a1db402f603ad980021b741e230ed0dadd6295ba941e4065e2dcb57cde2ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513403, "uuid": "3343cd53-3fa3-4e34-b024-57f907eb44ce", "value": "T1F0E4122172D1D031E5AB29702975C9949F3BFC63A6E444CB2B543F3E9E327C19A29723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513403, "uuid": "8583b607-ecba-45d6-a8de-844df1f3ee31", "value": "a589c292925e83b27bb92739ab013116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513403, "uuid": "f73ef173-c0ed-4380-833a-920020121a7a", "value": "12288:yXfM73cG18m7J0qU3jU0dTZ0Movf9zEoAYtt1jzC/o3qSt+lzuZv5Z:y0MG1zF0/3L5ajvf9gohpzl3q4o+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697513403, "uuid": "19695322-2a6b-4639-abc7-9a5d53720bdc", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697513403, "uuid": "3c6da748-e810-4571-aefc-99cb8caf2a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513403, "uuid": "ae91c7d4-2fa1-4c9f-b2fc-25c3fcd1a4c4", "value": "SecuriteInfo.com.Win32.Evo-gen.29762.9614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006b9297-6cae-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697520508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520508, "uuid": "9d992760-cd8a-46bc-b1fa-6e537a87714e", "comment": "Malware payload (Smoke Loader)", "value": "d0574e7dc5ae1c849bdd56105dc1e0d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520508, "uuid": "5bc571a1-5030-4810-a8af-19048a548d05", "comment": "Malware payload (Smoke Loader)", "value": "4326b6988537a823ac0b6e9a3116685f46fde5f2293a530b400e20daa319ec4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520508, "uuid": "f4cfe23c-203b-4d47-941b-0b362340733d", "comment": "Malware payload (Smoke Loader)", "value": "623a9a2dbb3ea2fcf2164435e5fc7dd6db691057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520508, "uuid": "b08b1836-9ea5-458f-a6c5-776aef410f11", "comment": "Malware payload (Smoke Loader)", "value": "4002f88e5d741d1023a0b7a533af31b156435e15a5ab389111cbd05896da5897b3797f2ca7cc7b90f84f2034c1f86162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520508, "uuid": "6c7e8c21-13e9-48dd-a637-c306b9093f32", "value": "T1D555231367D90037EAF02B346DF602831736BCF29EB8C11B6666AA690D73954F432767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520508, "uuid": "3ad8a2b4-9fc0-4c98-99bd-ec9b0ff59414", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520508, "uuid": "06b9661e-4ce7-4262-9a67-24f78a44139f", "value": "24576:byvv7YJVtNNE7ME+7Ts+f9nSEF7UiuY+6F/ujf5SNS3F1rKhL:OvDYJVTEEVSEF7hl+O2zmgFFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697520508, "uuid": "9da4d4dc-6797-47c0-9d17-af448525dbd6", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697520508, "uuid": "589e3742-b13c-4532-a083-6d1092860661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520508, "uuid": "d163dd9c-1040-4236-8b05-fbe398f4286a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd615abe-6ca2-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697515778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515778, "uuid": "60ea2797-26cb-4012-966e-edc0e10a13bc", "comment": "Malware payload (Smoke Loader)", "value": "6f6f8b9080a2949f996aee4dee911e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515778, "uuid": "3c2c1dce-4cdd-494a-813d-ba0ce1942b56", "comment": "Malware payload (Smoke Loader)", "value": "43700603e556ac1aa114a795ae011c87ce432b27f53219c9f3ace8e96eafebc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515778, "uuid": "ae7861dc-0ee8-466c-af12-28474d4843fe", "comment": "Malware payload (Smoke Loader)", "value": "2dc2a1b5992d92afb4108daaed6a12362c3e6b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515778, "uuid": "8402317a-34ec-4aa0-8a0f-38b8dc8f4650", "comment": "Malware payload (Smoke Loader)", "value": "1b6743a8a1ccaabde098dc0dee5bec292c35ff2042bc6e633c14409f91d9674a29d3d5cf06566024bb3f22b47cbc6b4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515778, "uuid": "d20a9648-29b4-4ce7-a424-5c66d0a40de5", "value": "T1B3552313A3F58063EDF6277065F35263023ABA615C79936A22B179A94DF25C4AC3133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515778, "uuid": "64b73d2c-ab6f-4c39-ba1f-77758d4d5091", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515778, "uuid": "be7108e2-b1e5-4525-aa08-c6af2d6acbe3", "value": "24576:ey4vcAMa6Ip8+pPSjz4zvrIEHWC2/cLsLjWV1+o4bLypTkN+3t5+sI5yBD:t4vJM3mTSjz4IEHgK+o0m4N+3t/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697515778, "uuid": "c3eea6bc-28a9-4951-8a83-88adc0e86663", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697515778, "uuid": "1381c836-ce52-40aa-8152-366292336746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515778, "uuid": "63f24663-597a-49ad-8036-db003620a406", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd8eaff-6c89-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697504798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504798, "uuid": "12c55563-89e5-48e9-9e84-8393a0fe17cc", "comment": "Malware payload (IRATA)", "value": "686a275de08f70cbc58739f99246573f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504798, "uuid": "e50a549a-673f-4a4a-898c-b3c9ed95baf5", "comment": "Malware payload (IRATA)", "value": "44b976e915b0225b555950576e45bf91d1215c5d3dbac92a3be5c0760ae4ac6a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504798, "uuid": "a6c6fe62-85a7-4252-8d62-029d4d26992d", "comment": "Malware payload (IRATA)", "value": "d748c12c8bcf96f542db74f840f7e7c752eb5cad", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504798, "uuid": "2e2f981b-3efb-411b-8103-4083d8c2d1a1", "comment": "Malware payload (IRATA)", "value": "eece4458938fb4f3bc3c9254f95ae6452740154bd5be18ac085273e1afa1b0ba0007c80e697cb8ae6593ecd2355b3e9e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504798, "uuid": "1691c0cb-d73c-4a8f-951c-c79488df472d", "value": "T152A533E7F104EA12C9B7A735123787C5156B3C290E23898B7DB4FB7C28369EC576A910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504798, "uuid": "04cda485-4e2a-4564-9eab-6b31badf03a0", "value": "49152:0PUXYD8F8TWqLM5yeD8Y4ACfCiGRkUCmuQmAKUD:0PGF8X5s8Y4hfCi00VQm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697504798, "uuid": "cbedfc8f-11c7-479f-b6c1-02f411d4ee90", "value": 2235611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697504798, "uuid": "8920037c-e88a-44a2-ac56-e8464ef6f0a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504798, "uuid": "dcdfc7a2-83d4-4c7f-8e93-de8ca6d17d6f", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf26a7ba-6cd1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697535860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535860, "uuid": "f1bd694c-25e1-499b-923d-f1744072b0d7", "comment": "Malware payload (RedLineStealer)", "value": "8b0d8b308332ef988f2808fc0ae107bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535860, "uuid": "1fa8d52f-901f-4941-a83e-ff0d9293da6b", "comment": "Malware payload (RedLineStealer)", "value": "44f815eeb2769d9881d9a4fafe9e36e7a8c3de1a2e6cd70af5262add15d376e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535860, "uuid": "b4796815-044e-4e41-90a2-b84badaa7470", "comment": "Malware payload (RedLineStealer)", "value": "65e51a73e4b10891c01c715e91e1a8910b870068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535860, "uuid": "9a5bf798-5c7a-455e-80d1-3bfbcb19d678", "comment": "Malware payload (RedLineStealer)", "value": "df7792467ea5bde38ca873c743842454851a55363f93182b940671d7e2ec9f3b1f345398c3e1b566b5ae667cbc182463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535860, "uuid": "524eab0b-2f18-448f-a3a8-f453df4fd0b0", "value": "T169347D31345F4031F12544BA2A9C9EDFF6492B9087351C83A7DB0D7F11E02E6ADB69AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535860, "uuid": "4178ebbe-741b-4f98-9dfc-f9fb80cae40f", "value": "d9695adf5088d4aed8e28d82cde0c102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535860, "uuid": "4f218dd5-a014-4d3d-b7e0-19dfb1012765", "value": "3072:8pOlh7XHcENewtYSYyOyyCKMqBEHHgpNI0deb4NoVr7d7u1epKpK:8pIlQwyzCB2EHHgpNIJb4NoFpcGKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697535860, "uuid": "f5924b11-c5b0-42fd-be60-d3c995cd662c", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697535860, "uuid": "e111e7a4-c36f-4d49-b984-507f2b322bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535860, "uuid": "d92c57e2-2881-4817-b897-31e002d3df57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcbdc3d-6d2c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697574919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574919, "uuid": "891fa1dd-bd73-49d3-88aa-1a86ec2811bc", "comment": "Malware payload (LummaStealer)", "value": "6ff575dc9aa465705d0fd0b212eee10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574919, "uuid": "030f46ff-ce21-4ddd-a293-cb1d6d96acf7", "comment": "Malware payload (LummaStealer)", "value": "45788ffb220bdb52a1611e7ecf373be0e774c53e1e3f8bf7be0cea3f13b16960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574919, "uuid": "38bd311f-2c59-4469-ab17-3d38413753e2", "comment": "Malware payload (LummaStealer)", "value": "2bbd6d16f2687af5d1553edca5b66be514b31d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574919, "uuid": "8296e541-7995-4f08-9b72-a143e921da61", "comment": "Malware payload (LummaStealer)", "value": "2824077b344b91b54f8128c14818fed6d62cda06f62229cef23c38e1ef614acf03917ce83e39ef91f0c2f65208daef6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574919, "uuid": "68a0aff0-0f5d-49b9-b21b-34e17a9ee1f6", "value": "T18F352347B2D895B3D9B82BB450FA13930E357E829C3C975F3B44C96A08B33845AB175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574919, "uuid": "dea259ef-8545-45a4-92d7-565f86d2a13a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574919, "uuid": "eea417c1-8c41-4346-8fe0-7ffff2f97a07", "value": "24576:TyrIwnq0VSqXM1bjHH2jafSlQ53d8rMfDTujPTF:mn8LWeR3dBGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697574919, "uuid": "b0274309-5a56-4b56-82f6-28ce42c0b47c", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697574919, "uuid": "334ae941-12f6-43be-8728-ee1b4fc68653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574919, "uuid": "2279cc0e-d91f-4266-a7a6-cdf472aab934", "value": "6ff575dc9aa465705d0fd0b212eee10f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b503bc3e-6cb1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697522099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522099, "uuid": "d2016f78-1937-4e43-b1a7-a0f0ae1cc3d7", "comment": "Malware payload (Smoke Loader)", "value": "95fcbc387a18e9148f680ce4ad287ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522099, "uuid": "0cac57f6-45d0-45b1-b0df-7bfc2e5bf95e", "comment": "Malware payload (Smoke Loader)", "value": "4637a1d7cc39503a7c9bc929187b4c31d8f9830ad5c7bc366303823a27ef8f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522099, "uuid": "8ba4b18a-64bf-417f-94d4-9fcc8274c3a1", "comment": "Malware payload (Smoke Loader)", "value": "816c548a90ff7b981d125d86ba43d5179f2114b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522099, "uuid": "f56ffbbc-fdd0-4c28-96b3-dc001579662a", "comment": "Malware payload (Smoke Loader)", "value": "816109b99f4318c24fda6d1f4437a12962fa8b8e53fdb6097402e8c203d4fe99e8c326b68557672de55ce13444398b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522099, "uuid": "b0ccf803-6a9c-4f4a-a03a-b1f415961fa5", "value": "T17C552393F7E8D923E8E20BB10CF60B9309317C556C34996713466D1A9C73AD1B8B537A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522099, "uuid": "6c36d4d0-e49b-4ff1-8648-705becd47ead", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522099, "uuid": "a3b5cd8f-da70-4b6f-93af-f39d9d69dca9", "value": "24576:Xy+uLGKI8TmVTi/w4kmNRyF5myIykbbWTI4QyifYCUl39:ixLu8TmA/bs4WTJifYC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522099, "uuid": "5a996cce-e518-4c24-8ff6-1c33c97f46fb", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522099, "uuid": "587c7b60-2ca2-479f-9a28-c2d11430e56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522099, "uuid": "6b24bca1-588c-4623-a1c4-120a6b9b0bd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9349e816-6ced-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697547812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547812, "uuid": "39fbdc9a-50fa-4a93-8780-8410fe2cd2fc", "comment": "Malware payload (AgentTesla)", "value": "b6c2d158c44f2cde2132cb325c67acfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547812, "uuid": "fa00be4c-59d0-42cd-9108-d75826b84b03", "comment": "Malware payload (AgentTesla)", "value": "46f7eef31809fb7711ddf38f9bf6f5e7ec288e4d022ae8246333282696e4fc6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547812, "uuid": "c73a40fa-4443-43aa-a9f9-c116a6866bf5", "comment": "Malware payload (AgentTesla)", "value": "6e7e1ff2d5ea03f814c5ed3f929c34c70b54e2fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547812, "uuid": "a1b1509d-9c73-4522-8669-2736348108ae", "comment": "Malware payload (AgentTesla)", "value": "437110985bff66aebf069f89c354c263101f5f5fd4090023a6469433c3de5d0b3b53918e2794ed8ef4cb52b7ac7ec967", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547812, "uuid": "bb3e580d-892a-4144-a795-1b30ab04f3fa", "value": "T187E4239077FECB56EE79B3F91DA1000117F47162D8DDEF8A1E8530C69A2EB014869B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547812, "uuid": "dabfb9e2-520f-4b93-85ff-b1397bbe58b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547812, "uuid": "da6eb642-6de9-4052-b942-ad610b18fbf0", "value": "12288:lBLXmsrJM1knVLByp3FSKVn9W1b/uNcxEE2e5SS4x25D1P2y0eQ887Ser+:vLWiMOZBy14Ka3xEE28S9QdVZD82e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697547812, "uuid": "061bfd56-4cf6-4ee3-86f3-22a7578843de", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697547812, "uuid": "d306c85b-b324-4ae5-aa3c-653ba56215c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547812, "uuid": "c76a5190-ea0c-4ae5-a13a-1cebc9655060", "value": "Justificante de Pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901a8e94-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697522896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522896, "uuid": "07b4f132-747a-47ab-bb12-8da83681eda1", "comment": "Malware payload (Mirai)", "value": "852b457fd7a03ec8f8284f81fbf6ea37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522896, "uuid": "d14965e0-0e64-4564-94c3-449bd2a621f1", "comment": "Malware payload (Mirai)", "value": "49368af1d4dd9245de3470bab5fff8cfa30e2e5cae2828acda11095100b6f42e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522896, "uuid": "e5d91f54-9da5-4651-a670-f557a760e33f", "comment": "Malware payload (Mirai)", "value": "eaba9c456a06907f8f2ba4e17b3d653c94533fd8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522896, "uuid": "4310bd74-3785-4343-96f6-7d3ea64d62c9", "comment": "Malware payload (Mirai)", "value": "de8a11fd14bb46241293a18822682bc9582d7009cfcdbc59d362913015ee48d1bbd173613ec3c0a7a4592dbab7a9605b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522896, "uuid": "ace66808-33aa-49e4-9bea-1eee6ec72cfa", "value": "T1DF04D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522896, "uuid": "ddb9cbf6-89bc-4c19-99e4-c12c5a26fb73", "value": "3072:ueEksFM+wX5O6aVR8H3NaMZOTTMJxt9U+7fKbPE:ueEnO+wXmVWdaMATwJHy+u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522896, "uuid": "4f1d5615-e9de-492e-a0f9-a40b6b53c58b", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522896, "uuid": "b11c4d4d-8ba5-449f-85cd-14266cf0bd3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522896, "uuid": "81603722-b7c8-4657-ad92-7fb17dc17adc", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccda0ee-6c80-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697501067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501067, "uuid": "9569f34e-0198-4326-b696-31dcf5c1fcae", "comment": "Malware payload (IRATA)", "value": "91a45656a23d1a5b774c6f84737b6503", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501067, "uuid": "03dfd035-b9c1-4033-b993-a6a3d3aee2d2", "comment": "Malware payload (IRATA)", "value": "4a48b348e4f8d12a320122fa57224e7517e2030aac0042d95188f5ee2119a250", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501067, "uuid": "e23bb63f-b5df-49c3-8240-bd2de77e2313", "comment": "Malware payload (IRATA)", "value": "888a62854abe4bee9b46f127e6a6704888bac15a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501067, "uuid": "82f3fdbb-d60c-473f-a19a-b6e408bce4a2", "comment": "Malware payload (IRATA)", "value": "5a5455f182d091255c44c9dd047dedc41fa9e3c1cf0fb9f21963895c7c6030ea96702b9c023e0c46820f34d725b80e96", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501067, "uuid": "295ee9e3-d6d5-4c17-8d8d-d66d87b619cd", "value": "T1F8A533CBF34AD106CAE7B3709726B684557A2C558E83944F79A0333C69B3FF89B85406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501067, "uuid": "b0b28457-946e-4576-8781-8af028f7b430", "value": "49152:AE6XexrF019XtZDcbIr2h8Ukzpoj595PtdCRtXz5dJq5Wh:ADXehFIVtZDC85zp+zlH2zfcIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697501067, "uuid": "a8ac01b4-144e-4bed-a3bd-d84f3f8448bd", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697501067, "uuid": "9d54bd8b-2a73-41be-b479-812333c514e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501067, "uuid": "0f227053-e493-4831-8397-01ea5ae326e1", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126a3fca-6d47-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697586251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586251, "uuid": "87fdd453-39f5-4d6d-9db6-9b7cf1530c4c", "comment": "Malware payload", "value": "f86e663f44640721a44bab222515eeb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586251, "uuid": "281238ff-a58d-4b6f-aeca-3b5b86fbde98", "comment": "Malware payload", "value": "4a867373dd1a1f97400f342569527b09ff79740d024ede9c6659e8f472e47a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586251, "uuid": "b3c53aa6-f10d-4963-8675-69538e53da69", "comment": "Malware payload", "value": "9761ccc52e141ae7bc4ef105b2794b16627d69c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586251, "uuid": "97b19571-b9ee-4d3a-a92c-62841ef93ed0", "comment": "Malware payload", "value": "f51270107d782f44b77da409da10a07f208051018fdb8677a6d02084c0b9e97dcf700b24d1e9de7bd128cdde1a153a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586251, "uuid": "4a3a9df8-563b-4efb-84f4-80cbf54f9bdc", "value": "T12D445B5392D1BC55E9168B3ACE2EC6EC761DF550CF69FF6A2218AF2F04B0172D263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586251, "uuid": "62a1a23b-0c30-44d0-88fa-bcdaa2645b62", "value": "3aa2edb93873da388f3710ef0ad5dd79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586251, "uuid": "4f76faad-5d03-4540-8d5e-1f734d2f149e", "value": "3072:T1dYpR963KR9q86a3cEWS7lnF4lZ3CAZx5ASKQfrWq:hdYf3G8B3vWSxalIAOSzrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697586251, "uuid": "95c158bd-319f-4eaa-948f-5ae77d1cded5", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697586251, "uuid": "91a91e94-aafa-4d06-9eb5-0494818e9fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586251, "uuid": "79de1f20-453b-4945-89f8-552b7ff42666", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801a52eb-6cc3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697529741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529741, "uuid": "75cce730-f894-496d-a55f-01497850ddb9", "comment": "Malware payload (AgentTesla)", "value": "73f54afbcdc80fdb3c3dd8a0e9fa1c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529741, "uuid": "0b6bc20a-1e16-49a7-93d8-87342dadc477", "comment": "Malware payload (AgentTesla)", "value": "4aab06d62b7be6864a2844428af16f335fee3713ef63ebf637540275f40ffd3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529741, "uuid": "cc902431-033b-44de-94f3-e4bbdda4233c", "comment": "Malware payload (AgentTesla)", "value": "f543cbd1a1d3d6b9889c90f4c1e7996b76035557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529741, "uuid": "edec8783-3aa0-4bfc-9b60-115c272c8c48", "comment": "Malware payload (AgentTesla)", "value": "b90c9d48001d470792d7817fffe60cdf4da9cecf04a3cf3114767272a728f682eeeb248f0da75ecd3d6bfc7b71c193f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529741, "uuid": "b2a2dc0f-c888-42f7-8903-78d77a3b5d1a", "value": "T158F4DFAD1738005ACE3AA3B5DC82BD3011281FB965E4EAC739F57D55BE33B20A05661F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529741, "uuid": "b9d684f0-749d-41a0-971a-0564d00c9183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529741, "uuid": "25ff20b0-4cac-4d7a-bb96-61012ef3baef", "value": "12288:pDDJ92IokcsQO+VwIvByzoR/TZjue159CXExTf/Y3SJ:N/QbzbVwzqxp9eE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697529741, "uuid": "a5c0262a-ef99-44ea-a6b0-1767d7b79319", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697529741, "uuid": "56f053cd-3767-4e54-9a83-2980ed22374b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529741, "uuid": "51862b85-b0e0-420e-8853-301915f34459", "value": "73f54afbcdc80fdb3c3dd8a0e9fa1c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581d364b-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697523232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523232, "uuid": "a3ce2db7-9b69-48fb-bfd9-e03de18a8970", "comment": "Malware payload (LummaStealer)", "value": "03e566c663820ed5ebcb8308190bbc06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523232, "uuid": "db928e3a-c1bb-40c9-8ae0-004793a87781", "comment": "Malware payload (LummaStealer)", "value": "4ac607648aa2e9cb6716e95a2648bc43fdce77ca21449727a270a6b6cc6f3649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523232, "uuid": "11ec50a2-224e-4eb6-9130-9b47f1ffbc59", "comment": "Malware payload (LummaStealer)", "value": "e9ffc82cfb5dc7973c6a01491bad7968f4598311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523232, "uuid": "90470b8a-9913-4d56-bdd9-2b2e3b17d721", "comment": "Malware payload (LummaStealer)", "value": "f68e334c9cb825893f420e99b95225b748981353a4000a011e31d499bf3c511adf468d7a38bc09c53b714e0e8bf2c002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523232, "uuid": "92244326-8fab-42a9-a4ff-585f8ebbdb01", "value": "T1A705C54226054DDDC19802F677E38BA233E35AEC50E1C3AB1B9499BA6FC57F92CD4271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523232, "uuid": "fa3eca38-ab83-45fb-b8ef-86c784d5c300", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523232, "uuid": "3e509a68-5a43-4e55-9465-bd0e71276171", "value": "24576:UC+OZkZ3WFErLUaaA1KJYOodKxnXN7m/VLV:UCPZkZ3WFErLUaaA1oYOodKxA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523232, "uuid": "626bf512-63b4-4675-b574-1d8b9062f3db", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523232, "uuid": "659b7835-c4d9-4238-b429-00ffaadef087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523232, "uuid": "e36d8cfe-16c5-4712-a86a-5e69673b463b", "value": "03e566c663820ed5ebcb8308190bbc06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ecb74e-6d05-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697558125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558125, "uuid": "4cc2fd92-4ecc-4068-b0e5-20a61382f8c8", "comment": "Malware payload (Amadey)", "value": "b9a72222e0f097f96d2deb146133ff7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558125, "uuid": "c96af898-4dba-4bc9-9b14-bfb54f7410ab", "comment": "Malware payload (Amadey)", "value": "4b4f30056b0775f0fff144ee19c65b367e38a714210cb335168c60a548f16f6c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558125, "uuid": "b8490ad4-301c-4124-bf90-70633c6fc938", "comment": "Malware payload (Amadey)", "value": "f266e534610d3ef6e7fc269378d845e3e98c8580", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558125, "uuid": "b227c1ca-5b98-4a24-8fd5-33c869734825", "comment": "Malware payload (Amadey)", "value": "fac74c8a5db1f82756788156a37844e0d2a7380dc9b10ba8bb5072688454489f1c90b50ecfb266d655d33ebf054a50b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558125, "uuid": "1bbcfeab-7333-47c9-a7c7-e9ee84a5bab6", "value": "T14444AE00B4D1C472D972253209E0EBB95A3EB8210BA55AEF67D43F7E4F703C1D631AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558125, "uuid": "abc3f3c2-296f-43dc-9ee1-e3a526b02c25", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558125, "uuid": "b0b0be1e-676a-4d9e-a86a-230f40870c83", "value": "6144:N9+kyb6crtLHthXcEnc/ilUpEhWqAO9jbX+AGf:N9nyb6c5LHthM+/TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558125, "uuid": "b11845c0-93ea-47d6-b81a-ba7023ca2740", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558125, "uuid": "d643cd8e-edf1-400f-be7a-dd24c05b9da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558125, "uuid": "3989df58-ab79-4ecc-a2c8-f7f2dd150ece", "value": "b9a72222e0f097f96d2deb146133ff7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821247c7-6d2a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697573983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573983, "uuid": "1b46c12f-d77f-43cf-90c2-11f1e4f7fa25", "comment": "Malware payload", "value": "eefc84fdb2c352b19477bf8ba29b1bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573983, "uuid": "6510dc8a-483b-4947-b595-30f06e0ef984", "comment": "Malware payload", "value": "4bb1702e5b8ecbc4a91dd9d1ed77ebbdf0406b6712143b3b86c906a5709a05fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573983, "uuid": "fffb0175-714b-41d0-8029-61cbc67503a6", "comment": "Malware payload", "value": "ae73ce98fa5c9e4a4a7cb288d3f519c994cafa3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573983, "uuid": "53fc9ae8-4554-4f76-842e-9bb61558b6db", "comment": "Malware payload", "value": "08fb7edc9f82cb4ec5320bd4538c477d6f951ba566ad765db0388df9d5d77e4f440b20ad2fb635816969747a2ddebd60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573983, "uuid": "28b1c607-b559-4e34-beca-2a5f7c1482fd", "value": "T184E4136E3F897DA1D27C867604633568C6FC4197C303DB799994E2F5BE923880B3217A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573983, "uuid": "b172fa30-3e70-4e7e-9675-887aeeca6333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573983, "uuid": "d33e6849-3c20-4a16-8943-c7a7b0f609fd", "value": "12288:8cDpJR9oa1h6noEVv0xH56ULw2PaLxoiRxMfGGsjMR6lLYHHR/:fpjh4xs6MwGg/bbw2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697573983, "uuid": "34b6a388-e2dd-4900-b779-b0738998bfcb", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697573983, "uuid": "1e586da8-de4e-4852-957f-05bef598246b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573983, "uuid": "89305715-f28f-406b-b9a5-03eeafcf0752", "value": "Invoice\u202egpj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67931a3a-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697523258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523258, "uuid": "54ab10e8-7d86-4321-8ce9-3e2c60b09fac", "comment": "Malware payload (SnakeKeylogger)", "value": "0510813ffec6988f2259fb1ca510140f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523258, "uuid": "5022c1e7-b0ef-426f-9f5d-912a67a2b9e3", "comment": "Malware payload (SnakeKeylogger)", "value": "4c076ca3a33549fac8442be24c36aa480b6659e65816aa2a2a0292c1fe7a4a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523258, "uuid": "5b062e6b-ab23-4938-96fa-b166e0a0cb06", "comment": "Malware payload (SnakeKeylogger)", "value": "22e331320f6a81af1026c9fedf1d974454d9479b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523258, "uuid": "64e68fc1-fdfb-4706-b597-edea53073188", "comment": "Malware payload (SnakeKeylogger)", "value": "4b8f8dfd4c5d74f6f697a7f0184ff58db1153e6e6eb97a0004b2eeba0e4c47bd279ac1cd454bc432fdcb4efc6c74fe06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523258, "uuid": "25f1aab5-2ed6-496d-a7ca-6cb4aa481f25", "value": "T16E94AE1BBEDB5EA1D2845B3ADBD740004BB8D1D1B6B3DE4BB84E12CB88437A9DD14247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523258, "uuid": "1a5f53f3-ecd0-4d66-abcd-7d50d72643e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523258, "uuid": "50ae5bc4-be64-4bce-b02c-39db34387663", "value": "12288:v1cNNUaPs5nNmKRC/QYKpXTAQQ0M4R7VNcdYF+oCHzwap:tX7C/oDAQW4vNcdE+oCTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523258, "uuid": "c12750d3-a94f-40dd-af02-4a7ab819ccf0", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523258, "uuid": "2d2b7344-e1c5-4d82-a60b-556ac5225fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523258, "uuid": "5493e12a-d01f-4947-99dd-f0874716e123", "value": "Ygpiiqywyqu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577dde08-6ca1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697515070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515070, "uuid": "60feb346-93f5-462a-b00a-482668c1f78e", "comment": "Malware payload (Smoke Loader)", "value": "a2ea285f0a8f6badb73c94753936520f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515070, "uuid": "7fe1df65-3f16-4124-997d-f79a37f30a3d", "comment": "Malware payload (Smoke Loader)", "value": "4c49995d1c5c64500be537e329377c55393eb5a558bb58113300d76923f7f0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515070, "uuid": "09b42932-f36f-4e62-bfb8-3fe463d6aa5b", "comment": "Malware payload (Smoke Loader)", "value": "16a1de6582a50613fd5402f1d9b6ff73036098a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515070, "uuid": "a3aade9f-123b-4bb3-8131-c879edd27896", "comment": "Malware payload (Smoke Loader)", "value": "0bb56b90788a7e358996ea4249b12c5183d21c59ec8f451f59fece5a2c8490c624230bc94affc34b6a7c18100f68fc32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515070, "uuid": "60db2549-ea4b-4af0-b833-8b4cb786bb28", "value": "T1B255234272E890A2ECF12B7169F352D30731BCE18E25829A17655D1F9E73980B6317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515070, "uuid": "bbdb356f-e196-4f7a-b53f-480dac4222f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515070, "uuid": "89c2eaba-4160-419a-8242-4dbbe123a94b", "value": "24576:Ny9QBmyFmClpXOMXeJrIAngAyOtk23DjJdCzHHjifTIB7ATHibv:oCXFDXX9qIAnjtb3DjPMnsEATC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697515070, "uuid": "b3d52360-8028-4583-9722-b2189664f4da", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697515070, "uuid": "61bf0f1c-2cfe-41e3-95c5-182f10ceb97f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515070, "uuid": "a2e5e192-c905-44c9-987c-74a42470efa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7283d9b-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697539739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539739, "uuid": "686a0497-114e-40ad-8a84-2731b00e8ba1", "comment": "Malware payload (AgentTesla)", "value": "f1d5abbff199165d3be412308c494cfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539739, "uuid": "f8f714e6-6056-44f7-8b98-8c178ff96c68", "comment": "Malware payload (AgentTesla)", "value": "4c586bb1d1197451bf41ce8be61cfa82d237ddbfcaf3815303d8ff393803721b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539739, "uuid": "67f08c33-9333-45e8-901d-20dca9c41831", "comment": "Malware payload (AgentTesla)", "value": "b023cc5e2349a1359ddd5c6536dd227040a634c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539739, "uuid": "a7462776-e5a7-4140-bb63-0703a1a4c15f", "comment": "Malware payload (AgentTesla)", "value": "0a8eda5c0d3863c49f5a33a6e8d4704a6d8be483cb4e41237de1fc7bf03b3134e93f03425bb7915f3dd9819e71e72a75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539739, "uuid": "2ebc96bc-6b96-45d4-96b5-4d0b58519114", "value": "T1EBE4220133EDDBA7D17EE3F748A12248A779B6A280ABD7C41F8D24CD491DB8105A971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539739, "uuid": "1eb4e9b9-09d9-4d5b-9dfc-a2299c76af8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539739, "uuid": "b62efa51-15cd-452e-b179-26099c748e53", "value": "12288:RBLXmsrJM1TxFSZknr85KwHsXXbBbuW/psx8U8VhdgfAqcEQGZQ:rLWiMtx0dKVXb4E2/8V/5qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539739, "uuid": "4af6c151-63aa-4013-8a0d-cd8110ab51a4", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539739, "uuid": "0438f640-0421-4cd3-b486-9bc35a64dc32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539739, "uuid": "ba5b63a6-9cb0-4d6b-ba44-9739eedb4ecd", "value": "dowd_przelewu_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87c5990-6cbc-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697526937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526937, "uuid": "bd3eaa4f-c98b-44a9-9f5e-3ab1e6fa8d31", "comment": "Malware payload (Amadey)", "value": "9a1c215bb7035edfbd83251013f8d3c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526937, "uuid": "c897136d-ab6a-4a47-b9bf-460852baf71f", "comment": "Malware payload (Amadey)", "value": "4d3cf4eeb2d7e2360c79956a570d6b0505c520f342ae6245887d26e561890d16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526937, "uuid": "6655f19e-0d3a-47b5-a018-cac1b3e0deb2", "comment": "Malware payload (Amadey)", "value": "63efc93837783fa0c348776b01d7ec433cc58bea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526937, "uuid": "5e806c30-e517-4b7b-b7f9-9da50280b51c", "comment": "Malware payload (Amadey)", "value": "e57a93aff4706d9d258be11bd03bedbc74926dc526c41c0c40787b8f11f4af5f71306426f5659b1af0a4a256ba287058", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526937, "uuid": "a41a40bc-e88a-4509-85f5-4a065d32b672", "value": "T10D04AE15B4C08072EE72183609B0E7B19E3EFD304FA49E9F7BE45A751EB02C19A35976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526937, "uuid": "1efa07ac-da6c-4ab2-be6b-a298191e36e2", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526937, "uuid": "0c11de1b-86b0-41a5-965b-6759d95ca2a5", "value": "3072:WDQ5oizKw/kal99mdVeiOEru0PIBNzcoLEj3GRiaGCxnd:WjK3l99cV4ElhRCxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697526937, "uuid": "c8d3608b-cad6-4c35-a822-8517828cc545", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697526937, "uuid": "12463a72-88f0-4e01-a063-bc95f2610526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526937, "uuid": "12d2fdc4-d22c-443c-a0b6-b1382044b7bf", "value": "9a1c215bb7035edfbd83251013f8d3c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fab0ba-6d2c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697574921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574921, "uuid": "be286634-1d23-4a4a-b04b-926bae2f0a40", "comment": "Malware payload (LummaStealer)", "value": "8dc27ebbb72ef11f99a93b6a293d2c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574921, "uuid": "34751af9-9529-4bf3-98e7-d71b468bb62b", "comment": "Malware payload (LummaStealer)", "value": "4df4ec1acdc09139f205fdab8ac15d11db15ad6b5a8258b09812df6a57410442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574921, "uuid": "ff9c373a-f5fd-4e38-bb4c-90d9370896a7", "comment": "Malware payload (LummaStealer)", "value": "7bb9799b34aeb79e090345c9d593f1371badf5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574921, "uuid": "6329a30b-1569-43f6-843e-6d8ed91a7e1b", "comment": "Malware payload (LummaStealer)", "value": "b88a406d54af5a4dc23aa284d37872498a3d66f82f64cb38340397ae617f758307bd4518f450d3adce0fa2aab69f480c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574921, "uuid": "fe2d1db0-7c4e-49b5-83b2-a8d4ca1494ee", "value": "T13435230366E880F9D9B5277546FE27932A38FCE24EB4467B174A980E0C722D4A57173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574921, "uuid": "417631c8-2fe7-47a1-967b-3803dee80bb7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574921, "uuid": "7609a77d-e2b0-4776-87c4-3ced9f5c1890", "value": "24576:YyqpQHan263LKBzUyfifyA35TA+UFiai3Q5WTB+cok+:fqp6anf3eF6dsMa0QQcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697574921, "uuid": "3e631e9c-145c-4d8b-be7f-3776088f775b", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697574921, "uuid": "eb702d15-5059-4f11-978f-829f32e0d188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574921, "uuid": "1d118215-4e0d-48f9-921f-4f8133d51cb8", "value": "8dc27ebbb72ef11f99a93b6a293d2c31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff92819-6cef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697548800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548800, "uuid": "e8f6037f-3f3b-4eff-aa80-a13dab1ae60f", "comment": "Malware payload", "value": "c599903e822c6ae635084f5b72fe5c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548800, "uuid": "8559bfbd-f49e-4a52-9cb8-a2a1fa9e6f4c", "comment": "Malware payload", "value": "4f286970516f49d9114010e3de523bdc7f13608d5c1b0f87b1a4c9ebaa5fcb6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548800, "uuid": "71c386b3-876f-496c-be55-8629a6fa2a1b", "comment": "Malware payload", "value": "823ffc7c21b569019a71af501200f2eb4bd463e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548800, "uuid": "e67b7796-0678-4f2d-95a7-90c658f4dea4", "comment": "Malware payload", "value": "3929b3fda85764011db8870b128134ed6204c6ba286f9496fc04841993edc2ff24f88e62eee0a2abe8c1b2d5e429c804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548800, "uuid": "8fae559a-bf05-4cdc-8129-65d627048640", "value": "T1C5D49C43A7B7DE7DD3540B3BD18672204F6E8DC192E2F619348872E91C7BBA99D20247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548800, "uuid": "8171a527-ce18-4707-86aa-28971787fcd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548800, "uuid": "36fc2b47-42fd-409f-a1ae-e01b106c70db", "value": "12288:I96zuul5Qz3kPNvKsAARbXBy4MsnjPKtnsMki4:I9tkLhAALy4MsnjKtsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697548800, "uuid": "196bf269-f84c-4301-afa4-3055b147be55", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697548800, "uuid": "8d60b5e9-511a-402a-bcbd-d8bccc805d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548800, "uuid": "a778d9f5-4271-47d5-8abe-7e7d37962d4c", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b902698b-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697539715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539715, "uuid": "439a6c25-d1c6-4a79-80c3-abefd13322e5", "comment": "Malware payload (AgentTesla)", "value": "b1dca66504e5479a77d8c5e8ee58afde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539715, "uuid": "0e2d9e33-62e0-41aa-8f2d-2175ccbb433d", "comment": "Malware payload (AgentTesla)", "value": "4f7ee7b035490423edd7b7c641b2ac81c192252de8c5ab2e40375274a170d5fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539715, "uuid": "0432aaf8-7e28-4215-8d62-0ffdbcb68820", "comment": "Malware payload (AgentTesla)", "value": "c10e0792a7a9e5618fc1f2bad28eeadc3ce25db8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539715, "uuid": "1e259663-fef9-4699-8d76-323550c89bc5", "comment": "Malware payload (AgentTesla)", "value": "1c977ef7e32264c2a156c86ebb227df4f34c59df69ea03fe32720d9488dedb6e9353b1153bfe4136d65790490668dca0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539715, "uuid": "5dff6996-d373-4778-ab09-e64cbc46757e", "value": "T19DD42315B7FD971BF977A7FA849210001BBDF287A89BDBC90FC630CD0516B4146A4A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539715, "uuid": "f007bcc1-9dd4-4fd7-a1b1-849d77f646de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539715, "uuid": "6a183cd2-3bcd-4184-a799-0394072550c4", "value": "12288:6BLXmsrJM1iagDkWknUsProAKvxuQYfwfqMbv8oO+M9wsD+Ayr:KLWiM4aWryPM5AQ4niPiND+Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539715, "uuid": "28b48001-73ab-469f-b5d2-ed165ef26572", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539715, "uuid": "3346ba48-4e8e-4e48-8ec4-da4a83a7c615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539715, "uuid": "f0199204-49c0-46e3-a2ab-30d6419b1ec0", "value": "DHL Shipping Documents and Notification details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4955e937-6d30-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697576465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576465, "uuid": "fd848ecd-4558-4a34-acc4-77f94d54f72c", "comment": "Malware payload (njrat)", "value": "33dd87541bc8ac254706571995f70e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576465, "uuid": "99859105-4a18-48e1-9779-1d1a66e94951", "comment": "Malware payload (njrat)", "value": "4f7f672a899e6bdbb5b3352fc359cc426fe7053fcfa53036a48572bac7df36ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576465, "uuid": "ac58d9ba-ebc8-4621-ad99-c2817105bff0", "comment": "Malware payload (njrat)", "value": "bae5b770ca714de85ec789c5b5de2d0cb7e7483d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576465, "uuid": "bb8d5628-b012-4495-8407-b4bb27b1972c", "comment": "Malware payload (njrat)", "value": "2b155b5e0080d1773a6288729cda35451a28df382b056b0d27850f24c6357515768dc5e4b294662c477174efbd543b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576465, "uuid": "87b038be-0642-4157-8234-2fbab683b287", "value": "T11EB2194E3FA98856C5BD17708AA59A5003B091470423EE2FCDC554DBAFB3BD91D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576465, "uuid": "2d2fe9d8-5f19-428d-a4bb-20d5fea7f0f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576465, "uuid": "61bfe051-4e79-4abe-b71f-03d734a51e14", "value": "384:J8aZYC9twBNdcvFaly2H0dVJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZ93Q:RY+sNKqNHFSdRpcnud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697576465, "uuid": "882b27d3-394f-43f9-8bbc-7f3f85654782", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697576465, "uuid": "b3b96368-d024-4361-9f38-496b11f442ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576465, "uuid": "4cedee98-f043-41f0-9828-2a0391d9bf79", "value": "33DD87541BC8AC254706571995F70E18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3484d8b9-6ca7-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697517589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517589, "uuid": "5ddda01f-cbaf-4396-a69d-6ac065e26033", "comment": "Malware payload (Smoke Loader)", "value": "c6ed05d11f9ee2d1f36d7fbd278a263a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517589, "uuid": "fd429654-cef6-4c56-a05c-8c6e6971ab52", "comment": "Malware payload (Smoke Loader)", "value": "50a0a9155fe6f89b92b851dfdb338cf52104ea9df3b08527761379fad502ad20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517589, "uuid": "beb98160-e6c5-4e82-a548-964c83de1181", "comment": "Malware payload (Smoke Loader)", "value": "2bea82af47ea00172f4be49ed2be8d6d0c4f7b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517589, "uuid": "e641c54e-e514-41d0-a314-d0197b103f0b", "comment": "Malware payload (Smoke Loader)", "value": "efa8f6a118d0d2460a7eddc090c6c04a0aa10ba7af3f08e70dbe059dd0e63a3e2aa0e6e261d920926e8e84dfea69a3a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517589, "uuid": "fa85d853-7c7f-43f8-86b3-95abbf354a63", "value": "T1B2552317E1C88031FDFA2BB258F6026B0636BDB11E3847966382665F1DB2641B47277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517589, "uuid": "e6b9ad51-5181-41f6-bbc8-38ec5990bcfb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517589, "uuid": "ed38eae9-0448-426f-9b78-c6f5a9eec5b3", "value": "24576:uyLwNkZUpxdai09FOYnW+LRiQ9clImsH5OH/CRlNHPqmsM0LreXWlgeYdCJuDtuB:9LwNkMTsW+LQQqImsc/CPNHSgk/WLCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697517589, "uuid": "337a8c4d-e60a-4eb0-9fb2-76a38980b1f7", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697517589, "uuid": "ced93f1d-28db-40f6-9566-1696828488d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517589, "uuid": "d370f044-7f3b-4981-8796-b94c5ce0fa3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282534bd-6c9b-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697512414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697512414, "uuid": "0ecc0010-6290-4fe0-83fd-ef95b242e6f6", "comment": "Malware payload (Smoke Loader)", "value": "0c6f3d5b6457e5f3a56714f821d3c616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697512414, "uuid": "54bf7e31-d1f0-493f-b922-5ac237e9fe4d", "comment": "Malware payload (Smoke Loader)", "value": "5118e477923a5fc34de07ddc0d204a3bfbc20580cdbb94a034620a7d1d3b2310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697512414, "uuid": "95110de1-9fd7-468f-bf1f-755b622a716f", "comment": "Malware payload (Smoke Loader)", "value": "e39536d601ce25d5b19001c428bb70414d71a22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697512414, "uuid": "0d58c54b-9c0f-4696-8441-b8eea8f09a7c", "comment": "Malware payload (Smoke Loader)", "value": "46744426f79f979a7c687c6d9ac1f40350ccc6b8841dae6d2d9e5babe390ce2ac57d9960a0fc6657bdccde6dea491583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697512414, "uuid": "ea91c8fc-2245-4c55-a17e-77438b736b8f", "value": "T1F545235092D88172DAB01734ACF78B831A39BEA59A3493C733C066AB1D73B85757533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697512414, "uuid": "5eb374b7-2224-4b51-8e27-e94f927ee4e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697512414, "uuid": "f2d545e3-a416-4e2c-80fa-1b96da10529d", "value": "24576:dyd+/4VN+GH1kYuSb1BPF1B8Yr6K6V2/37ZMQ6srYJBM:4dwY46jPyYrL/1MsrYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697512414, "uuid": "8f422329-52ad-4c11-bb29-81e439dcb366", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697512414, "uuid": "5e944e3b-ff1b-4361-844e-2c96f80af41e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697512414, "uuid": "39c225ca-0f37-4131-af4f-72fde5517ddb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bf728b-6c83-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697502391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502391, "uuid": "a11c71c3-e23d-4e23-ae95-784bc12d8547", "comment": "Malware payload (IRATA)", "value": "d3b2055ac0e2a3a8f9319ff059619795", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502391, "uuid": "21cf624c-37a3-4365-9be5-a55a7cf3a66c", "comment": "Malware payload (IRATA)", "value": "51479442683feda97a2b6c6998d608aa7d520a94afc992f3aa7ed0a69291f7a0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502391, "uuid": "a33ba120-0aac-4a22-8827-e5c2a0441ba4", "comment": "Malware payload (IRATA)", "value": "65ba364d832436c688bb05fe944eabd444b36472", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502391, "uuid": "467a3b81-93de-4427-8bce-3448ecd217db", "comment": "Malware payload (IRATA)", "value": "91825e1f3c80cc3dc17e7bb6ecef0b386df5686aef38da578233897fb8b75d81c6df8bc4b47d3dfdc7fdf84ca5e7013c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502391, "uuid": "b6005e0a-f2b1-45fe-9926-2349967805b3", "value": "T1EC851213F26AA927C831C1323445163661162E68C943F74A394D37BE7FB7EE84F816E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502391, "uuid": "2ac3be5a-2c8a-4b8f-a00e-9639c36c9867", "value": "49152:vs/ikkp7XQoYJ+GWG4vZJZTzg6dVbKLiYP1YGVpkAZshBbd2LTiM:wikkpXUJ+GsvBgGVb41fpRZk9wT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697502391, "uuid": "bfc16561-8ae2-4067-89ae-7d17c5258262", "value": 1858813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697502391, "uuid": "58a69b68-193a-43cb-a569-1c260a093c55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502391, "uuid": "38f08706-01ae-4494-ab27-dff2fa0c45f5", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52acaea-6d33-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697577961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577961, "uuid": "21a3582b-7e64-401a-a193-8774068ccbd8", "comment": "Malware payload (AveMariaRAT)", "value": "4d8cfa525067203b27179173f92d1dd4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577961, "uuid": "e1d22544-fd58-4cd4-b7bc-87e5de7fff84", "comment": "Malware payload (AveMariaRAT)", "value": "51910dcba10bde10ee34e6ec7db7130993063ca0474beb95d7901248a5966838", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577961, "uuid": "9be8f88d-51e5-4030-853f-fd0bde15726b", "comment": "Malware payload (AveMariaRAT)", "value": "502061a0d06558e8252197fb92e17d0ee41ddaff", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577961, "uuid": "44859b86-bd89-4741-a53a-63c6911fe0b0", "comment": "Malware payload (AveMariaRAT)", "value": "60af00eab7d79e51ef10602fb55d609d7c3fbeeafc19b42af0f9d6a62e06162c050374ba2b35e4a837db76e668406432", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577961, "uuid": "3ab7a164-2bcc-400d-b97b-7c1c12425f71", "value": "T183D4E0897550B1DFC41BCE76CE941C75AA60B5AB030BE203A56722EDE90DA9BCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577961, "uuid": "0cc5ab6f-3faf-4081-a86a-080802bd7e3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577961, "uuid": "8c0d13b3-b171-4025-812d-c7d50a872923", "value": "12288:9NADWPCvoJ3DfF2h9f0XvLnEFpznTF7qGPKMYAGAn/d6Pb3X+AaaQRZ7wjx:/AECvoJro3f0XvberJVdYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697577961, "uuid": "7be91bea-8ebf-4fce-9c4f-f950b7a93d74", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697577961, "uuid": "a47d5344-1523-4402-bfe4-3af232408124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577961, "uuid": "5e458713-c4db-4a91-aa80-fc6377835244", "value": "4D8CFA525067203B27179173F92D1DD4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a167e40-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697545945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545945, "uuid": "aa0ee3c0-ea0a-48bb-a420-e845df8d865a", "comment": "Malware payload (AgentTesla)", "value": "efaf27c9ce39119f8018117b934901e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545945, "uuid": "e9eb3e0f-1145-4d4c-9978-a1f0f1cb8194", "comment": "Malware payload (AgentTesla)", "value": "51a93c7ee4b2ae6c6f9b7a7a6aea4c36cd341248ae7fb6b37cd772ea93499c00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545945, "uuid": "2b1e2a13-bfd1-43e0-a827-89a370b7e393", "comment": "Malware payload (AgentTesla)", "value": "3ea411c01fcac4f4a9a0e8f0572d2620ad4a1d1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545945, "uuid": "85d62e01-c2a6-40ca-b9d4-1aea19ca65bf", "comment": "Malware payload (AgentTesla)", "value": "5575b24dc105065c8f9064d149d66ce68710d4a8e28240253915bcde6a88ed12d88c77e8b3184c29eb1cfa5f23544e30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545945, "uuid": "ebec596e-e034-45cf-b86e-119b06e6ed81", "value": "T11323F23118729D40CE2B6039D0A50BF1B7B0D5E61DA5B0B11B33BE49B8E79837A86D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545945, "uuid": "74b9edd5-9ca8-48f7-b8c1-fd3ff791b13c", "value": "1536:4L1jqYOktETJIpJCSLNERItkwc+hDyoZln:QfOktEF+Nqy9Fh9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545945, "uuid": "61c9a724-0a71-420c-9308-eed322029bd9", "value": 49191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545945, "uuid": "6e784e99-ad8e-4040-833f-d68c0973e80f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545945, "uuid": "7be6e6d2-26b0-4c5b-9585-eb6b40bf3394", "value": "24090120211531MES_S Quote.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cb1f92-6cf1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697549365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549365, "uuid": "58694f5d-ba3f-4577-a5b0-9cb46945af00", "comment": "Malware payload (AgentTesla)", "value": "0d174f521596900cd6fec88c9c620522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549365, "uuid": "022f0bda-09fd-4b9c-bd3c-415c397de304", "comment": "Malware payload (AgentTesla)", "value": "51bff726b061532d5b3b5239752797e1394b4dfe902c413290427c379f2b307e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549365, "uuid": "ab04f939-70d8-43a2-8f26-b5b161c0f36e", "comment": "Malware payload (AgentTesla)", "value": "d618263f6d5675e438043622281c12ca068d3151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549365, "uuid": "e83d3226-3bbf-4ee6-ae90-03651dca9c2b", "comment": "Malware payload (AgentTesla)", "value": "2ec5d32329dd764df597bcb7b787511d562573c1aec291e2d958d322b46eb44098c3b4d8a194fa4bb7576595a3da37be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549365, "uuid": "86220a6a-13cb-4ef3-aa8a-35355ea70372", "value": "T12EE4126ECA18DC61C37D163682633DA486B4A0A7E611D716CCD186F7EB1A3C92B133D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549365, "uuid": "d0837e8d-2529-428a-a1b9-3c7f4b04dbb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549365, "uuid": "8b2e8719-e9ed-44e7-a395-0af4a7e82c71", "value": "12288:CeAkUL5Eu4x2ev1ls3k/KVg9h5lirGe9Mrw87V/7U4j:CVPUv1l3ygj5ze9M1VYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549365, "uuid": "97e415ed-509d-47f5-a133-d99cb397ecab", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549365, "uuid": "b0723658-f316-4040-ad32-355357b197be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549365, "uuid": "b8a046ba-beb7-48f1-928a-d6f32a8b6f0d", "value": "ORDERN_2.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ec02fa-6ca9-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697518524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518524, "uuid": "729f9833-1419-4798-8900-872e0e6955ea", "comment": "Malware payload (Smoke Loader)", "value": "701490a1c74a9f9b0c77063f68f7ef4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518524, "uuid": "ce20d4f6-9dde-4983-be1c-c5e58cc4212b", "comment": "Malware payload (Smoke Loader)", "value": "5266391e5f6b2e116ca5ad77381cd5f469cc6c7a2f0a09ee71cf612f1667209d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518524, "uuid": "3f30f853-4086-41c7-be87-8920782899a6", "comment": "Malware payload (Smoke Loader)", "value": "bfcc890e96675801ed2ca5f8f8e97b8cfd4ed6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518524, "uuid": "15c4b3b3-d168-4b6d-b6b8-6b664af4155d", "comment": "Malware payload (Smoke Loader)", "value": "aa3c530f1f422a8a2cb10cb68ca279df4ef206e9fc69cbdc2de2c9eb5555132ec556abede314ba6b39c46366a990cd10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518524, "uuid": "2e7f9d68-2c39-458d-8008-fa75215f10f4", "value": "T126552313F6E04173EABA2BB019F107D30A367CF16974421B7B46D9A91E73790A43636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518524, "uuid": "cec14948-f906-4afd-b3c6-624feacb8156", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518524, "uuid": "9e90a82e-d9d8-4774-a807-3749dc9d088b", "value": "24576:vyIsnSiziu3aa4OhqCkdUHb3W5cfXeDql+W4AR5fHZLCBOMRexBxYVlSENUDT:6IsRzwa4OhqCSs3HfXQqx4ALfIwxBKVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697518524, "uuid": "8f5164d9-3110-4de3-a07a-ea0d77057496", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697518524, "uuid": "3e9e1dab-c4ba-4765-a094-9cf43bd8b14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518524, "uuid": "f37e49f6-5c58-4662-ab49-3d91407e3e92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92955eb6-6ccf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697534926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534926, "uuid": "7cf30321-2ce9-410c-952e-c85c7c280901", "comment": "Malware payload (AgentTesla)", "value": "8128dc633e4f2407b4e9a8ace7809232", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534926, "uuid": "44fee7fe-acb6-4657-9de7-13bab5dd3613", "comment": "Malware payload (AgentTesla)", "value": "527bd1688c686cfb6d7fe4b85e2456a5a80c6995cb8ffc5aea8deae08877062d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534926, "uuid": "07ebf6d2-625b-4cb0-b08f-43f5b1fae168", "comment": "Malware payload (AgentTesla)", "value": "f70e0e3c13a6423bdfd13b2f9d0e93874b6bd2b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534926, "uuid": "0f2227f8-9e02-4a59-a20d-ad82166721d8", "comment": "Malware payload (AgentTesla)", "value": "72f83b27432cf5cb4b4512f0d0315913884a8c954a6b2b8dadc1acf0d219c8b0493d725074ed8a64c3baa78f617028da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534926, "uuid": "90497d6b-37cd-44f9-9885-3d0766d3b53d", "value": "T112C42224B7DD436EE2189FF42CA8D4140370F8B526A0DFEA1E9876EAC957B07211573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534926, "uuid": "1eab0523-63ff-4244-b0ac-ca943e7d9f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534926, "uuid": "ee4aa7e9-8e8a-47ba-8653-7c7e7e9d7ea2", "value": "12288:EjDJ92IpsmgOFLIp060DbIhYKbKJvMMYZaufCbYgX8KkUZ1ZFgNe:0/+mdh67Y1JvMMYZaUCbD8Kz5Fke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534926, "uuid": "dcc1aa5d-43ab-4ed1-bd4e-2b7a46f45f5f", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534926, "uuid": "a7a5fcf1-7c2c-4e6f-9391-d522faab1b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534926, "uuid": "4367e2df-4cf0-473c-988b-693067d549f5", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdbdfb4-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538378, "uuid": "955f8750-547f-48c9-a858-888832f9c5c4", "comment": "Malware payload (Mirai)", "value": "2638756afa020aab3283cc117a8d9f98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538378, "uuid": "233f140d-c4e9-40a3-8407-ddcc84825404", "comment": "Malware payload (Mirai)", "value": "548d5c6d53d03f97314aceaea47e24b66b06e27e1dedc2e9875c06314a953c4a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538378, "uuid": "ea41e654-1ec3-40e1-9363-cdcff3ac8102", "comment": "Malware payload (Mirai)", "value": "4bb6dd7122ee00203db2ac616a287cdba89bb9e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538378, "uuid": "f7ecdef0-c5f2-480f-983d-85c257144e0f", "comment": "Malware payload (Mirai)", "value": "8165111771b7d9045b11168452d109b9d93ddbb3711dae48f643d26149ce54e68e75012d36c90a919a18c281f20de59f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538378, "uuid": "e79817a0-e71f-42d1-96fa-bb90668b740f", "value": "T184D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538378, "uuid": "60a60f83-a1b2-44b4-9771-d30ee922b816", "value": "3072:gHZ+X7AoRxFOV48wlP1z0RraPuk8d+Ow9L3sibE:gHZcAuAV48MP1zuQ9Lsio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538378, "uuid": "4acb7477-f1f5-4a3b-a318-a56e75109bad", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538378, "uuid": "a9ef7775-5b99-4aeb-b015-9d263530d8c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538378, "uuid": "b10e6b6a-a500-46e0-bf68-e509b4b3b59d", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2e7ff8-6d21-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697570134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570134, "uuid": "c9a586c5-b6f5-4d71-9d0d-836cad9182b9", "comment": "Malware payload (RedLineStealer)", "value": "2a91d99a870d89877b0629230ed822f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570134, "uuid": "17241c3c-a848-4ed6-9039-2ef6be0aeb80", "comment": "Malware payload (RedLineStealer)", "value": "55d47df5def104b174ed8f80e619e379f6b29dc77a16bf71ce37d5c0933e8391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570134, "uuid": "dacce1ec-7258-4733-b5bc-1242a395de77", "comment": "Malware payload (RedLineStealer)", "value": "664c7aec36b71392f5a50aa793f80b1ce335b472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697570134, "uuid": "546304e8-39ad-408e-a8ca-3ca5e0ef58f4", "comment": "Malware payload (RedLineStealer)", "value": "378111978108a6f55103b23dc2d53e6a9727850670e96ad21c501d813233619d85c9cc04a883c6b5860ce77389293cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570134, "uuid": "7f4ce8c5-bc7e-4ce9-b952-75b29f61bcd8", "value": "T18644AE1074D2C472D8B2153209E0EBBA5A7EB9210BB599EF67D41F7E4F303C1D631A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570134, "uuid": "d0f1e84f-ad84-4839-9f9b-ec31400212b3", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570134, "uuid": "ab44ddab-9818-4c04-8dfc-63e3bb43bc9d", "value": "6144:/RdaQTO7dthO+6x+/XEpdBWqAOkUDqOxMku:/CQS7dth9U3qJku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697570134, "uuid": "7e98e9d5-d6e3-40fb-ada3-227bec95fcce", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697570134, "uuid": "211c10f0-ef3a-45e7-b24f-42d2ea852fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697570134, "uuid": "25f5b7a5-3ffb-4ca6-aaf2-e0194132a429", "value": "2a91d99a870d89877b0629230ed822f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f2197c-6cc9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697532456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532456, "uuid": "a4c4b5e0-ece6-4213-9ebc-5fa35e423a31", "comment": "Malware payload (RedLineStealer)", "value": "f4602173fb706a849c17667f4202cfb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532456, "uuid": "13f56683-158f-43c9-8dbf-1cf0cf367d50", "comment": "Malware payload (RedLineStealer)", "value": "561ee68412e92b9d76e6798fac347f84d0a63b2781802838bb461dabedaeeb87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532456, "uuid": "54807ef0-f25c-4a1e-963e-0f60aff701be", "comment": "Malware payload (RedLineStealer)", "value": "afb466aada6f1d92c335c9bbbc0773f174f34dcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532456, "uuid": "cbfcf3e4-6413-43f9-9de7-16f0b166ed43", "comment": "Malware payload (RedLineStealer)", "value": "f33ac4b6633757a869a7deb02c5614e6ea395650c40c510ce4c97013205046a894314c8aaf1931e911b2c5607fe24a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532456, "uuid": "146044f6-6f13-4e74-a3ed-f3ca7efb67d4", "value": "T149743AF434F084B2D2718934DBAAE314CE396633495474CF85C6D5250D9C26E2FEBAAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532456, "uuid": "a2e4a97d-5454-4722-9dfa-042f7220b0a0", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532456, "uuid": "8288f018-a14c-47b9-8bc5-dda034225e45", "value": "6144:3xPJ4nbndunHPqurFk4p8UJLHVj1S8b4RlBWrEWFDj8J9AQBZ0DvNVIwlab:3xPJ4o9Fkg9HVodRDzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697532456, "uuid": "7581ecaa-44b5-439f-89ba-5eaa624ebb78", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697532456, "uuid": "f1ebd071-a807-4e36-b631-745507946335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532456, "uuid": "ee3e91f7-6527-4abf-a60d-18aac6526f44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8ad5b9-6c87-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697504016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504016, "uuid": "e701c05b-9cc1-4cc2-b284-2a8bcfe611c3", "comment": "Malware payload (Stealc)", "value": "43e160e6243430ae28d99be72a2a2e82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504016, "uuid": "810cab62-fa92-4691-8399-35490768d821", "comment": "Malware payload (Stealc)", "value": "570d4585e8911b9ce48b5547f32933c61386c747b147328670b1db4ff8a87f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504016, "uuid": "cbe0d9cd-e95e-4c9e-a04c-57a0b73eb6dc", "comment": "Malware payload (Stealc)", "value": "4f19bde4d948018518edf42755211470691367dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697504016, "uuid": "0871612c-b1e4-4907-9035-79d4083aa48e", "comment": "Malware payload (Stealc)", "value": "4d16f4fca938c1bf30db1497dfda375f11b320bcd11ddbb1d8d979d07dfb52f9e31be0f9e3079d9467f053f939780120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504016, "uuid": "ad7eb1aa-290b-475e-a9f9-7dd40db67385", "value": "T12144D0227AA0D832E57319315470C6952E3BFC72AA79808F37943E3E9E703D15BA9753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504016, "uuid": "354c3e35-0a01-447d-8d87-5544c684f412", "value": "a589c292925e83b27bb92739ab013116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504016, "uuid": "2c91fb98-0aed-42eb-880a-b9490f894fc7", "value": "3072:JBNX5YC6g8L/OfD/TdewWgviBjY/iI4yfLuhqTjRXaVU1:PQgEmfDbdhK1viuMvRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697504016, "uuid": "c9a6e22a-e033-4409-a70b-8bce64a732fd", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697504016, "uuid": "8b83da4a-bdff-4a7c-b9b2-a2b2a7c7e35b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697504016, "uuid": "c011b9ca-a498-436b-91f6-7d7c42342fb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dff1bcf-6d05-11ee-8907-42010a9c0042", "comment": "Malware payload (PovertyStealer)", "timestamp": 1697558004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558004, "uuid": "f5b407d4-f85a-4a71-86d3-196a73c89780", "comment": "Malware payload (PovertyStealer)", "value": "2904b7653eebfece5a4f333ecba28c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558004, "uuid": "ee208c20-e106-4baf-b3b8-10406c307a26", "comment": "Malware payload (PovertyStealer)", "value": "5807ffef8961091a219aec0c13c73980eef926129c284cac82d977387884ea93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558004, "uuid": "362b2546-3d64-4abd-82dc-5da882d17dd4", "comment": "Malware payload (PovertyStealer)", "value": "0fc464b432c7edbe4720b3439f80432bbc13631e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558004, "uuid": "4d0013ee-3f11-4eb0-a262-965676a4cf62", "comment": "Malware payload (PovertyStealer)", "value": "ad2d621b42b4a3695e6b581c8c6a325b41ca17027e9b584e35bb6145c4277b2d81d43d82c2bae382f9cec69efd1b2796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558004, "uuid": "d4695882-ba4c-4aa6-abe4-32a7cb1f17a0", "value": "T183C39E1339C4C432F71594B784ADCEA5255AB83007235DFB3BD406AE8B65EF24B36A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558004, "uuid": "f4f8a82f-b251-4ca6-97aa-03457904a9d1", "value": "42dc4b97f00c0e49be924a48eec20081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558004, "uuid": "6fa3b426-d429-486a-9e64-1dbce6021dba", "value": "1536:QKyqh/+cR9UEF7Gk0p6E3DVHkXT1uKtXy0pUA8sEdIlc:QKyqEtEepD3y5Xy0pUdsyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558004, "uuid": "2915e8ac-56cd-4b87-a1ac-f693cb3f96f6", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558004, "uuid": "2a9b380d-d53c-4afc-abad-b32bcbf81dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558004, "uuid": "fa4d8679-916b-47e1-a15b-2fd15f7e9f6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb93bef-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697539750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539750, "uuid": "fa2a1d85-db77-415e-9f53-ff4faaa86175", "comment": "Malware payload (AgentTesla)", "value": "92e6adbee8fb332691be9a727cb4b694", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539750, "uuid": "e3147816-a542-435e-bc64-4773974fec05", "comment": "Malware payload (AgentTesla)", "value": "5ca6d298c6d1b95e2d810bf3906b55355416d88c05c17d4094f87924db898c7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539750, "uuid": "e636949e-776b-4459-9e33-403b9650e0b0", "comment": "Malware payload (AgentTesla)", "value": "cac63154cf6022f1bc939c3de82c8ebf04b9efd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539750, "uuid": "c8f826d1-0384-40e5-90d5-e434e4630c69", "comment": "Malware payload (AgentTesla)", "value": "c9bcb3eef5e82b5aef00ca185386efbaf0a3da5fa7acd7a280229a6dd5dff1c446b64c2bdeaf53794f3bc82dfe4d8d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539750, "uuid": "d7e3c389-b72b-4ef0-aa0b-33ad92ad882a", "value": "T115156DD1F150C8DAE96B09F1BD2BA53024A7BE9C54A4410C569EBB1B76F3342309FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539750, "uuid": "4a2fd28a-fa8a-4fa6-8f5b-fd0c07b9fc03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539750, "uuid": "1749db0b-2383-4983-96d6-d87a0c0c4c48", "value": "12288:WHDJ92Ib0kdXYvGitGgpV7g8l3onFYjJn5Ht6gUINo8cVsIv7:i/TtEltGgpV7yYjJntkgrsVsIv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539750, "uuid": "0fdd1c27-57fd-4c42-ba72-2367a69a908e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539750, "uuid": "a39ed106-a1fc-451a-a6b1-8b8ad58fece6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539750, "uuid": "b6bc1755-dfe9-44f2-b26a-2b6ac5773471", "value": "YEN\u0130 S\u00d6ZLE\u015eME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f20f43-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697545968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545968, "uuid": "57ba53f7-668d-40b3-b4c6-ce13a60be8ef", "comment": "Malware payload (GuLoader)", "value": "0434f8f8ecbedb6b3e19b857c1fdf73f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545968, "uuid": "5b2865c9-e949-4f98-9337-a003fa3e9932", "comment": "Malware payload (GuLoader)", "value": "5cc5d61fbb43948bb1e3da2fa8adc0af7efb7353124c73519e285d01d9303a43", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545968, "uuid": "7fb4763b-e7d7-483a-a6f4-4d73861c43a6", "comment": "Malware payload (GuLoader)", "value": "6ab244e2273bd75624ea6b69d37f798482415c89", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545968, "uuid": "23dc0618-1da9-4d48-98b8-894eba9faadd", "comment": "Malware payload (GuLoader)", "value": "de8545b81f5fd77e091a05a29380815e53159512398deb029a199ff5ebb7c1908919dbe5e8ac79fcfa40c9e8e5d2b8cd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545968, "uuid": "c1170746-8b48-4c31-80da-c7848368befe", "value": "T11E8302C56E3384CB9505ADB1482C6B274F3EB319F5B0A247EA603EA34563F5510B09DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545968, "uuid": "556e6c08-b0fa-455b-8b77-56c8c9d7e568", "value": "1536:Ecnd5P3V8fJv/qbQGEJcxDOQVhWahlg6ffBcRMlv6rx07VyOwg1QT/w021U:EeVhyJcxDfVhWahlgIZcyl6zAkeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545968, "uuid": "5b5cac69-7636-4d54-b604-7b6f55113ec7", "value": 87204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545968, "uuid": "6564d399-06dc-4a38-a92a-3214d2931064", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545968, "uuid": "75f435fd-7a47-49fc-96af-91701f4cec7c", "value": "Upit Rekreacija doo 10_16_2023_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017ca541-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1697538119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538119, "uuid": "69fe6c38-80a2-4048-94c6-cbcc4128a11e", "comment": "Malware payload (Gh0stRAT)", "value": "f029c534a1dc47d593f1aa413432cdf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538119, "uuid": "459c6f9f-fa4c-43a4-8d3e-612e226a5383", "comment": "Malware payload (Gh0stRAT)", "value": "5dbda634d2ac2fa1c53a15b77ad8c0772d578e004fa98fea7668c6082f00b1a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538119, "uuid": "9b85e585-cb58-4896-b803-02f75fd60870", "comment": "Malware payload (Gh0stRAT)", "value": "a886715ebbce5c047e3e23dc8d0aa513b2b194b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538119, "uuid": "381c5040-dabf-4182-8285-a3d4a6a8ee06", "comment": "Malware payload (Gh0stRAT)", "value": "124730a9e9e21e1b99fae4f269dfb2eee4d8b1942e208049935ed4817a0e15a3d26ba6e21409facc09854c13ce1c63a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538119, "uuid": "32bc4863-0906-4b5e-8c45-43ce3f062111", "value": "T16E260213706A800FE6676DFB078F817055F46EED60DAD30D7282B71A06FA328159F7A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538119, "uuid": "50a5bbdd-1911-41e8-803a-d95f0f55374f", "value": "8c3834fc7034d44bcc087a16f2eb9619", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538119, "uuid": "790b91b8-c127-42d7-a367-c336aae24c0e", "value": "98304:FMKSSFYyri259a1iGrqHKBQLso2kFK7RNVYRiD:yKvS2LbMqHOQIo2k8ZU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538119, "uuid": "20ae703e-c0d2-4880-870a-c669d7eda8c1", "value": 4612096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538119, "uuid": "da6d5349-68d5-48d6-985c-24f682862762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538119, "uuid": "82d0a23c-3dfa-4957-9202-3475d96a9410", "value": "f029c534a1dc47d593f1aa413432cdf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f807afb8-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566879, "uuid": "d27642a1-dab8-4463-8a0b-943e09ab761a", "comment": "Malware payload (Mirai)", "value": "311619cfee47d83d03c56c670a6973a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566879, "uuid": "5d65b5cf-d456-4980-adce-6ada7cc72791", "comment": "Malware payload (Mirai)", "value": "5e2dbbf28ab4f9059f6a88218b78c3bd097d1082c3f2d61de81e5b6f744a7aca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566879, "uuid": "be6a7af7-724a-4c7e-a7ab-708cf625f2bc", "comment": "Malware payload (Mirai)", "value": "d97e45f9f3c51659c25c98655ab7e94c2905e26f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566879, "uuid": "967ee086-e03c-405c-a879-4caa81338fc2", "comment": "Malware payload (Mirai)", "value": "358af48b3a47ecd4d12f807dbfa0b41d0115506bfa6565bea3fec16aed7a2b93343edf4a5cf8cce156eea84b1b81f075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566879, "uuid": "17965633-dc8f-4ac2-946d-93cf49a17e10", "value": "T10CE2F197D371A452CE747AF1F96A85CB2ABD8BACC57B30A31A0156282D5B0535F2C8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566879, "uuid": "2baf1639-1036-42f0-a786-e45eb15da432", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9X/t9q3UEL5I1:1orm1vpALgUJ4L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566879, "uuid": "4e8461ce-5ac3-47cf-96f8-d571c92f99d6", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566879, "uuid": "de9d446d-5879-4c99-99da-837da8aea33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566879, "uuid": "fedce329-5e9a-439d-bad0-83ca3bab5f3d", "value": "311619cfee47d83d03c56c670a6973a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ced169-6cb9-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1697525327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525327, "uuid": "df46f08b-9d75-491a-b99d-89e0a76e2452", "comment": "Malware payload (Loki)", "value": "2dc05b83f18fdacf71b4f5312c39c700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525327, "uuid": "e9787ac8-2a11-4b77-913f-d5001b647ec3", "comment": "Malware payload (Loki)", "value": "5edc09b099bc0ceaeb320c048504de1d50baa137314253c92baef7033a776c0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525327, "uuid": "5154c592-34f1-4e22-9db2-71870607150a", "comment": "Malware payload (Loki)", "value": "66d60047ba5f3dd064a8079ac5c133c19b062928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525327, "uuid": "ce0784bd-d947-4bbf-807e-a8d345485e31", "comment": "Malware payload (Loki)", "value": "06bc64b6bfc2f9b139b6054b9904414e6d078c0b59fa6f49f2c53b2a028e83fadd7751f49921084b0d8fda8ecdf14133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525327, "uuid": "9592a7a5-ab0d-456c-9a28-8a02a6507d16", "value": "T13CC4D09C3250B2DFC867CD768A646D64EAA07477531BC213A01711EC9A0EAEBCF156F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525327, "uuid": "98268ddb-2318-4a8f-9d0b-28e5745b16e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525327, "uuid": "a520dbca-4326-41b7-9a41-ae2138ec3209", "value": "12288:mRAzfqBubEhib2EFHcpt+foSM7ABLQo6j/4Wejsj:KAT6dIbnHmUHQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525327, "uuid": "64bc6dcc-2273-495b-985b-fb5c4573ea89", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525327, "uuid": "5b3c162b-ed3f-4f73-a037-795f6b34aeae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525327, "uuid": "931c5275-f913-4b12-9fa8-fd606e419c25", "value": "8FIpmViI3DJZE8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae358aee-6d31-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697577063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577063, "uuid": "cc8c6301-5a34-49f7-8d94-30d4d56e6833", "comment": "Malware payload", "value": "194722e3c7b1dcf0f10c681095ed6d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577063, "uuid": "981917ad-801f-489a-9d9a-9839398998b4", "comment": "Malware payload", "value": "5f17f3d4964619bed6fc0dd713a7e6bedcfdf64454a03dbd33d548b0f6147dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577063, "uuid": "5e44fc90-2945-49c0-91b4-2d9555d219bd", "comment": "Malware payload", "value": "5a1d537c3a49b990fe04b04f166cc0fb619a3ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697577063, "uuid": "2e145472-dd8f-482f-85cd-b3d6b8ac3f24", "comment": "Malware payload", "value": "35d90dc86c42f966ae7df5e501ac1c2eab614dea809eadb49ba1f23ddff12e0d3ebbb0e04047da0ede6fe7f59d215620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577063, "uuid": "7ee57efe-3504-4a66-96f7-9af1d943934d", "value": "T189352309A6F46237D9BD93B049FF02930F38BDD29CA486163781BD4A0DB374196357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577063, "uuid": "3ed0ab00-d2c8-4b47-9b89-99e71331856c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577063, "uuid": "a8623acb-fb1c-4af2-a4f6-3cdad8e4453c", "value": "24576:CybkumyUslXI0emWnkUt/jP5hfaUCIziNaJHbfO1Ga1d3fz:pbbxUsZI0emYJT/JeN4HDva1dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697577063, "uuid": "b634019a-e59b-4ecd-874e-4d3320ee42fc", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697577063, "uuid": "268a73d3-642f-45c0-9ef6-eb4a3cfba973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697577063, "uuid": "916e76f9-6892-4868-b99b-c7924d25512c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0b5d14-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1697523324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523324, "uuid": "c64af42b-2200-4036-b73a-4ef102816791", "comment": "Malware payload (DarkCloud)", "value": "477cc65774868d033eaf9d66441da0f0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523324, "uuid": "cba2cce2-68fa-43c0-95bb-dabc83950306", "comment": "Malware payload (DarkCloud)", "value": "5f7aef928b23f4025570371dc20c0d63eab7d4e26dcab1d9776fcdf310a9b794", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523324, "uuid": "052680f9-f304-4604-901b-0b05e9e54886", "comment": "Malware payload (DarkCloud)", "value": "6125f4a464c3b66a9afd97bb133cdbee76a1ea31", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523324, "uuid": "23168bc0-973f-4e2c-97ba-a1701244427e", "comment": "Malware payload (DarkCloud)", "value": "df76f60bb9eccd948a169364d16ee4f763805f824c2b14e5aa85c70795e107550327c69a8b9d5f591e7fb6bd7c2d8f9d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523324, "uuid": "a889d957-f5dc-4a40-aebe-736bbf3740fd", "value": "T1B3942301E3A1EC7EE9F54B735778551B1FA9ED2E25A4910F0B40320CBCB62D2A61F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523324, "uuid": "63f0fcbe-d803-4625-9433-f3d44b554af2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523324, "uuid": "b826c201-8386-4768-82e3-9c4aee575a1a", "value": "12288:jYPybbY1pVepKBmEAf2b1X78ARjafb47s48Oa:jYPKY1i8Bm5eX7Dm4w48Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523324, "uuid": "1f731622-acfb-47e3-ba41-92b5b1489547", "value": 443252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523324, "uuid": "8d80c0ad-27a3-49c5-bb9b-9b1a2ad55c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523324, "uuid": "63dc8021-e205-4ea1-aed5-eb363f00e31f", "value": "SWIFT-EUR 130,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d941c79b-6d1a-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1697567257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567257, "uuid": "766ea8b2-9aee-4f95-8ebc-e40404594f9f", "comment": "Malware payload (RiseProStealer)", "value": "72cc6f88a7301db1086dcbe0119e5087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567257, "uuid": "0f0dac50-f46d-4350-bc09-c2afcb463d7f", "comment": "Malware payload (RiseProStealer)", "value": "614229293870b4b64469ee384fa377480e7630cd9ac3191cd1169cf234e3f855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567257, "uuid": "e14e7af8-c7bc-4b1d-aea4-e4ec7664a042", "comment": "Malware payload (RiseProStealer)", "value": "40cbc09e547149c93cddf9ef56b67e6c083c4875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567257, "uuid": "fd52f0d3-a510-4dd9-8b99-8c9bf00850b9", "comment": "Malware payload (RiseProStealer)", "value": "51d383dc4c1207f47eb669040e8556e50aa06defc73bd533e74878ef9ec33756fa5c235f2f0c68cc5fc195609cb6a9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567257, "uuid": "af6fe6bd-d8b4-42f8-afa2-bcee5b163655", "value": "T193E53385F9000DCDE99C427460668A71F1369CD72CD5065A7C0FBD8BBBA86770E36A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567257, "uuid": "3448066c-6a33-4574-b00b-e3de063384ee", "value": "a7b93c85322555ce5149c255418da6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567257, "uuid": "21d191cb-368f-4cab-a2dc-830dc682a814", "value": "49152:R8oNEPTDAiffI3MaZP5eeGLBXwlDDouqStqFH5hOFDLwkFzZ3w5w9cJ0+/P5kOGq:WPAipaBoeGFXI/3qSMt5s4Qdi7d3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697567257, "uuid": "76d42021-a189-430a-bfeb-8ef9d5f9f0d3", "value": 3148728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697567257, "uuid": "057ffac4-29cb-42de-af66-621820681bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567257, "uuid": "13c994bb-bc17-4ca5-9491-7f5489a33395", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4464d863-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697545962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545962, "uuid": "cb553426-c766-4544-a34f-14f0b0125ec5", "comment": "Malware payload (GuLoader)", "value": "232a1bd593de54cb7c8137ae9d62bb4e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545962, "uuid": "4a09963d-774d-4e6c-b005-471a0f72606a", "comment": "Malware payload (GuLoader)", "value": "6250d0527d1bfa56fe670a3703b0a2e50d1f8c85789c3fd576e5e77af978a41a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545962, "uuid": "1500d846-01c2-41c0-9393-2257767f877c", "comment": "Malware payload (GuLoader)", "value": "9cb0fd3f566278038d03cbe2fcface90d192729d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545962, "uuid": "5e79e13b-e35d-42d8-8102-c3b054a1f33c", "comment": "Malware payload (GuLoader)", "value": "078c5454f4e7b99d7e6284df715f68877d03d68c9de7f90ff405ca02223e7b7b65a7706dd03d67241fa5a21b0b3758d2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545962, "uuid": "07cd0e88-533e-463f-84d1-e92ee54320e1", "value": "T18783028AD02BB384D965E5891F322BCD8D0376BC2E7DA5965F1C67FF05D21116C52F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545962, "uuid": "bf54af32-199c-48cb-be0c-d5dc9c181aa8", "value": "1536:BdiBbvy1YXGUo6yxC1FDkvFbtFECYxc0NBy51d5kxKnwGeBqmbGJhXxzCP5ESJmz:DY61YXGUOxCvk9bdYO0c/ehGeBq6wChg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545962, "uuid": "8e89158c-a6d8-4e4b-9e2f-24e59fda6f29", "value": 87095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545962, "uuid": "22c72abf-985a-4758-9801-5a37a781c971", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545962, "uuid": "ce0913fe-a854-4ee0-9ead-dbb9bbe12f9f", "value": "SOLICITUD DE OFERTA MOLITALIA 231016.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982972f6-6cd3-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697536654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536654, "uuid": "9db4c088-6850-44df-8ebd-cdbbaeb079bf", "comment": "Malware payload (Stealc)", "value": "3a77fc04743664066168d91666d06b5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536654, "uuid": "feea9c95-752e-4744-9cdb-d36759245852", "comment": "Malware payload (Stealc)", "value": "64774aae4c0db099f244f96e6748ae04765b12472197d1dcd537e6a1595339db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536654, "uuid": "b34df721-b985-47a1-88b7-58c21bf06cc4", "comment": "Malware payload (Stealc)", "value": "b926086c429eb881f803c2b7ca2b57c743a5bfeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536654, "uuid": "53d08280-322b-44d7-9c92-bfa038e710fb", "comment": "Malware payload (Stealc)", "value": "ea70d82a96c4dc2902a5e102120a112bf419a99f3a16741fd199943b7ef04b9928201c611db54eae5435387af4449a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536654, "uuid": "3e5529c2-730a-41bc-955c-86868fd3b4a9", "value": "T1CC343A9382E13D94E9268B778E1FC6E8761EF7548F4D776912189AAF08B00F2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536654, "uuid": "1f444249-80d4-4898-869a-4a7e3ddb4f4d", "value": "e8b76dfd97b58fcc0350cdefeabf1153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536654, "uuid": "72edee0b-57d3-4f73-946e-e82d8d21096b", "value": "3072:MMtC0IbZTIEeoel/Frh2p6Q+PS6UIFyAIUFgToQ5+QVQ6NBkW:zubZhs//2p6RHU+yAI6bQVQ6oW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536654, "uuid": "00b1aa97-90e4-4e3c-9ffd-26a1a0caed02", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536654, "uuid": "0febe8eb-d2b3-4013-a8a8-2c8fc970c05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536654, "uuid": "ece02365-1b01-4d30-8954-160b65f7dc27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d840917-6ceb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697546836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546836, "uuid": "6022179a-80c6-488f-a29b-cead7231aee2", "comment": "Malware payload", "value": "cb8281100a60caf31f7cd0de2abc88d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546836, "uuid": "b3fe00b2-b6ee-4fb9-bb6c-2c170c3ef75b", "comment": "Malware payload", "value": "64ebfce462a34d5bc2e149af5c7659214dea4b681954658d0c62e9ef7ec816ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546836, "uuid": "523ef847-c6d4-4681-b061-1c442e163782", "comment": "Malware payload", "value": "2293527516305ad1fed191ceb64453c1207bd572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546836, "uuid": "a0de7780-7766-45bf-935f-9bb72c01253f", "comment": "Malware payload", "value": "12933b0ff807572e7bb5f01aa63500686718a0c2a71b5ba4781ed3d9f1a59cd74fd3a1c69501645c94dc4d78b8a8234b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546836, "uuid": "9610851c-6853-49b5-a5d1-e879309e9c60", "value": "T1F44523436BD88533CCFA1B705EFB21871675FCD19A74C3AB22C5695A0CB22D0A938727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546836, "uuid": "85ad83fe-8131-4ddb-aec5-de6adead1bb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546836, "uuid": "d43d41ec-f140-4c92-8feb-f38dea5b1e22", "value": "24576:Uyx/QNIgkA9Hf7XW2pyRSUQk4zlVdSHapBOKV75cSyMMCq1qW:jRILsRiz30HapBOxyzq1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697546836, "uuid": "dfd54c90-8983-4112-bea2-114c8bf82475", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697546836, "uuid": "67cbf72e-3167-47be-a09e-6d6e774375e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546836, "uuid": "427f2523-8c47-420f-8225-a331713c9701", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fa121e-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538388, "uuid": "4ec3cc92-99a7-4f31-95a5-2d6df02603d3", "comment": "Malware payload (Mirai)", "value": "6812fd7031b4d05c02870e8b9b0a3014", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538388, "uuid": "99058fed-8327-438b-aab6-80b1996edb40", "comment": "Malware payload (Mirai)", "value": "64f9934d3a419cf3c4414a415ba75e7dbc8acabe096dfb682df798a9c92107d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538388, "uuid": "ae9839a3-a604-47ff-828f-b432232bd8b9", "comment": "Malware payload (Mirai)", "value": "1c580a3d57fdb38b50091fd6f79f2ebcf8e2178f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538388, "uuid": "c4d4a82b-337f-4324-9dad-9ce460ec6e91", "comment": "Malware payload (Mirai)", "value": "7905f287bf28734c10ae324b0777d375926b79dbd034fb545f09d7d31765f03a66457717a62f774bf521ea371c13f1f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538388, "uuid": "edcb01bf-53f8-4787-a1fa-367d743d7c5b", "value": "T16C936CC5F683D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538388, "uuid": "1d850db4-6e9c-4c81-9563-cdd8c5b0723a", "value": "1536:xpmWc2AcighsZ82fJxfcvHH1mSsM8y6Q+gBQ9TnkISGtAdr0xZ:xpmX2riED2frfcHVmL1Q1Q9kVTr0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538388, "uuid": "1766636a-776f-4e59-a1c8-8a071e24f587", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538388, "uuid": "306b499e-8cb0-4714-a55f-7ba47133c349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538388, "uuid": "f6c68f69-ac63-43b9-aeb6-97da234b806e", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d9ef6c-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538393, "uuid": "137ca1d0-8eb4-4f62-abaf-953d4da257cf", "comment": "Malware payload (Mirai)", "value": "17de5f85e41e3a5b7a70c4ccf647ce3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538393, "uuid": "90d3c1db-cb65-477b-8ebf-6aaad08a7e51", "comment": "Malware payload (Mirai)", "value": "66f2ffb360d7d2be14a502f6dc0621c59b40a0f9b661e43f961da1202d975a6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538393, "uuid": "dccfbccc-30cf-4c55-b5f4-4110c4765644", "comment": "Malware payload (Mirai)", "value": "d1fd581a4735c6505e70029deeb53ab4ec7196db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538393, "uuid": "8afb1abc-ec8a-4463-8d24-e0ccf8bf4b14", "comment": "Malware payload (Mirai)", "value": "e994eb051c4e9c0fabc7e0dff8221040e6b70ab873cba3bf53bc7a9d64ce9ab5631646c798dcc1deba44884663c7fac1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538393, "uuid": "0f030c34-6d04-429f-9603-65baf937d2b1", "value": "T1C9C31A45FC405B13C6C212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538393, "uuid": "b6a6fcd9-1b42-495c-a1ba-0ddaba776c00", "value": "1536:Jtv+s43G5bUWkwRAbSh71QAFMxK4VIGUT2yR2hO/CoA46n/txlc6wyw1FrR7PVz2:bv+XQjRUg71QNE43UqyR2hOO46/ykbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538393, "uuid": "a28e7d36-c52f-447a-b8ef-8cba5d1e9f91", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538393, "uuid": "8c838fdf-c6b4-4c46-b628-83b57afadbf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538393, "uuid": "9992141b-17b8-4e0f-81f5-fc52c7b83914", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d6f707-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697537537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537537, "uuid": "787489f8-0f88-4e67-b4a6-9c26eff23697", "comment": "Malware payload (RemcosRAT)", "value": "f3447835046bbd5dfc272f89cf4a22f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537537, "uuid": "97078e4b-8840-41e6-990a-1710c0668f78", "comment": "Malware payload (RemcosRAT)", "value": "683b1aa79c5e0658ad46b136527a047a44eac01c497133e379015d7902fb783b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537537, "uuid": "e38056b5-6ef4-4047-8f2d-e5207ce33428", "comment": "Malware payload (RemcosRAT)", "value": "0a7828a28ce01af2a19287df47851ea761853239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537537, "uuid": "569e7645-7b4f-454b-a78a-8e73b43dbd89", "comment": "Malware payload (RemcosRAT)", "value": "0de74a290ec57d85efec0befb417241ec6f469d4e73512ed181ac19c24a1d3b2c51821bae6dccefe58a806df70b94da2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537537, "uuid": "e5dccbad-e7c9-49bd-ba8c-b10c6b27e750", "value": "T19FA5024AF4458DE0CA556334DAFAC9250B21BEA67972D10E2CCC3BE73A737921C16C5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537537, "uuid": "8c27a52d-030e-4afb-a1b0-7a68b901f840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537537, "uuid": "8d0262ab-2c6c-4082-9c37-81acbc1c75d6", "value": "49152:eabxAW+DKp2Gf45tu9U/IaETT5Qik8UbTF7EjQ4MxFt:Hsh5ZgmBbx4vIFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537537, "uuid": "b71d54b3-0dd5-416f-88d2-eafb2dd29a37", "value": 2127360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537537, "uuid": "63d022f8-40ee-4470-a097-bfa5eea40051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537537, "uuid": "bae829f2-7746-4ad3-9346-0e656ec0c9a9", "value": "PRICE CHART AND MORE DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0754db35-6d1a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566905, "uuid": "1fc2e1fa-dca1-46fd-a7b1-de7b00453b91", "comment": "Malware payload (Mirai)", "value": "ac4b93e55a5d3a0009ea404409376906", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566905, "uuid": "74d089bf-3fbe-4e93-b6f8-63f0f16c2dec", "comment": "Malware payload (Mirai)", "value": "68a9caaed45743de1b795f7296c3536c94328ce8f7f8c0a8e300972b28496e60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566905, "uuid": "329c1521-6760-44af-90ed-2673844785c4", "comment": "Malware payload (Mirai)", "value": "489f47f126ba081150fcba23cf1fb11d11a48000", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566905, "uuid": "f915c17e-4bba-4ae6-b22e-3c046dc292c0", "comment": "Malware payload (Mirai)", "value": "0c31beca99c137f5b7fbfbfbf84ab814c551f80fc3c62a242c056c90c9cff27536b28e397c6120a06a353983566ebadc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566905, "uuid": "021d267a-1b2d-4f5b-854e-ade72d4be903", "value": "T1DAB2D0B48B919B06C6B0B475A37C8F526E3B55E4C5F63826172092FCDA8146633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566905, "uuid": "d8951f1f-6e9f-4cd3-8f83-684cbf8b7392", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+Bt5/p4QhymdGUop5hu7Y:4GHKQFH0rs3zWoDDRsjt7LB9U+Bt5Psx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566905, "uuid": "c95d2ebd-533b-47a0-8118-814f540f8e1d", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566905, "uuid": "3927a7f4-d7ad-4f34-8723-c1e267fabe63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566905, "uuid": "d9aa3ad4-7907-404e-8c60-fa8cf10695ce", "value": "ac4b93e55a5d3a0009ea404409376906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6315be9-6cfb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697553911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "728e0717-df40-48f7-b2d0-bb701bc18f72", "comment": "Malware payload (RedLineStealer)", "value": "1663ef55fa6b9bb8889c4ff1bb25ec8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "4bfe537a-38e4-42df-b322-408251cc13c0", "comment": "Malware payload (RedLineStealer)", "value": "68c52b5d06a02d8382c159de27eceb800d1c5f8ca21c03b00f17a9af11ee250d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "441f75bf-fc07-48af-9660-e0846d4f4d61", "comment": "Malware payload (RedLineStealer)", "value": "46019cb99996d57d5457abf06afacaea018ca057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "848ca852-91dc-48d5-8b4c-80c3cde66ef7", "comment": "Malware payload (RedLineStealer)", "value": "a59121f43cf98b7b82ada30b56dbb939070425664465e1acc1a05422f5d76886aced9a7c56c537ecde551fea10534c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "ae79a1f1-1a9c-4f09-9dc1-560e89061e82", "value": "T19B252312A7E95033DCF917B059F706D31F38BC915E38896B2758DA6D2C31A80A8397B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "98ea4ca1-e4e6-449f-a6b1-ce50115dea4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "a451dbe0-ab5f-4cff-8ac0-c9503afc8397", "value": "24576:6yOj4R3qOoORtW+Yn2/Ol73gBJfHSy4EYDo:BOjz4b3Y2WdQBBjYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553911, "uuid": "ddd23af5-f3e3-47db-a18b-c99e5d73150f", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553911, "uuid": "b04486e4-be56-4070-a66a-4b7ae44d9778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "aef4a886-6947-48c6-972d-41f989f8e5c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de44e6a7-6d35-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697578862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578862, "uuid": "7ac7015e-5e08-499b-8b17-097fb059c610", "comment": "Malware payload (njrat)", "value": "70d8a4cfe8f75bef1d5cea3ba0cca2d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578862, "uuid": "bb07af2f-6469-4790-bc46-4eb7e5977073", "comment": "Malware payload (njrat)", "value": "6a949940330b0828af63f56d10981f8596ef1c24952b058e40af09ce6e947100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578862, "uuid": "69c6210c-c31b-4a4c-861a-e56133810454", "comment": "Malware payload (njrat)", "value": "636d0bb422ed168d310a31160d69aef1aec90d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578862, "uuid": "e31f9e1f-18f6-4a2b-965e-16f7523b6a0e", "comment": "Malware payload (njrat)", "value": "62ff64d3f817f2f4b915a3d9fda1c447ae13b6a7f46379ce03d26d4174aef47b15fd796e83025e2fe3b73fcd071bcaaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578862, "uuid": "a75fd54c-9f2e-4a6e-997b-dbe53909b3cc", "value": "T16FE21BADFBE64466D2BC1AB50571950013B4D043E523E77E8ECA24A62B2B7D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578862, "uuid": "d273a4f6-d50d-4151-a04b-584d161233be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578862, "uuid": "96de3fc5-5a07-46c9-8c07-f5f0bd8535e0", "value": "768:ZRZghV5VXPKzxF+dt+XKvJ+rvaPQmIDUu0tipcj:mfqciMQVkzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697578862, "uuid": "32c26726-6698-49a3-b314-4ef22b78f92e", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697578862, "uuid": "b61b1f8f-e15f-41d7-9f92-c894943bcfdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578862, "uuid": "fc1965e3-a661-4e59-b405-5c64564a9d3f", "value": "70D8A4CFE8F75BEF1D5CEA3BA0CCA2D0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659009a4-6ce5-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697544300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544300, "uuid": "4d3c262d-e898-4c77-a5a3-f0cb5eefb440", "comment": "Malware payload (GuLoader)", "value": "9b40ae8c6dc8f35af3535a7b30c51d80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544300, "uuid": "2d67d754-4bc0-4add-8389-0da40a139011", "comment": "Malware payload (GuLoader)", "value": "6ae7089aa6beaa09b1c3aa3ecf28a884d8ca84f780aab39902223721493b1f99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544300, "uuid": "8b4ba231-048c-468c-822d-61caa46dd7e9", "comment": "Malware payload (GuLoader)", "value": "6526c781106b303b7f21861e8bcc255d4f356143", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544300, "uuid": "0b28718e-7535-4571-98fc-fe0b12eb4548", "comment": "Malware payload (GuLoader)", "value": "c0ff99cb442e5731876da1e804ee745059f63b240b616076d7e3aa4061c01e3f429360805a949e4ff76c19dd8755a082", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544300, "uuid": "449e2a14-fba2-4233-a0c6-c45bdf55a5a0", "value": "T11E75337228A8D5BFD94646328DBADEFC81F1EB3156911F477005C8DE2AEB441C9834EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544300, "uuid": "053cdcb2-df24-4c04-b31d-81d02f4b8029", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544300, "uuid": "cee3f98d-f204-44eb-aafc-82da24de9a62", "value": "24576:ZU2aMOTAxrYHURbf4xDEgdRYTYMkfDv6Ti5yz1ZtUK7Yq4VnRmhPxomtv76Nu7qs:ZOfTAGhygdDDiThz1vJ7YqYURF+IIhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544300, "uuid": "edf58d79-510a-4205-abbe-56ab24c7c796", "value": 1694856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544300, "uuid": "7594be3f-842e-4399-ab2f-38861f8ccd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544300, "uuid": "81b5f0d0-0375-424b-9b03-b1176ce9f6af", "value": "9b40ae8c6dc8f35af3535a7b30c51d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a177fca4-6cee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697548266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548266, "uuid": "a33099e7-ef65-44ff-b255-deb4a9d2971c", "comment": "Malware payload", "value": "59ac504e0c31149b23c9a148c25926cc", "object_relation": "md5", "Tag": [ { "name": "mp3", "colour": "#70B75B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548266, "uuid": "bddb2931-fa77-4897-a0ab-8bc023cfd9a3", "comment": "Malware payload", "value": "6b77ba56e180dc84994a99aebbb3b44c5a40f9e2548c408b4c1df77be1547bd0", "object_relation": "sha256", "Tag": [ { "name": "mp3", "colour": "#70B75B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548266, "uuid": "9ef41567-8ea5-4b03-a8d6-d3b8300e5851", "comment": "Malware payload", "value": "00bf716fb3a401cad957111d7ba794292d09d241", "object_relation": "sha1", "Tag": [ { "name": "mp3", "colour": "#70B75B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548266, "uuid": "701d71fc-3da9-4283-8e5a-6d6375dc8726", "comment": "Malware payload", "value": "4990aeeeb5653e21014ac1f549664375de78e1600b01d7fc901e7a832ab4a06b74378d859492e9c321791a92f24969fb", "object_relation": "sha3-384", "Tag": [ { "name": "mp3", "colour": "#70B75B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548266, "uuid": "81d37183-6110-4ce2-acf4-2c49168b4fa3", "value": "T107A4124F07A7FE90FC86A43B2FDA80C55C9C408B66F995D6EC858E189895D2C9C34EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548266, "uuid": "57b39833-c98a-4584-8d45-b506e5c06a7d", "value": "12288:P7lmYKqN4FCHR7WwDavKphPER56RJzAM+/kNpm:P7lj4CdWBvKpo56RJf+/kNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697548266, "uuid": "bdffe6b6-a9be-47cd-b840-c4efabb6958e", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697548266, "uuid": "13b3257e-97a5-4054-9a22-44870aab3aef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548266, "uuid": "a3bbc0ea-8188-4a92-9dab-0a66bfeddbcc", "value": "Zvlphlek.mp3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40ea9f7-6cd2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697536378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536378, "uuid": "9d806fea-7265-44cc-ba85-3782fbc0bf26", "comment": "Malware payload (RedLineStealer)", "value": "1bda1c74826d6c13ac1f4ba9c09e9495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536378, "uuid": "fe3ece15-f713-4b4e-ba16-ff0499e2a783", "comment": "Malware payload (RedLineStealer)", "value": "6c18ad8f2c22bf2ef02b3e56e2678d79c6cd7739d92d7abdc81bd7f19c9ce393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536378, "uuid": "8da79f76-6fa5-41c2-9fa5-68c0eaec104e", "comment": "Malware payload (RedLineStealer)", "value": "70d421f217eabe72a45adf1af9e5c7087302bb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536378, "uuid": "af7be0f4-bda6-4089-8d24-a523735e15b9", "comment": "Malware payload (RedLineStealer)", "value": "f1b5aeebbe4cdb2474ca782a5a2ca3b81840e905796f33e658c2b88379e84af61aac8d9130ac011361471f206c1826b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536378, "uuid": "c8583a46-63b5-4a5b-8268-130fb03e6cb7", "value": "T190744AFFB0876493EB421776372ABD1C8871CBEEC55DED537E4883D14DB69818068A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536378, "uuid": "24db7896-ab56-4fc2-a677-65789bd875e4", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536378, "uuid": "ab97acdc-cbb5-4fa0-8bed-fe3445071481", "value": "6144:D4K3l99cV4EiGAtb26blStS49njhQhPDEuWDkhpL/BF+2vw0xnd:sK199En1tS49jhQhYkL5F+2o0xnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536378, "uuid": "11f67407-0ccd-4261-b28b-421469bb5a92", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536378, "uuid": "8195a333-869a-4cbb-983d-98b984073a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536378, "uuid": "6d37ac84-25d7-4b20-a15a-2bb6fcea66f2", "value": "1bda1c74826d6c13ac1f4ba9c09e9495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be60a25-6d12-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697563638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697563638, "uuid": "91972f3a-ea5d-4c19-988e-bd94c4d565c2", "comment": "Malware payload", "value": "628a221b89b9168f68837e30e117cd3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697563638, "uuid": "ef7080b0-b22f-4f4e-a49f-62c41727a2a1", "comment": "Malware payload", "value": "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697563638, "uuid": "f8c96714-716a-42c3-a17a-106cdc3f1f38", "comment": "Malware payload", "value": "30fa0f2fc556d897e12e8a244ef341c36847cd79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697563638, "uuid": "48d2b07f-0ff2-475e-b37b-ff3e233adc1d", "comment": "Malware payload", "value": "4ff6d8936dfa7d659aaf71f3a741e65758a012da6bb61010a02fa9f049a223b15b6704423f06568fe69be89a9d17d53c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697563638, "uuid": "d805bf2a-6c31-421c-92a6-f43e643d7088", "value": "T154352243AAE88562CDB55B7018FA13870F31BDA38C744B1B2B825DAD9DB2788153537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697563638, "uuid": "7210c027-4341-4b9e-ae14-6eaecc9f949b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697563638, "uuid": "a7c395df-5eb4-432f-b04a-268e341a1f09", "value": "24576:PyEq2x4EgTgog4g6efAB45aqa4YzbuFWMBBE:anIgTjgZrxQ/VMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697563638, "uuid": "94715f00-8a70-45e5-a040-d5d06c0d477d", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697563638, "uuid": "2de6cefe-8727-4ec9-966a-2046cffe0f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697563638, "uuid": "b6d2e809-b116-4829-a37b-83cf8c33041c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f50c41-6d3a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697581056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581056, "uuid": "94c86373-9042-4625-beb2-2ba1048e37e1", "comment": "Malware payload (Stealc)", "value": "c2ecd7c9e75b18cdf3764d4980220005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581056, "uuid": "4729b939-ea93-4864-aa60-8f3f79d32d51", "comment": "Malware payload (Stealc)", "value": "6cc1f9a60a3727e76de7105861f46cbf9308532c851a02193db1022e987aaae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581056, "uuid": "e09b31e9-82ff-4385-9a69-117b150f6c3c", "comment": "Malware payload (Stealc)", "value": "7e1fde662e683b8909b6a45731cf1d3d2cbb7915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581056, "uuid": "7c40e682-29a1-47c5-ba83-af2a61dfd119", "comment": "Malware payload (Stealc)", "value": "a5d4f4ffe57694278bc5e0587fa315aae2ee921c168a9577dda3ab81b7139ca41c55dbc4876f292716f89cc41882dad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581056, "uuid": "19656ba1-a49f-4447-a5f9-3c47cae30687", "value": "T1B9352362E6EC5072E9B703F005FA03834F34BCA25979475B6709B94D1CB3A956A7233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581056, "uuid": "f302d36b-f201-4a8c-bc98-36e23a0d9280", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581056, "uuid": "b80d0ddf-a4b2-4d40-b809-b10f7e3b3df1", "value": "24576:1y9G9Ji/AY7LFhZh6ofp8/uM55O5YZBhBvUg44vnSOgbyzeN:Q9aJiYiJhZhh+bO5YZbF4wV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697581056, "uuid": "b1f17273-107c-4934-9276-f6b182b1fee3", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697581056, "uuid": "eaab10b1-9284-422e-975b-441092d50cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581056, "uuid": "77a0298c-d3be-49ce-a1e8-fe8d3ecdacdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaca336c-6cee-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697548281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548281, "uuid": "5ad84b8a-4cf0-4cc9-9eae-351537a81d69", "comment": "Malware payload (AgentTesla)", "value": "1c86caaf667d408ed5f1e847accdbd03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548281, "uuid": "bdfeeec1-24a5-41c4-8140-3bae1b20f839", "comment": "Malware payload (AgentTesla)", "value": "6cc94af7278990c89ed746ebc99759dc7d847cfcdd3cd327d15988b489e3e59d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548281, "uuid": "2c0cb664-2499-46dc-b6ae-3aa2af00026c", "comment": "Malware payload (AgentTesla)", "value": "bcf5a35139086846442c3431b388dd7a8ae76429", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548281, "uuid": "142f5cb5-75f7-42a5-8c2e-4bd34ae16e00", "comment": "Malware payload (AgentTesla)", "value": "368bfcf82d2120dfdfc71ee1915494d90b5ee22cac26e0fec79dc68fcbbd39fff1736247de44c07ab96274096c7a358f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548281, "uuid": "16d6dd95-d756-494a-b201-30bb26d83a7a", "value": "T1B7F4D044BBD39250F27A49B90BD9A990C61F6F162E03CA092E8633DB4F31BB75510FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548281, "uuid": "83abd5e5-e890-401a-bddb-2fa41aa1e6b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548281, "uuid": "d9def8c1-3ee8-4cfd-905a-e2fa95e9eb3a", "value": "12288:1MYnQ3j67SESV1eXl8OhA90W+xpWokahBnz/OlfgHc6fWlh2q718BMHHBngz+bQO:1B3xpMah5+g8k3cEyHmz9qhv2Uz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697548281, "uuid": "30986f2e-9c45-4174-b3ab-fcef16f8a7ed", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697548281, "uuid": "113ebd46-e2b6-4dfc-90d9-4bda89668efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548281, "uuid": "fb63d0f9-eaab-4557-8b6e-c8e45b3d80af", "value": "documentpau.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdcaccc-6cdc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697540586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540586, "uuid": "6c9be69b-6042-4e1c-bdfb-f6d0296fdc7a", "comment": "Malware payload (AgentTesla)", "value": "6e0dafacdeee6f2d9463d0052db5cce8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540586, "uuid": "4d2844b4-d154-49ec-bfaf-b2ef37842bb3", "comment": "Malware payload (AgentTesla)", "value": "6d905511eb7f3672603bc86b2589df6c7b7a24a208e78cf6aa5a82501c3796cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540586, "uuid": "83bef1cb-62f0-47cd-9e5e-ad53ef649c91", "comment": "Malware payload (AgentTesla)", "value": "9d4e3619adf76850ddb35a5d6cad4296c2fae864", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540586, "uuid": "f95b50f4-66c4-4be4-a872-6dee2436bf65", "comment": "Malware payload (AgentTesla)", "value": "dd6606a4acbc10c54c76225fc6db7c7842c758fc8ef0d744d8238d47f8a03a56fdb17569e4d44a128cab00be313fe1fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540586, "uuid": "f75b4c07-ff07-4c20-9d98-c0acf1be423f", "value": "T1A634FD037E48EB15E5A83E3782EF6D2413F2B4C71633C60F6F49AA6528516426C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540586, "uuid": "84826855-06fc-4bf8-a522-a32e3d94c466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540586, "uuid": "45ca1d95-c248-4bb7-8bb4-2b8f2eb36360", "value": "3072:JKaVcQkgcNn2d3laIp0NijUVa7K/VczMaRwogK5uUISs08u:EqcQkgcF2d3laIp0NijU7/iPRmQIS98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697540586, "uuid": "5bc86691-b42b-4f5f-8a7e-6525ea6fa1b2", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697540586, "uuid": "3d6946af-c077-4753-87eb-249c4a616d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540586, "uuid": "6b05f41f-2723-49e9-90d9-33a91fb36c37", "value": "1697540584441f082ada98156762af16e3ec47c3abd14a56e7860597d947f4471ac8299438901.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453c7724-6cfa-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697553265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553265, "uuid": "2ba076ee-8e6b-4b8c-b208-e6b030feaee5", "comment": "Malware payload (Healer)", "value": "0fc9cee6808909feddf5c8e4e30c7abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553265, "uuid": "9ee6ba44-40c7-4ed0-aaf8-100463af7b68", "comment": "Malware payload (Healer)", "value": "6d9b4a93f740f8bfcb75f34163e4a8e5eba03c0a61b187c356011f7f367246d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553265, "uuid": "f72b5eaa-06d8-4150-9f31-ae4b034aff73", "comment": "Malware payload (Healer)", "value": "e7498be8807c91714ebcd30d698e3ea0670ef6cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553265, "uuid": "55aab58d-f700-4fa7-af8e-7461e2817cf4", "comment": "Malware payload (Healer)", "value": "c96c2daafdf6c199c022d53707b9e4ed81dc03614aa28679b761a487f6cc06775af164f8c2485ab1ac9a094e0ebae170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553265, "uuid": "3e57c199-e61d-4e75-9676-9dfb37ff33a8", "value": "T114252302ABE89433E4F567B054F64B870F397C610974463FBB48983A1872AD168B377E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553265, "uuid": "123826d8-2854-40c7-9314-7d2f13cdfc0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553265, "uuid": "bdc99c8c-89e9-4448-85fc-13b7afbe32e0", "value": "24576:8ygbPFjq6/rtm4RLWdXuFFFymJ5throrhUniYRHA:rgbPRq6ztxS0b/vrDnBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553265, "uuid": "6f5a1658-860b-4426-9952-9fb40179f58a", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553265, "uuid": "2353ebf2-206e-4322-a6c5-5047f357227c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553265, "uuid": "3a339a86-6f15-4437-8d11-c72edcf74a9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f6826b-6d1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697567565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567565, "uuid": "a26ca9a3-d876-4462-b6b9-6adeb11f813e", "comment": "Malware payload", "value": "b4e0e967a39c0899ed9cac5ed4349c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567565, "uuid": "34e5b8e4-953a-497b-af34-912aa8720d58", "comment": "Malware payload", "value": "6e0bc02f4cd4fc35745d77e77cf3cd9c46696f24a2a7fa4d160b167f25c6f5db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567565, "uuid": "6819b367-fdfc-414d-872b-813b7930365a", "comment": "Malware payload", "value": "d1a48a0ca771152179d9b78cb549d10728c86212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697567565, "uuid": "dde6e9ed-fe3e-41a5-b2d6-b2cbe9f5d3b9", "comment": "Malware payload", "value": "72bc38561e83d5715c56c6bbb79ab20d3ad66273786640bfb35dd29c131e22a1c5014e6837da75c4ffc439e1f5b4dbcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567565, "uuid": "bac78934-5dfa-4d08-962d-46e36dd528ff", "value": "T190352257E7D89837F87A13301DBA16970E397C93187D934A2BA4AC464CE368058727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567565, "uuid": "6409af76-e931-49b9-ac9a-a506fbe3e7a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567565, "uuid": "b7ca198c-5c60-4fcc-8aa2-d631d7ac311c", "value": "24576:eyG2jZhah+IuOz6cfwRcfm8m5J4PBjEPX2askDAReZtNYF:t9j8HuOzZ4a2J4JE+asNReP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697567565, "uuid": "08d8e54d-3c51-4614-8b5b-7596fe6767e9", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697567565, "uuid": "a82bf054-3009-4dc7-ba5a-77d06df2c3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697567565, "uuid": "77a207fb-9525-410d-a862-25f40eacf1c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195c0f5e-6cff-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697555339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555339, "uuid": "64e4076d-3fb7-4c10-941e-17de4836ba15", "comment": "Malware payload (RedLineStealer)", "value": "9569cf1983d115fd30ebf30a558fca28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555339, "uuid": "f214d634-2a42-416b-8bac-546bd83388bd", "comment": "Malware payload (RedLineStealer)", "value": "6e3da629f58585ed8b4a732516294693db5158c8e5c551b1c35d93e46e009a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555339, "uuid": "476906f6-13cc-46b8-a157-4026ed63aa8e", "comment": "Malware payload (RedLineStealer)", "value": "b592fb89c0ae3d8ff12df590b0a988c51dfeecad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555339, "uuid": "a51bb6ff-1111-44c8-ac6d-68e9da97f39c", "comment": "Malware payload (RedLineStealer)", "value": "df3088dafe7e82367d70c3ec5cd9fde321fdc763223d1a6564a6412b8824c0cd8f887763f2ca9ccbb9b57960d656d6aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555339, "uuid": "045db7c0-8e14-4f20-bb48-423b2ff8ead4", "value": "T1C4252313B5E98026DDF467709DFA0B831A727DA6CE7001227781952A2CA3DD4EA7533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555339, "uuid": "df40d57b-ae71-4658-a299-2918c4540230", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555339, "uuid": "b40745d3-d948-4f15-9d8c-ec25f3912f08", "value": "24576:RyELBKrOiyCQq5FNvReXf/aMPVLFL77OEWKhip4:EELBPFe5FlRc3ldOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697555339, "uuid": "815a3319-4ee5-476c-8fc9-6e6179666e36", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697555339, "uuid": "a6a1e185-ef84-4a44-b73d-28f4ffe5c175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555339, "uuid": "cfe4d5a3-9da9-462e-badd-9fe3ff6e125e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e43c3d2-6cf6-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697551669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551669, "uuid": "f244224c-66c8-4bc8-af0c-46765f8c8d5d", "comment": "Malware payload (Amadey)", "value": "da2692b6e62979609f5df7128e9e5a40", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551669, "uuid": "cf4dae54-595d-455b-bb56-b7e256892c08", "comment": "Malware payload (Amadey)", "value": "6ecf835556c666d9c17c11473060876684c92536382867c591c66110ff225f7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551669, "uuid": "71558a4a-f8e7-40a0-91a8-4b35b30b297b", "comment": "Malware payload (Amadey)", "value": "24ea47ded658b54b96c7f78fb5986839ef43eb0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697551669, "uuid": "6dbda6fc-541b-44a9-a553-9d1f277da721", "comment": "Malware payload (Amadey)", "value": "423c9bc80c04535f09975edce0ed6bc42e5e1248ac2064da2b94b2a9fdf9346be6f57ffbcf1ef0456e050a30f4947efc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551669, "uuid": "7c3b5a74-ec11-460e-8b4d-a18cb9a7b311", "value": "T1842523137BDD913BD861A3B11CFA16C71E3BBCE29D3097A27264D52648B2EC09935327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551669, "uuid": "f2773312-44fb-4684-82cf-4f1e86e13d42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551669, "uuid": "acac8fd8-7028-410e-adda-ea862d7f4074", "value": "24576:vyXVbt51bQgz7yh9poJZDXXir93DJxD1OoTproHVn4:6X1rFD7yh9mDCyoFra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697551669, "uuid": "2feb9b3f-6784-40e9-9091-dd5d11bf43c8", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697551669, "uuid": "91ca676c-74b6-4725-8580-a959bf7bfaad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697551669, "uuid": "b949a8af-135c-45f8-8ed0-9b24cee86452", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631224ec-6ce5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697544296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544296, "uuid": "ba9c37f1-5edc-46bb-adf6-4c213c7bd9a5", "comment": "Malware payload (AgentTesla)", "value": "7876bb77fa613b4bcea4b6f87330d686", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544296, "uuid": "d0ba6fcb-2353-49fa-9435-8b9e0d4cc529", "comment": "Malware payload (AgentTesla)", "value": "6fedb05b8cf5b61e947236d5933ad251a3d47dc8b3415ef50ad2d763df91cd16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544296, "uuid": "91a8fc88-4ef8-4737-97ee-94ff63a0fdbc", "comment": "Malware payload (AgentTesla)", "value": "1f8baf1d9fa25e30b29dc8891a060ad6ceca092b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544296, "uuid": "32e6b5d0-0fee-4e8d-a3ce-22c8c95c1415", "comment": "Malware payload (AgentTesla)", "value": "4bfd2e6938a749e3e84ebaffe5737426e8c22e9d5ec550be46c84811336662e2189e0529d9aed69981527045e9453b84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544296, "uuid": "f7350112-dd06-421b-abfc-29ec2465e689", "value": "T1F815E189724848F0C83EC3339222F1938D3D9FE5ABE1D61D54C177AA67776C8968B247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544296, "uuid": "32ecbe10-eba3-4ab3-9a33-b92db207e51a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544296, "uuid": "14a6d916-7e4c-44eb-a83c-542b1212cbf3", "value": "12288:3RTf89q75Eu4x2ev1ls3k/KVgWRSx8xSjm3uimF0dSmAgOxwr:3x89qkv1l3ygRx8Yym2d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544296, "uuid": "63085918-5fcb-4da4-b85f-036087d1eddb", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544296, "uuid": "96417673-b71f-4cec-95b2-a7155d34a770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544296, "uuid": "557c5100-4003-4288-a5bb-49352243e816", "value": "7876bb77fa613b4bcea4b6f87330d686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b93fec6-6c8d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697506568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506568, "uuid": "aca74c2a-7162-475f-ab7f-2287e7254bb3", "comment": "Malware payload (Smoke Loader)", "value": "6b1c8d19b11eff572a70f674107cd2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506568, "uuid": "1df9d7c7-b047-4142-becd-0af13fcee28a", "comment": "Malware payload (Smoke Loader)", "value": "70190c21a83981710d854d77ca755ec7c2054199a8dd7012dc504791f7dcd438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506568, "uuid": "af9c1c6c-2eab-4291-9d46-bc2633c5840a", "comment": "Malware payload (Smoke Loader)", "value": "53e137b5b01f7e0368ba74af044c7b90190b3fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506568, "uuid": "ae6567e8-ddc4-4276-88e1-72ae0b753620", "comment": "Malware payload (Smoke Loader)", "value": "c94b508f18c52b2bddf8f512e1e615294ddabca453a172572fa7bcc0fbb553407a909297e3d3d8a80ce3e05a4b94ce61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506568, "uuid": "57b9aab8-f82c-4cf7-bf9b-3f1c4ebd39ae", "value": "T1C43523436AE88073D4B167B158FA02831F36BD916E39076763864CAE1D726D1B87273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506568, "uuid": "d0d40e62-7759-4c2e-b9da-18bbe84477a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506568, "uuid": "0c87f823-6cd5-497c-971c-7a7f02ceb476", "value": "24576:LyNZUCw1bw4bFLIbEt9veA0AJWBFuBAWJznKbN0:+VewMIbEeA0Ae3WJzKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697506568, "uuid": "c0fec8b2-1624-4410-b3a2-77c64425b820", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697506568, "uuid": "1eaf9750-6caf-4795-b481-c805a386e4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506568, "uuid": "8170df09-aea5-4677-8c0a-924a4fd21764", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b57f92a-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Nitol)", "timestamp": 1697523774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523774, "uuid": "154ace94-cfd6-4f16-8b5e-7e84b7236454", "comment": "Malware payload (Nitol)", "value": "dc62653f9e2468f587b27fb7bb8857e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523774, "uuid": "c0c22634-eb3d-4473-82cb-5ae9be24aec5", "comment": "Malware payload (Nitol)", "value": "702ac05f0c523270a003e54c250535f52a6fcb5745089037a00b4d21926edca7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523774, "uuid": "8dd1ac53-92f1-4a62-8de7-00994047866f", "comment": "Malware payload (Nitol)", "value": "9f7cdfa22858528401886fd08ebe8848356076cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523774, "uuid": "a139d14a-d661-4342-8473-2105fb618cee", "comment": "Malware payload (Nitol)", "value": "798f0f5a4d6f6842434c0cec982c9bd71ead477f36f6cfff3de435f4ff1477e918ed02ae26b5198e79c1de846dbc758e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523774, "uuid": "969ab9c9-14ee-425b-9d17-a6237d95f0d7", "value": "T1E0636B2176D0C072C05A64756855C3B15A7EB931DBF9C583BF9B0BBE9F212C06B3A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523774, "uuid": "ca7275e2-9f58-40ea-95fe-c82cb3b74899", "value": "070b5b44988eb91ceb5948a1cf23bcef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523774, "uuid": "3f780e37-f874-4947-a12d-19e6c8bbbcc8", "value": "768:G407txg6CVX762AORxFGPRDEEOsx3n+79Namb3GluLrXCS32Ta1NzBoFsxHv5rMx:Gd7TGAgFqoQn+mmTCuL7NNzBl55rw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523774, "uuid": "da4cc304-b932-467f-914f-6c0e1d2ebe04", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523774, "uuid": "072ccf9f-6278-4dc0-8f62-235262ceaf84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523774, "uuid": "5271b4bc-84bc-4400-a1d7-ef60edba078b", "value": "dc62653f9e2468f587b27fb7bb8857e2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f02862-6d47-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697586577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586577, "uuid": "b0d40899-402e-452d-8561-9cbfad3bd33f", "comment": "Malware payload", "value": "3af769dae147792fc1ed561b944cd1ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586577, "uuid": "5898d8b2-d2ad-45e3-897e-b691037526c0", "comment": "Malware payload", "value": "70c585099f0c4cc551566cc0422a10fbbf1231ba561790e365ef8487ebfa13e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586577, "uuid": "18d6b3b4-686b-4329-aad7-b553a557d1e4", "comment": "Malware payload", "value": "2d07be242f5a282cd68e2d06726380183ccfcb48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586577, "uuid": "0920d079-c971-4771-a67f-ab8d52c57d6d", "comment": "Malware payload", "value": "a39bfb1cc2c763fa53e2c8adf296f648128e8064d6a9ab7f31b05c02f7e1e71babd4e6839402096cfd7a93e8103f59a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586577, "uuid": "17249af4-130e-4d48-93d6-74a7c9b5fed9", "value": "T1E53523E266E4A871D8F527710CB216D30A36BCA8DC34979F274A78AE1C735D460353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586577, "uuid": "e7a18bee-0d36-4347-a5cf-ad1dc48a1eda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586577, "uuid": "654d4159-5ef0-44c5-bd6b-38e9544c0171", "value": "24576:iy1GZQr7TFkRP9vfy0wPBsNTpFCUaNftrrR3vrAU2L:JYZiveRuBE9iJNtTAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697586577, "uuid": "60f3ce17-ee44-45b4-8a18-814b16e1c920", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697586577, "uuid": "f6d9e7e9-b119-4fc1-a752-14c4b804561d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586577, "uuid": "cbbd900d-3eea-4fcf-95cb-bf8826a28a31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e370bbd3-6d29-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697573717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573717, "uuid": "e3bced37-456a-4566-8297-c4131cdbd5ce", "comment": "Malware payload (Amadey)", "value": "acc098acced4f19db4351dae8f2632e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573717, "uuid": "7cc6116e-e70f-4d2c-9e5e-d8ae013f2387", "comment": "Malware payload (Amadey)", "value": "710ebb9cef72eeee6e52c6336341919bf31b69d5e97643dc3255fca7618514b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573717, "uuid": "9f336ee5-c8de-4d53-8dd6-9287448e1b2b", "comment": "Malware payload (Amadey)", "value": "a8424c0541ea2b11d75391ec5ed789141a42f131", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573717, "uuid": "34e6ff6f-de7c-4bed-a016-7cd72195e71b", "comment": "Malware payload (Amadey)", "value": "8aa9f639c6898e25f1f76904045ade805981f409558138551732ff7caea2b53d69ac5d613bcedc3165251f054a23b463", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573717, "uuid": "10eed95d-24a0-4f22-b48f-b65a84912e05", "value": "T14C44AE0075E1C473C573153609E4DBBA9E7EB9210B7189EF67988F7E8F302C19A316A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573717, "uuid": "9f574152-8007-4481-890f-493945881e42", "value": "cde9adcbea0243fbc6ee703199b5c401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573717, "uuid": "a2ba06bb-4a14-4009-90cd-1fbe7e892656", "value": "3072:VJGTim/7u4spGahWcy23rT1YCj2AFnKFCWWCMLfCpBJqs6uRtNeAg0FujGn6S188:PGFK3RlYo26KFCW8m3JqxAOCdor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697573717, "uuid": "3fa32a7d-03f4-4807-b9c7-e062b74a9000", "value": 276816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697573717, "uuid": "032350d6-d4df-4fef-9c95-ff75cbfc187f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573717, "uuid": "3ca93905-5409-4c18-96ba-16be788109ce", "value": "acc098acced4f19db4351dae8f2632e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb4e725-6cc2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697529331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529331, "uuid": "9722b1d8-511a-4be1-999e-5fc045566a30", "comment": "Malware payload (RedLineStealer)", "value": "8f2c88ff4f984d82d0adb907adb41fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529331, "uuid": "1f6dd2df-1f13-48f0-9b94-f9f16a897c39", "comment": "Malware payload (RedLineStealer)", "value": "71c3bdb2696ffe105bca88e4e1295000de2b5c689b4d8787928e45c74f5202f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529331, "uuid": "26d72a51-3f5b-4349-8a81-2e8b642f998d", "comment": "Malware payload (RedLineStealer)", "value": "5ddcada7deb3ae9b5ba69f50d644f33757281ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529331, "uuid": "367abd96-fb7f-4fad-ad89-40a575e73b0b", "comment": "Malware payload (RedLineStealer)", "value": "010900a368bbb38920b75616a4af9ea886d4755289cc6ea60a684529b622f44caa26742b5261ec1d3c162911d08ac6ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529331, "uuid": "5ee37ce5-91a7-4d60-8f37-e1f50f2fc85e", "value": "T11104AD45B4C08072FEA2193209B0EBB15E7DFD340F609E9B6BD44A7E4E702C19A76977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529331, "uuid": "e8bddee7-819d-4b94-a584-1e6fe9048c1d", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529331, "uuid": "d7d8edbd-0575-46d8-8a1e-4bab6b26ee36", "value": "3072:kDQNyizKw/kal99mdVeiOEru0PIBbcAuFsqqRl1xnd:kJK3l99cV4EjA8qRl1xnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697529331, "uuid": "361c93d7-f34e-4816-94b2-640ec12adfaf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697529331, "uuid": "f6865007-2e70-43e2-a2aa-3129dd3f3080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529331, "uuid": "f4cc0049-33be-4404-9a7b-430228dc0e06", "value": "8f2c88ff4f984d82d0adb907adb41fe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbcbf16-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697539753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539753, "uuid": "b71bf658-9a85-404c-8bd6-32b258eb55c9", "comment": "Malware payload (AgentTesla)", "value": "d33cf5818f88e678c51af8d6b515af8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539753, "uuid": "bf19704f-f34f-4a72-9998-3bd4b6aecb8b", "comment": "Malware payload (AgentTesla)", "value": "7334b26a05e125fab9f42c96a4e16e8cd09275263a61ac746f02d822d930bfa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539753, "uuid": "5be72928-0b7d-475b-89e4-e72879c3fa63", "comment": "Malware payload (AgentTesla)", "value": "2fe6ad1a652e473dc80959551a88d48f5a3377d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539753, "uuid": "b21fd1e0-41cd-4595-8fff-34a24e29733d", "comment": "Malware payload (AgentTesla)", "value": "631ec4e9a6644ebaa34ce1ba1e1a421d3637a4dcd696ea8c12ba54c4aaca0c5c359b504944d47782985bfbc0b02e578e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539753, "uuid": "a40b36c9-7727-44b2-a3e9-da4f8420cb5d", "value": "T12B84E0B0FE945265F2DE1B3E82B153E3DB74D8F66611B71B588831C92C85F842EC172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539753, "uuid": "38ffae03-59f6-4e44-88c3-e700c5b78b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539753, "uuid": "f00eb441-0583-42cc-9324-d49882345fd1", "value": "6144:/ls6DmmhIvNcFDLDG+7Xw8pysfkYBw0nQbWT74K95pZOcrDJUjOwWOmTuQw:/FDEN8dRDfk+iWoKbhDJUCTvKQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539753, "uuid": "38df8897-1504-432d-8202-89b6e8064607", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539753, "uuid": "164eef71-c05b-473d-af6a-cb8f37fdaa8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539753, "uuid": "59c6ca24-6f16-4272-9550-c974129a6db5", "value": "Sip 035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75af61c-6d40-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697583575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583575, "uuid": "0c857205-027b-4730-8135-2d4c88e4f8dc", "comment": "Malware payload", "value": "5c42f7747f11d5f955e957e94b844271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583575, "uuid": "3bd09a7f-a235-432e-964d-59fb32e0be25", "comment": "Malware payload", "value": "73642e746bae07eedd99cce9f5d772be78cafc40dffc02c93c95c88bc229f594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583575, "uuid": "b028a626-4c67-4bcd-884a-c7007c8a6318", "comment": "Malware payload", "value": "a9808d2d77c72f55c270f198560dbf384c6b15a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583575, "uuid": "7e11663c-7b71-4862-8c1c-4e4755701d3b", "comment": "Malware payload", "value": "8319ffa969677ea77a3101f27041cdb4ef9f21ac47a049b23c39635d2cbb17598068eefba08bc0d77e1ac81aebd1a220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583575, "uuid": "c6a61ab6-bd59-4d63-b04c-020895b29082", "value": "T1763523051AD88023E4F51BB198F566C31D3ABC72A978C75F275AFC5E1D32682A53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583575, "uuid": "996c408c-6e64-4be9-a270-49da308f987f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583575, "uuid": "51844280-8941-4441-b597-0395ad59797a", "value": "24576:WyYtxRHai9fJE3UFOpQK4NsYklkKz/t2PxIbDyQjDxtJd17MoN3Hf:lMnL9Lu0SrV4x4uofN7rN3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697583575, "uuid": "5fc3e711-8954-4d4a-b68a-4bc8e9af75d9", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697583575, "uuid": "d5f2f833-81cd-461c-bb3a-b9e7bb57a529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583575, "uuid": "7574e15d-fc8a-4dfc-b26e-4caa11dc0bb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0187bcb4-6cb9-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697525234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525234, "uuid": "61aa3263-b77f-4b27-ab7a-1ce6c2a5ef28", "comment": "Malware payload (RemcosRAT)", "value": "0f3e70bc8340ada66a0870f1ec4ff08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525234, "uuid": "962836c7-296b-424e-b7d3-b249f32dba0c", "comment": "Malware payload (RemcosRAT)", "value": "73a8f239da349dabeba46f143311e8f5874589917a88e3f6cd64767c56dde3a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525234, "uuid": "93dc7e09-6a0f-4cce-aa37-9b19e3f0e408", "comment": "Malware payload (RemcosRAT)", "value": "cdade74f634157acab79058948bc292fa0d740e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525234, "uuid": "5f577365-03f5-454e-b883-eb930c080ead", "comment": "Malware payload (RemcosRAT)", "value": "2ce16654cce1ea17d82b94b3d0915fda59260f3e8ca25e1b89ca35e2213fb6f714d95909f3b667ab3e5b913a819d79dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525234, "uuid": "d9b922d4-f4cd-4b63-8512-50e34cf8b5e1", "value": "T156E3C517BEDA9EB1D2895B3AC7D711000774E5A2B257EF1A758E13DB18433BAEC4120B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525234, "uuid": "7572b342-1b79-4b9d-99fe-ad026f23218b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525234, "uuid": "f61d1afc-8f43-4e8d-8b69-08ba8cd48dd5", "value": "3072:wM/+etaii7bRb6MXRr/RcSWlJV0v850eE7e1:9/+etzifJHRr5ctOSE7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525234, "uuid": "10fcf6bb-4229-4c27-8560-c9ed695b3f02", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525234, "uuid": "d691a1d8-5e1f-4a2f-9aa7-71035c59eb9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525234, "uuid": "c205144c-cf04-4f8a-8fee-2c73ae484284", "value": "PO_YG E&C_CorporationS_54378927ZZ.Z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71371db-6ca1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697515204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515204, "uuid": "8bb92710-d0ba-4490-bff6-9cbf90b81d57", "comment": "Malware payload (Mirai)", "value": "89d88cb0af347167b69615be087cc30e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515204, "uuid": "619fff9b-3340-41c4-a1e6-f09531ff6fb5", "comment": "Malware payload (Mirai)", "value": "73b4eb7f66de223b116ad54afe195028a8e589a36255329925f8a95e6d08e0eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515204, "uuid": "11e66e4f-7536-44a8-8b05-b9e43f079e63", "comment": "Malware payload (Mirai)", "value": "ac53f488c4f6be633d0602c98a0891532d10ea9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515204, "uuid": "ee5c23c4-8320-4a83-abee-8822cbe83c51", "comment": "Malware payload (Mirai)", "value": "0eccd138282c806eaab16a0f512df16b19febef874e50a7809ad203ef1f88e455632f4f866e3cdd552a082e8ed9f54b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515204, "uuid": "198f5dc1-ca17-4d9b-9870-04d4f78da3dd", "value": "T196330262676E2AE251709777BC32BC1E66EC17B95C6730DA2CF0661573C58024FF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515204, "uuid": "31169c1a-3672-4617-aabe-d4280d3ba62f", "value": "1536:69O/ZMAXIxNUk06YK1LcPqF1aBexo4opKZb1:69O/ZNKyGYK1LGqFUFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697515204, "uuid": "052a37d6-e566-4a2a-ba7e-dfcfa6be27f2", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697515204, "uuid": "08f5814d-ceeb-4d6f-9e03-7ff07b5ab318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515204, "uuid": "dbaf672e-0e46-4351-bf38-4cd56a83e133", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b9b44c-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697537556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537556, "uuid": "d19c3d2c-f717-4093-b60a-9dc5185104f1", "comment": "Malware payload (AgentTesla)", "value": "42db68ec803c474a2400e75724057b4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537556, "uuid": "7aaf9797-4b73-4e8e-8ad3-bb82ee664270", "comment": "Malware payload (AgentTesla)", "value": "73be7a22c3bf4ddcd0cf8c6ff0a90816e49566bca5d54ec0014d86a45e639071", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537556, "uuid": "c1e2ab7f-3615-4636-8dc4-07efa6770154", "comment": "Malware payload (AgentTesla)", "value": "47e174aefaa93b05bdc7e0c91923a3b8d8f1ee5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537556, "uuid": "8138c69a-a97c-4934-9d01-ad1ed606650e", "comment": "Malware payload (AgentTesla)", "value": "730c5f39865f8853962585896ce038676c5a318f09af6d004fb9510efb3661a83c2eec3c821bbf91bbfedb9ce33e9397", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537556, "uuid": "ffb95e85-b18b-46a9-99f5-f25cc6e1d338", "value": "T11A25CF039904DB83D41D83F8BE133AD91F0EBF29E5D579DB14927F8B3A31AA2095A41D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537556, "uuid": "e93814ee-e5eb-4302-9f92-2f54e283c03e", "value": "24576:uWQmmav30x+Zypw6VL7vhZy5w6VXPKik4b1kwTAZyKPoUhx:jQmmQ30ex6V7J6VL1LTpKwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537556, "uuid": "977277ca-669c-40f4-9731-4f4863a63d79", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537556, "uuid": "993613a9-dd9e-4d0f-9fc2-48f375a64006", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537556, "uuid": "8eea0d21-ccd2-4da9-8ffb-ff1c111f51c9", "value": "PO CEE-2340975.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0125e0-6d1d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697568604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568604, "uuid": "7f6c1594-3e30-4934-a475-49a7680bd119", "comment": "Malware payload (Mirai)", "value": "bc33fe2cb3ecdfbfce85f96d077be1e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568604, "uuid": "dcc7f22b-ecd7-4010-ac92-e5c8facd954e", "comment": "Malware payload (Mirai)", "value": "7448ce8681457730e1cfb01d05b8dd6c8ca15510ecc61bc2e17aefbdd8cfb13b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568604, "uuid": "dd62e6b6-cb10-4fee-bf51-e5bafc24547e", "comment": "Malware payload (Mirai)", "value": "c0267cf02ce52071a74615106f254db77b0faac4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568604, "uuid": "b6b4f599-3127-45b5-85bc-f2c1046f1a4a", "comment": "Malware payload (Mirai)", "value": "f158e15d882a152122dc6c251e872dabae1062338ad88919b803ada32e4ff0b05ec1a82dd3dadc7d891e75cfb3a99e5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568604, "uuid": "d94dedb5-336e-452d-9997-a696171d68aa", "value": "T115D2D1787B1245D6C67ED1B48EE50B263E608FB2F1026C076594DAC7BB0A86C3CB6DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568604, "uuid": "eaccaab3-f1cb-4314-81e3-05d864d1cbef", "value": "768:B4ylAtv6pqLJM0RXaxGyUbXtheU/SuIBY6fJgGlzDpbuR1Ji:SMBqTRXa+Zhr/GVJuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568604, "uuid": "a74e7f4c-ec83-4b88-9e90-fd7e57726162", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568604, "uuid": "095ea608-0f78-49a0-818b-76375e1eb8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568604, "uuid": "24cfac39-524a-4973-90a8-0bfb173aa6bb", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01ff42c-6c9e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697514038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514038, "uuid": "2facf605-769a-4830-a16a-a9881406b4ab", "comment": "Malware payload (RedLineStealer)", "value": "b8e4cddbef2705a5d84c39491c635935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514038, "uuid": "a4f5eb80-f4d5-414a-82d1-7b148835e318", "comment": "Malware payload (RedLineStealer)", "value": "753e3781aec1907cc7a901646a9b847ff8e47e9f43d4e70b4732ca1ece335527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514038, "uuid": "32ed191c-153d-4544-b6fe-9dd21b8bab90", "comment": "Malware payload (RedLineStealer)", "value": "b8a1d993cc3433cf231355911dcf10ecf1a40b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514038, "uuid": "a61acb3c-b179-45c4-b15b-5c743850682e", "comment": "Malware payload (RedLineStealer)", "value": "ada963e1ac8c1181c2525fb73b73386654f6054f4bc9ebd05216e549b6bf229dc407a291089b2b74673805e75783b750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514038, "uuid": "76533f6f-55e6-4a64-b27b-766c4a5e02eb", "value": "T1DD04AE11B4C08072FF62593E05B0E7B05E3EF9341F60AF9F6B940A771EA02C2997596B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514038, "uuid": "539c734f-ef91-454f-8450-2f36c99b62fa", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514038, "uuid": "db031726-934d-4204-96dd-c0bfa56d9fb7", "value": "3072:KDQwUizKw/kal99mdVeiOEru0PIBlcJhgShf2toWzxnd:KIK3l99cV4EpJ3hutoKxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697514038, "uuid": "af02b3b8-f247-437b-b565-dcb4b9a4414e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697514038, "uuid": "52c88b46-147d-471f-80fd-7515be14d497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514038, "uuid": "1c1872de-1103-48ac-84e3-64488a744296", "value": "b8e4cddbef2705a5d84c39491c635935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fd2eef-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697546106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546106, "uuid": "e2396c55-d7dc-42b0-936d-a4db15731cb6", "comment": "Malware payload", "value": "1a2aa9fde97a84ddd8511d94802e470b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546106, "uuid": "7977e14c-9290-4862-a730-0ad801cf7293", "comment": "Malware payload", "value": "75611d0c5c93e8fed61ea91c59768aab127968bf033063b667d0da450e71f6e9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546106, "uuid": "87ae5186-63ec-4477-9265-2bf80f149765", "comment": "Malware payload", "value": "fa91750de2672e636da1860afade9736ef70f529", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546106, "uuid": "a5c324ed-1c40-425d-8db2-a6099719aea5", "comment": "Malware payload", "value": "59f48527e56d6e88e6ada23d15d03640f06a12d0567842baf2c300e75ff44b9923c17944988697ae424b05838fe7d407", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546106, "uuid": "cf3d66e0-de48-49a7-bcb4-b4f8e8c2f429", "value": "T10EE72311E3ED01A8D4BEA1B889AB013AEB73BC25033556DF1640C72E1F77BD56A39721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546106, "uuid": "a90df3d2-e4dc-41be-8cd6-f8243f754aa3", "value": "786432:t/w0bWt6WRtBz09iLeUOfC1ZlZBdLNjOihRyb3WuYeV1GpSRMvM3fz/X+0t5WIsw:tI0UBRTAbvfC5hLki43Wbg3zPzP+U5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697546106, "uuid": "b66a2a8d-8bc1-4e4a-84ca-758354e55dba", "value": 63782912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697546106, "uuid": "f3f76376-f6df-4994-8eec-a1d71a7f1be5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546106, "uuid": "f68735e0-dbda-42fd-b18e-13a33a89d818", "value": "WinS\u0421\u0420_v.6.1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c025f1e6-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697539727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539727, "uuid": "2a083af9-4294-4659-9e22-8a87e6be85ff", "comment": "Malware payload (AgentTesla)", "value": "ae02185eea70600ba6883df325a8a390", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539727, "uuid": "fa806288-6413-4e3f-a519-e5a204764d88", "comment": "Malware payload (AgentTesla)", "value": "762e99d8e26289c2a8014630bee7905e0b1676aadae74fe1f063e0cd485df800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539727, "uuid": "03e2fa34-621a-49ad-a2e3-181dedd13fc3", "comment": "Malware payload (AgentTesla)", "value": "76d2b03a44cb1c3922b78fdda044a17ed2ab1d63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539727, "uuid": "67af8487-6fc4-4595-a1c4-26c1ef995b22", "comment": "Malware payload (AgentTesla)", "value": "18b75433bda59353e568d81c062c206885bc205502e5a2a47df601afc5f181c3a39780a9a0c7a139789ab0da60d5b4b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539727, "uuid": "98bf13c8-c595-4aca-aa91-da0290230f52", "value": "T1E4D4238CDC6512DD4C38C3FB39BA8184BBCD3D2EB04484553C24915EAEBAD9B1B5F199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539727, "uuid": "537b747e-c268-4018-8da2-f6a1876f391b", "value": "12288:5fnWEEjUALUKJU3zolDXbDMLc6T1MtRWvZtPFPpJweodTg2rve2K:dYtHXi+WvlpyeodZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539727, "uuid": "71f185a4-ba87-425d-9fa1-a3393358985f", "value": 644767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539727, "uuid": "b6dcfaca-85ed-4382-96b0-e9d3a70a5ff9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539727, "uuid": "f4b940d1-5545-4847-81d7-c62eb81ca93b", "value": "PL_INV 28047_17102023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4764e5-6d06-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697558731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558731, "uuid": "e17d3394-e7ee-4d3c-8550-6eb8c3fc9ed8", "comment": "Malware payload (LummaStealer)", "value": "a265ae557d4ee7b4ffd7651f408a2852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558731, "uuid": "0888b254-0645-4607-8d26-77e4aca23c57", "comment": "Malware payload (LummaStealer)", "value": "7692b21a9e930fa53549f38f827454dce8821fd25169d7ee1f586fbf439454f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558731, "uuid": "33a3945d-09c5-4fa9-8cd1-96db85bdf2cb", "comment": "Malware payload (LummaStealer)", "value": "338768f3f34381c8a25c6a43473ac8a1739ed16c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558731, "uuid": "f9aea956-bb21-4613-809b-260c5bcab2e3", "comment": "Malware payload (LummaStealer)", "value": "b13b2bd566628430696e964c911801dcaebda8c4bb342f67566191974a1d3da1ff258845524dcb23dcdc6b4050ba9b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558731, "uuid": "158a000a-3aec-4d7d-b3f2-88274ee5e40d", "value": "T1F9F42243FAD94472E5F9177068FA53E31E39BD2098B0A37A2784484A1CF29D1B53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558731, "uuid": "db9316ab-71f9-4dd6-96a1-c4891926bf12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558731, "uuid": "9ee185b7-8a56-4e0b-b29c-d023dd3cf34e", "value": "12288:IMrDy90tvMGhNYdYGN/YyzlsQRSyiu66mo2PUlZHREFboM3+XWnXGaNfThi:by2MQNMYG5zlHSyx0PUzRc8xW2Qdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558731, "uuid": "240eaa1b-1897-46b9-a2f3-d57181d77462", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558731, "uuid": "c1f6af08-0782-4a1e-be66-c9ab6cb32120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558731, "uuid": "45da3ab8-b6ae-4c2f-9b72-c6560f17aec7", "value": "a265ae557d4ee7b4ffd7651f408a2852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f974981-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697539914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539914, "uuid": "87f282dd-3040-46c1-8435-9027eb25e16c", "comment": "Malware payload (Amadey)", "value": "0bbaa41eb11fba7a01cd966793dfefaf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539914, "uuid": "1971f159-a4e3-4cb9-b04a-9774bd374f8a", "comment": "Malware payload (Amadey)", "value": "76eabc44fb13c1e70b3602f79da847562f118c4c61a97e9c49972980c8a5d0f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539914, "uuid": "6f03f8a2-ca43-405e-b523-6f276d83b771", "comment": "Malware payload (Amadey)", "value": "6235cd359718c873f08b30fe5170d7c2eeff4f77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539914, "uuid": "44d016e4-69f1-468c-b8b4-e2586d6d2387", "comment": "Malware payload (Amadey)", "value": "6fb44dbdab187df47989d66d5bd6d4c17d3e2220e67e9b8ee2fdb05e0cccc9c5ffedd2b4a14d983c13f3deeb62b9b9a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539914, "uuid": "2ed8f5d1-794d-4e8e-b117-2230367a9103", "value": "T10F452242E7D89072E9752FB149F6068303763CA1A078C26B63C6588F2DB2991F47777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539914, "uuid": "1de78fc7-21b8-4e04-bd2c-8c8cf14e28e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539914, "uuid": "d530d3e5-e4e2-4db6-b1eb-c922a91e6bf9", "value": "24576:cyeKS8phRXSNTCmgfvcysLh7pQPHrd67xzCE4pidAb:LDx0CzvSLh7pQPHrKx+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539914, "uuid": "1eba5022-d12a-4437-8753-66ed2e3a38a2", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539914, "uuid": "3def8d64-b5b6-4a04-80e9-2c031f5e5c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539914, "uuid": "86bfb479-1277-43cc-930f-ff66d097bc3c", "value": "0bbaa41eb11fba7a01cd966793dfefaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5925431-6c8c-11ee-8907-42010a9c0042", "comment": "Malware payload (TeamBot)", "timestamp": 1697506236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506236, "uuid": "e88cb9c0-38ad-4393-bada-e1f5a807bfb3", "comment": "Malware payload (TeamBot)", "value": "9e883088155f5f548f261ee4305b0f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506236, "uuid": "aaddd3b6-1be1-4aeb-98c3-5e4813268825", "comment": "Malware payload (TeamBot)", "value": "779a53aa3f90186b419cce157caefc492dd5c07072bbc9560992845fbeb34c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506236, "uuid": "a6522912-9fad-4b0e-9794-09baf4e0b274", "comment": "Malware payload (TeamBot)", "value": "a605b663157b2e715aef7c09120d962bff507cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697506236, "uuid": "031960a8-0ebc-49ab-a111-046426f56752", "comment": "Malware payload (TeamBot)", "value": "de185e14d9095096302cb96e6a041ed474b9d51ff4017c254412047cb77061fb07726094b05f52350426123a0f93ea4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506236, "uuid": "8777191e-07a2-4a17-8778-9d5cbe404b6d", "value": "T15244DF21BA91C836E4B31A305530CA952E3BBCB2A57445CF77A43E3E6E312D19A75B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506236, "uuid": "537630d7-08d4-4a1f-8851-e43939867216", "value": "a589c292925e83b27bb92739ab013116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506236, "uuid": "8b289491-93ac-4455-b2f3-b3e88b55aea3", "value": "3072:8BNXXliKgkPOATPjnRRIVk+TxtGAZhTeWe0X7FCM9VU1:0jgkWAT7nL2k+TxtG6hT9R7FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697506236, "uuid": "c2d016d2-86e7-434a-b4ce-484283983e35", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697506236, "uuid": "76ac1960-afb6-4f63-988a-9cef666d35ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697506236, "uuid": "d48a0033-c48d-41bc-b3df-df8bf57141f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f3364-6cf2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697549939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549939, "uuid": "fb840dc6-4054-413b-bd1b-de2abe666e2a", "comment": "Malware payload", "value": "3c309e99d691f291d1dfd2592e057e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549939, "uuid": "c44c2f9c-b19c-4176-8625-ac8495b35cbb", "comment": "Malware payload", "value": "77bb59f542a461e589a285301384626291ec43452ba26bdc5811f295910094ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549939, "uuid": "c4c8650e-daad-483b-89af-94649fa580ad", "comment": "Malware payload", "value": "82c95fe971c36748b2f5c212af5ec4d222bc0f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549939, "uuid": "7e35d33a-79fa-4d1e-969b-2491d1c8828a", "comment": "Malware payload", "value": "d5c56cd9eb82f7caf51b131dfed5c54b66e9f6b7188b5720b60ada237b89e692cad3dc791c543518ee09e45d98c0a7e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549939, "uuid": "cf5c7177-bae6-43c0-a3e7-8f408bab454c", "value": "T1A4048C18B5C084B2D463243106F4D7B06E3EBE700BA69ADFA7944F7E4F341D1DA356AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549939, "uuid": "73d13165-9866-445e-91ef-cc060cd0bd32", "value": "a80a0cad13bca6e540d29f1acf15a1d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549939, "uuid": "d2e6ebf8-b45e-4109-8c48-1be5583fa83d", "value": "3072:IdSlFMoE2jwTncLnE89z3oXO8L+lAGfslk/KvN90zEVwJEbc:Z/jwQf4nL+mG0v92EVwa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549939, "uuid": "3a603996-5aef-440a-80f2-b9bf4ea72166", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549939, "uuid": "d5f56971-1d88-4ee6-a0ae-f7c23cd12389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549939, "uuid": "c1b09044-a926-48ae-97e1-35e7cf63c1a2", "value": "SecuriteInfo.com.Win32.MalwareX-gen.6680.23152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bac581f-6ca8-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697518191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518191, "uuid": "36246c6c-6c6a-4261-92a0-72168f7d2eab", "comment": "Malware payload (Stealc)", "value": "5aa38295da76c7810a946e570d8fe083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518191, "uuid": "e1c2c1d7-b6b4-43e6-a7e2-c57b39bfd0e9", "comment": "Malware payload (Stealc)", "value": "78e6096326c837b23be4519087c4f920a0e5c0b3dca3a407e926a8d3940bde2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518191, "uuid": "9884f430-dcb3-429b-8d0d-3964961ce93e", "comment": "Malware payload (Stealc)", "value": "e308b69c06c2655f8aa1f550dfaef9388163963a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518191, "uuid": "a08ed323-8729-4c12-8b28-96ea5735076f", "comment": "Malware payload (Stealc)", "value": "0196bea31e29d036f50f8ac8cbf1ec7a09ad8fa0a193f7d957b0039b88ac5ebf680e4bcf86153d6ab67a2e5cf845a6a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518191, "uuid": "f6ef4988-99ac-4ab4-942c-150bc073712b", "value": "T189343A13C2E93C94E9278B728F2FC6E87A1DF5518F497B65261CBA2F04B15B2C663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518191, "uuid": "2c150753-4b4d-44f2-8ee7-9ff0032cca68", "value": "305c32ee7516131cef129ed3db842454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518191, "uuid": "cf2409bc-bfa3-4d39-8916-4d2c94a8e322", "value": "3072:p7XlGs6U2Ye6B6ZD97D8sIPYSj5Wqx5x:dXQSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697518191, "uuid": "d840feca-72a5-43d9-b836-efb45c2595c4", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697518191, "uuid": "3e0d0e1a-2e4e-4bf6-aa21-ec7354da69d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518191, "uuid": "d24a5bfd-31ec-4825-adc1-d81be02b1715", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dabacb-6cf2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697549944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549944, "uuid": "2b2e7a76-3a27-4261-aae5-546dbe3e5b1b", "comment": "Malware payload", "value": "6b53ec45409d0c3d8d5582b3f1312597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549944, "uuid": "7f24cb84-6a95-4672-9c8f-b75da8a0c325", "comment": "Malware payload", "value": "7953a1481b1588f4850817e6ca6f4b4041b3e4e1dcaeda1090ccda271c88383b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549944, "uuid": "b56293b7-102c-447f-ab64-81b3d1507aa1", "comment": "Malware payload", "value": "141d743b348222a755785558f962a742ae362fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549944, "uuid": "bbc29ebc-cb23-4759-a197-fbe6725e168c", "comment": "Malware payload", "value": "73cd28fe9063b271b7537d50bd62ae863ff16150835945be2ea70c04b9d2ed1dc8c49e697b21e25231d9a32d5766d045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549944, "uuid": "4432aad8-2a69-4b6f-a1f8-20772bfa9b22", "value": "T104048D15B4C0C472D463243106F4E7746E3EBA700BA29ADFA7984F7E4F341D1D635AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549944, "uuid": "5029471a-7f89-4d44-94b3-c84cf9053149", "value": "a80a0cad13bca6e540d29f1acf15a1d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549944, "uuid": "a627b3e7-2d9d-43d8-882c-8e5de744cb45", "value": "3072:+erlRIMoQs1MUmN1GIfNHo0e8cBlYGCDO3/Kv41UVwJEbc:8Z1MHRIacBWGoYaVwa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549944, "uuid": "85bba47c-9a58-4ece-a597-e0138c81d6b6", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549944, "uuid": "5e10807b-39f5-4aae-aaa6-f4e6906da746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549944, "uuid": "edd319d9-76c2-453f-a071-d5e6ca7e344c", "value": "SecuriteInfo.com.Win32.MalwareX-gen.10757.3043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37281f6-6ce3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697543652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543652, "uuid": "92866f6c-3d98-48bc-9bb5-7b889d9380b5", "comment": "Malware payload (AgentTesla)", "value": "d16bc8059023daf9183ad406e05dc9b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543652, "uuid": "957f34b1-2efe-4dea-a478-072b67ad5139", "comment": "Malware payload (AgentTesla)", "value": "79f31a87c4435c11bbb786847d8cecace6d76c49c1c14d3b53c664485f735e40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543652, "uuid": "85bbb6a3-8174-48a9-a131-4363c7c60976", "comment": "Malware payload (AgentTesla)", "value": "de3473050c3ff7bbe1509343ee48769fc59b306d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543652, "uuid": "30df50ea-d1d3-4e4c-8d6b-7cf0f35dbe86", "comment": "Malware payload (AgentTesla)", "value": "2940a117c4264176d99dc1b3095c6831c32156842b7a051ef4419a9b4dd73936c3f985325a5153720c3cf3aaa9e6231c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543652, "uuid": "28d0e52f-022f-4d6e-a5ec-46dbd65f802b", "value": "T1F8E4120037FCC797E636A3F7252151108BBD3A958D6EEBC95F8520CF9A2AF010569B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543652, "uuid": "318a1ff2-6e97-4fad-8952-57a21f5bb6da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543652, "uuid": "7ddacde4-9bbf-44c8-a618-e4fd5337a63b", "value": "12288:dBLXmsrJM14sHKisaYDP6LCEZSSqNTyJY1PQvYNk1V91+oRdE2:nLWiMaBaUqZBbJg9Nk3+8+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543652, "uuid": "b233706d-0b17-489b-a20e-cabd07cb44cd", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543652, "uuid": "d82935c2-b302-48ca-a1da-cae8373a520c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543652, "uuid": "52c5399e-c0c1-4412-9157-f9d2d4866fdc", "value": "Quotation PO-230102_Aromatics Co.,LtdAromatics Co.,Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cd5b2d-6cbd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697526978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526978, "uuid": "36169ade-febf-48fb-b81a-8583896ff5fe", "comment": "Malware payload (Mirai)", "value": "be4eda86a500f9e5b09087bb6672b5d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526978, "uuid": "ac61dc9d-1fa2-4bc1-9228-24aefc2dc974", "comment": "Malware payload (Mirai)", "value": "7a3936d569a8c4bc6392bff8037bbde1e296b81d261daa85c5888ece34d1102d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526978, "uuid": "c08223a8-08a3-4e31-9853-23299914ae1a", "comment": "Malware payload (Mirai)", "value": "cd1872190495f2defb5245acdc5321587f1205a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526978, "uuid": "5555e221-3b56-46ef-a420-84426ce45266", "comment": "Malware payload (Mirai)", "value": "f7bb5d93ecbdede8286b3ee5ddaa076603581d6ea93a1231ca1fa9ee3e3a993f5269da942c0b29fe0ef960c464c82fb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526978, "uuid": "ba2e9420-e58d-49e6-9d53-c04589465ba1", "value": "T132434AC4B183FAF1DC05017C307AEB325E33F0B6613AED9BD7E45573A855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526978, "uuid": "ef934f35-430c-44df-8417-16ea065cd782", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WUsoPMdQZl7dDFfG:xzuXndFq4ZthB/VUfOWFoPEQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697526978, "uuid": "25e94600-893d-470d-9ad8-eb038b475bbf", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697526978, "uuid": "adcf5590-8ad9-45d3-9dc2-98e47171c81d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526978, "uuid": "540522ec-004c-47fa-acda-ba168b934032", "value": "be4eda86a500f9e5b09087bb6672b5d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9daabce-6ccd-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697534133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534133, "uuid": "6061d5d3-e5be-4762-af16-d9e9ca365811", "comment": "Malware payload (AveMariaRAT)", "value": "c6e63a705167eedab80517b260919f06", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534133, "uuid": "2cbe7220-d6ba-4ea8-b79f-1bdbc338865b", "comment": "Malware payload (AveMariaRAT)", "value": "7b3534096bb9cef9fd603e7a3048f91bbbba6217d4581af1104b8b6de52585ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534133, "uuid": "55f611d6-3180-4f3a-9d81-d62e92462d6f", "comment": "Malware payload (AveMariaRAT)", "value": "07e6c746809b8351e44b02259a57bd5237d519df", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534133, "uuid": "e6a6d4cd-ce25-40ce-9a61-b77255163459", "comment": "Malware payload (AveMariaRAT)", "value": "bab5a8d69adfb761d668468926a1cb00bb116173c977b1e797b90cbc69e5d87eecf4f40058281b0573fc82dfbb0a2e42", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534133, "uuid": "1617331e-29f4-404b-9594-ab5eb7f14858", "value": "T19F74E01E9768062AEF9E4F7DC11215409F7552EE601AF78BCEAD48EC74837C71D212A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534133, "uuid": "c06488de-5a8c-4a13-9793-9dc2645d6ac3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534133, "uuid": "8f465981-e940-4ff9-add1-ad60a6c959b0", "value": "6144:fUDBeE/bWyjqKVYnulhiKQswyTCSy3uUiGKPNJj5CsJsykTc:fUDBzLuKNhibt78FWsJs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534133, "uuid": "78c6ff9a-5f16-42a5-b043-92155161aa69", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534133, "uuid": "a09e05b6-9f52-4c67-b3aa-b51359e03d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534133, "uuid": "aa68f426-b3a3-4603-8cae-95060656e03d", "value": "JUNE-SEPTEMBER UNPAID INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e17d79-6d35-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697578517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578517, "uuid": "08c7100e-f800-4f4e-96c2-7b745fdb05e5", "comment": "Malware payload (LummaStealer)", "value": "0bcc88bdffe7f77fffb958eeff281a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578517, "uuid": "8d18668d-a4c8-4f91-a15b-12f8933b729e", "comment": "Malware payload (LummaStealer)", "value": "7d19d5e89549bacb5248e78da9cd1379217a73a692d05f0db8e67a3fc1abf5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578517, "uuid": "8a985f4f-dfbc-447f-a2d3-23dd82e1da38", "comment": "Malware payload (LummaStealer)", "value": "62c4ecef6dee9ad0e3bbef94ff2ce3c0db532089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578517, "uuid": "d5e24601-f287-4aca-bf27-765ba47194b5", "comment": "Malware payload (LummaStealer)", "value": "c9db8d488af5c7c57a1971b5a5bad63d72a5d7da8daed0db6a3281b6682927583ce849393eae00cdd3cfcadd71c4535a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578517, "uuid": "c42b6dd2-d086-4b2d-bb7a-037ef271d0cd", "value": "T1C1E41221ABD94132ECB11B709CF903D30B767CA1A97883A7375A541B1CB3290A577B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578517, "uuid": "38253435-c6b9-4b9d-91ed-0c5383c121e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578517, "uuid": "f400be66-e965-4988-912e-5c7b72667715", "value": "12288:KMrhy90vQ2NWA5vPtoOgrAVjeU+BxSocwHwQ9Aoel8Y3S:HyWNWcAc+BxcJMDeqY3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697578517, "uuid": "e2f66388-0c50-4bc1-8647-b5ffe8572092", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697578517, "uuid": "3c7ede35-ef74-4648-97b5-d298ac4b0a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578517, "uuid": "9e050931-1826-4b1f-8076-86ef2c26b748", "value": "0bcc88bdffe7f77fffb958eeff281a0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b721103-6ca4-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697516446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697516446, "uuid": "413047d0-914c-40b2-b7ea-186eb081c6c6", "comment": "Malware payload (Smoke Loader)", "value": "40ddcb25960aa12fe4b54a88cd54bc0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697516446, "uuid": "32da5afc-8ff0-4798-84b8-51efeeaa25b9", "comment": "Malware payload (Smoke Loader)", "value": "7e5e1e4dc314453a92e211473a6479b96ced1f290c669d55ba2fa7df6de58e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697516446, "uuid": "2c1eca01-04c8-4b81-bc5e-54342d4e867f", "comment": "Malware payload (Smoke Loader)", "value": "5124404f8e469b2a92f5c6e1c041667eb4f7b8ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697516446, "uuid": "209df50f-dbb9-4db3-b345-cbc737a97354", "comment": "Malware payload (Smoke Loader)", "value": "c8db6800c8afc9165531c44a521f8d59e6d364ffd33a272b76c9a5994b5f5146b7ef7143e22413a10f20a54e5a735efb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697516446, "uuid": "8f0cff7e-113c-4617-87e6-0add7cf9c121", "value": "T15A552353A9CC1422DDB81B3449FB53830A3179A67C3CAB5BA3A396599C70A90753733F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697516446, "uuid": "bd23c748-972b-41f9-9c83-63275085db80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697516446, "uuid": "9881c77a-d2c6-44c6-9090-f85c1f2757b2", "value": "24576:yyQAxbKF8It0/4WIhOYA5IUBbHsKIrRfvQswo3FZ21T59h:ZVKyIqvIhO6UhH7IrNIsN3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697516446, "uuid": "4a08bc96-3e4a-4118-9367-597498db182a", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697516446, "uuid": "b285a34d-5565-430f-8ea9-ae4c5d517e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697516446, "uuid": "3d4c325d-48c2-4b3c-a964-7dda7ed84979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815c9745-6cb7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697524590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524590, "uuid": "1f653ebe-c3e3-4fe1-a774-07445fa134f5", "comment": "Malware payload (Mirai)", "value": "e1aa2c56a53f1b8801950ff24383ee92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524590, "uuid": "0ca1ba2a-1048-44b9-9943-4f8c0e59599e", "comment": "Malware payload (Mirai)", "value": "7fbdacc83093cfc1e3c037463221fc735890db1f3eb2d9e23cc5e2443618e9c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524590, "uuid": "efc44b50-c73c-4988-bd3d-f894a37e40d9", "comment": "Malware payload (Mirai)", "value": "2daa557fba5cd36b2ff721a059c44c26a4cdca2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524590, "uuid": "45b527f0-2d3a-4e2d-91cd-f9b4c8ceebba", "comment": "Malware payload (Mirai)", "value": "472d058f8604a65caf916f450b8eef625f58f14de7c55fdf4aa3f4c779ef770b07fc664b05ea84a3e75e733f3f958a91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524590, "uuid": "f7f31c8a-79c8-4f4a-8206-dd432834438b", "value": "T18AE32ADBF800DDFAF80AE3374853080AB530B7E155925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524590, "uuid": "39d76570-5152-443f-82d5-53af11c7dfa1", "value": "3072:HRsZhPhrvKPRq05NDAw3CMlI9Vrjbi7LLhQ06ysgdPC:xsmZ5BAwdlI8LLhqys+PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524590, "uuid": "9bffe09e-fab0-4f79-8d4b-b92ac9951fe4", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524590, "uuid": "bee4cbf0-7085-48dc-9c66-f9a88088bb0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524590, "uuid": "893b3e4a-ab72-43a9-a834-bbeb1c95e036", "value": "e1aa2c56a53f1b8801950ff24383ee92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7cfdb6-6d2b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697574483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574483, "uuid": "45779d96-c30f-48b2-9ab8-cb49a2f68203", "comment": "Malware payload", "value": "92897f0c4e065642b19589b299588f2a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574483, "uuid": "3ae58d06-bd3c-43df-9c44-ea63325929c8", "comment": "Malware payload", "value": "8265b9dd41b5eaa15f6bb8bf1d016e602e444104b57e792dc8ba906b9a8e1872", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574483, "uuid": "cc292d8b-c1bf-49af-8ac2-4172a8274284", "comment": "Malware payload", "value": "5107bb8a382803986f266b31c63d51865de31411", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574483, "uuid": "228886c7-bb46-41e0-bc66-268ab235be8e", "comment": "Malware payload", "value": "2b999e694ac37726449b0ed591c076a78074e40309df429763cf57dfa7a5d814f4b58bc5eeda0ab817db1cdd657846fe", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574483, "uuid": "89e2a059-260c-4550-9a1a-0eb54d89cfef", "value": "T1C896F103FA04CBC2C56883F46E670FA96E671F19D5912AE710153EAF3E7A2D209D64DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574483, "uuid": "9722be0f-1cea-4138-a3f2-4f709436e941", "value": "98304:cJYW3hKnHVi0JZg2wxyX0lrUs6ZBdAxmzhzBSTD0tNLq:cSahKnBJi2DX0lr4PBzuMlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697574483, "uuid": "54ebc0ef-14f1-4a8f-b78c-1c0205fc3b68", "value": 8957559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697574483, "uuid": "a228a9eb-c048-45e8-a64b-ad4c79855480", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574483, "uuid": "2124e77c-1164-40a6-822a-eaab54696253", "value": "Ihome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c03560-6c87-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1697503949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503949, "uuid": "55dac6f6-7eab-499e-af21-118e240e1287", "comment": "Malware payload (IRATA)", "value": "9ceca4aad3bc535344ef6e0cec74b04f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503949, "uuid": "cdc1f358-c841-4994-a077-dfb5c754eddc", "comment": "Malware payload (IRATA)", "value": "8353c1fa3fb13adecc0bcbca356f9b2c602f5996114d98097cedecdfabbcb270", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503949, "uuid": "e07464fe-d4fa-4bbf-8f66-6900cd8a2e36", "comment": "Malware payload (IRATA)", "value": "25fac647b25ebbfc167712a54e4eb8dc5e88ea0e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503949, "uuid": "29a3484e-089b-4c25-8b61-1801b2817ab5", "comment": "Malware payload (IRATA)", "value": "567c72668fcae7b9d707d1b987a4bd509767e96fcf7857535e7c30a8e53c241127d2acddbef3ed850b572e3df5d1c20d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503949, "uuid": "592f5aa4-671e-40f7-b33e-ecbf1e598411", "value": "T15F36DFD7F399A86BC4F39332817613A5515B4C264F83AFC76D28763C28BB5C41E49AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503949, "uuid": "636dfa77-83d9-4687-a0b4-0c8536578d45", "value": "98304:/PFbSgt+88jegeucgLCrgnsWIpTb/JHZkh:/P54eq/QZ/9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697503949, "uuid": "60e98a04-51b9-4797-a06f-973ad1d15cf6", "value": 4918329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697503949, "uuid": "cfb171f9-7be6-48b6-8db4-881d4cc33b05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503949, "uuid": "f79fe537-98af-4841-8e7f-0ff0b2f8d813", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16840ffa-6d10-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697562635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697562635, "uuid": "cad344b8-1abb-4002-aac7-dcd4f2df7024", "comment": "Malware payload", "value": "60d009234ab03005be50b2f01508fad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697562635, "uuid": "5e69308d-cdd8-4263-92fa-c6f2a4386ef3", "comment": "Malware payload", "value": "83d4cd651efe36c4648e5314ab3074e763f2a518623fb48c9b5b978a60743834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697562635, "uuid": "15a1d6e3-c310-4673-a675-bc25795db443", "comment": "Malware payload", "value": "c7eb2ed78b232391bf845573cb2a07bdf63cc91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697562635, "uuid": "c315f949-2ac5-4a07-bfb8-8bb4fb8a31b3", "comment": "Malware payload", "value": "c952b3a772e4a6a2636c00d20babede7bf978f47f110b5d44f77c47cea5b11653f781d980a6289c6132a2887a16895ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697562635, "uuid": "6a4404f5-7016-4459-ac5f-1beede67e6fd", "value": "T190352296B6D98179E9B827318DF707870A30BDA64EF8834F2B44AD1B0E7358456307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697562635, "uuid": "968d41a3-8293-477c-bdc5-7174aea30952", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697562635, "uuid": "24154142-be85-4e68-a4cb-b2ce921a7ca6", "value": "24576:Lyx8SI963yyDWhgNzExnf1h85ulAWP4Z1NcAhVjjBA3:+uN963z9xqUIiZ1Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697562635, "uuid": "44037d75-90c3-4c65-9f5c-9d70d84721c7", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697562635, "uuid": "83118db5-88d2-42ea-90c9-dffbad367ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697562635, "uuid": "19bebeef-5219-484b-bc6e-7afd9887066a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22749923-6d45-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697585419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585419, "uuid": "b8749e4b-0be1-4701-a1b3-f06a0dcd8524", "comment": "Malware payload (Amadey)", "value": "90b8bee329ab609429cea7393becd602", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585419, "uuid": "f1b3d97f-a470-4970-9e57-268d7138a889", "comment": "Malware payload (Amadey)", "value": "8457743aaba419d629a240435fdfd954f80c38caa91acb9fc70918c91a40b218", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585419, "uuid": "6bc4ab05-5a03-44d2-9ef3-ddcaf7d4711d", "comment": "Malware payload (Amadey)", "value": "001b0b49172559b84b14d79d448bfbdbd250067c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697585419, "uuid": "f3e1da87-93d7-47a7-b322-8301a12ed0d9", "comment": "Malware payload (Amadey)", "value": "f094de1338997ac1521072d4e9b7cefa114b35883965ff8e18e47843e61e466732b7177b2513bd85ebf3ac899cb23298", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585419, "uuid": "41647433-7ad3-4ddb-b0ff-7a33b48dc23b", "value": "T13A352353B6E86135C1F13B7058F743C30A39BC659DA49B6A32E6EC8A1C73184993637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585419, "uuid": "b8fb184d-81ba-4541-a1be-f5d6bebc9617", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585419, "uuid": "9073e80f-a8b4-4d64-a76c-b4bba5bb5f80", "value": "24576:uymXq//ZfabvUCU3GUcDvlPKU7ld7wygdu4Zzknn:9y+0DUGDvxKwv7wbdCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697585419, "uuid": "5a7c6658-5992-430a-a35f-d835100d0b05", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697585419, "uuid": "aebb3fc3-3989-43ba-9290-caeb60553cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697585419, "uuid": "d408cf72-0c71-4185-b5de-fd0b5767158e", "value": "90b8bee329ab609429cea7393becd602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fc85bc-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1697539712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539712, "uuid": "c5fdc874-91b2-4018-9e62-d1082b1c0cb8", "comment": "Malware payload (zgRAT)", "value": "5bee9baf4d12853dd0d2dd9ec1ace918", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539712, "uuid": "69381b0b-d947-48d5-923f-eb7227571071", "comment": "Malware payload (zgRAT)", "value": "855ddea7aaa937e3141c16859b731c4ab791fbb0ea8b6780e922d142701b63ca", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539712, "uuid": "cb8adfbb-c6e3-451a-9e9e-0e7f32a21837", "comment": "Malware payload (zgRAT)", "value": "9808940291979085ece618270dd241637979d6e6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539712, "uuid": "80786827-04f9-4203-aa98-6c5e05c3dd25", "comment": "Malware payload (zgRAT)", "value": "ccc4afa9c1dd6000cfdfe490cd0cf526885865afa4c4f636bf1bfc4a8b1fbd918361741e2fe58ddf750db9e5f9a8b09f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539712, "uuid": "cca2dc19-cbf9-4297-804d-e7e35f97d9ac", "value": "T1B1343D1036EB604CB1F7BFE31BE8B5D99F6FF6B22A19645A304503078A22D40DE95772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539712, "uuid": "94a8f48c-312c-496b-91d5-7efcc9d1577c", "value": "3072:01Laf2QDjSjzDUe4xW4RR99999x99999N3wsPu99999+r99999NYo999999WYYbx:08wsPjghOV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539712, "uuid": "fde6aecc-9291-42e1-8527-33df335840b8", "value": 246712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539712, "uuid": "c2809f1c-b360-4db1-915f-8b39453a3c91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539712, "uuid": "423c1b6b-0262-4bf9-9466-e9c240824177", "value": "DHL 8586013763.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c31f0ae-6cc0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697528473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697528473, "uuid": "237d7e44-2a3b-43ce-ad69-d2e59ce65b29", "comment": "Malware payload (RedLineStealer)", "value": "a619cad8e1ac85ccb40e4663bafc98f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697528473, "uuid": "0d456fd7-c879-4545-b958-c10420aecf6f", "comment": "Malware payload (RedLineStealer)", "value": "857c729e599af15b448248569bf008a112d93006e5f7fb3fa9324a37bdecf8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697528473, "uuid": "a3b561f2-3dfd-416d-adbc-2394cd0c1150", "comment": "Malware payload (RedLineStealer)", "value": "345bc9aba884d792e8e9fb4157ad4e2c01d9cddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697528473, "uuid": "0db4ebb0-3309-4f7d-89a8-5abc8357f722", "comment": "Malware payload (RedLineStealer)", "value": "daee9cb31befed7dc10b4066ad1a78145939754d4c19e81c8b8a94f379cab95e43dc2a82c72291157b8a85bccfb64e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697528473, "uuid": "3eed0a2e-e52e-49ef-a17a-67e64b2c9358", "value": "T13F5523535AC4C073E4B46B706DF602471B3ABCAAA868537773A35A5D0D33994B83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697528473, "uuid": "ddef2e19-66c8-42d0-898e-f29361b6bfe9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697528473, "uuid": "3fe80066-1e00-42ad-9fbe-dba4a40b3b21", "value": "24576:2yad1nErZnWIlkE8BOXvJIo4/4pdcY+0otnwFuVI6lLUQYu+cgeqOLW4r:F46WJBk/JIo4hY+/tnwo9lLUQBVzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697528473, "uuid": "56e49f10-173d-42bb-a82c-e1634760afad", "value": 1313280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697528473, "uuid": "34c32a7d-1e30-463d-a094-2b122710211a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697528473, "uuid": "d6f1b3e0-860a-4f90-80f3-7bfefff84524", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35a8e68-6ce4-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697543974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543974, "uuid": "f1820a08-eb9c-48d0-a278-4e7a9aaeb6b0", "comment": "Malware payload (Formbook)", "value": "68c674b8751ee53b3dcb6d6f10b0bc0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543974, "uuid": "b892e09d-5bfb-497e-b8c7-cbfacc6e0996", "comment": "Malware payload (Formbook)", "value": "87556c6d6258649af9a9e20761a1702c005a3d633933ed0ee76375965ad4d6c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543974, "uuid": "b01d74e5-e5aa-424c-bbbe-5e6c7625baff", "comment": "Malware payload (Formbook)", "value": "ff968e33cc969a5375e08f6c361190527579e865", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543974, "uuid": "ab623d44-7a65-4264-a310-1a14a61d361c", "comment": "Malware payload (Formbook)", "value": "8722ea9b144692e7bb86c1d82be968e4ce536e4b10ddb29792f89f6e16b81b75063917d30e798c61576840a8498bb7d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543974, "uuid": "35729840-8633-481d-9ce3-6fcda86b0406", "value": "T123741260B351C0C7DE7A0E726D0B8D7624B81D7DD1E4A20F43C46B09A9E37C549AF7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543974, "uuid": "be06e3e7-df89-4df1-8ece-889d8b609274", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543974, "uuid": "8ca74a44-39cc-4452-8666-50c927ec86fa", "value": "6144:jfL+oqjzQJikMGIb8iANj4ILBHmbGdjwqQ7aEoo299rVY1DlODccKS0mIlPDNxsL:jfLwkcGIbNy4gQsBEP2vra16c80m0kGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543974, "uuid": "de759b2e-7182-49bc-b07f-2582196a94e5", "value": 359970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543974, "uuid": "0bb44518-a2b9-400a-acc2-95a229e536ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543974, "uuid": "a9d2fd8d-8912-4ec6-baf4-4884e9ec71ff", "value": "68c674b8751ee53b3dcb6d6f10b0bc0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8167ab-6d2b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697574354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574354, "uuid": "975f37c3-eeb1-4b85-b86e-b9387dc54c05", "comment": "Malware payload (RemcosRAT)", "value": "019442206f627095b9d5d1a8470e56be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574354, "uuid": "44868204-f00f-409f-b047-6aefe07dad5b", "comment": "Malware payload (RemcosRAT)", "value": "897a97b958884456ec4bc6222c29db3057ab0df05c31de0ad02fa1b0ab6a4730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574354, "uuid": "d5cebeee-ad7b-4431-b94a-963dcb662317", "comment": "Malware payload (RemcosRAT)", "value": "edb1c1de4abfb7c4e7b6677f7257ff4b05e5787a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574354, "uuid": "82caf045-1e32-4847-bac0-15b60fc9fca8", "comment": "Malware payload (RemcosRAT)", "value": "f763610fcc1e2425341d4c9ea8485ff80468f0c9a1f7855d73c475e0054ad044bacd6c98709ae4fcec89a59c5cf7bb40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574354, "uuid": "ea1e3801-8d8d-4045-a824-f08a0bd56b15", "value": "T18A55D33D59B9162BCC75C3A9CFE18827B155B86F3431AD6D88C763A60353A8635C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574354, "uuid": "f197ecda-f8ff-457b-8e85-bb7150e87f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574354, "uuid": "e61848f5-6566-4842-9f32-776189dfec84", "value": "12288:VHn8Ui0OegjcToyvJkyz1xXXnApZFtvEMub9TQOHhIu+rimn1j0WLJxk+KXoICUp:VHJ9LgjsEQPHKttuhQOU+mBdWX7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697574354, "uuid": "0b56478d-1a18-4bf5-9d0b-1be91aee6ddd", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697574354, "uuid": "a28cc9f1-0f01-461e-8ebc-d710fe1f62cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574354, "uuid": "5a024fea-9931-440f-a13e-469a6e0c66bf", "value": "BUGH23ED2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5969b3d-6cdc-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697540569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540569, "uuid": "d05f53ae-b31f-43e9-9833-85257df19eee", "comment": "Malware payload (Smoke Loader)", "value": "5c2919e67a925749fdfafda6fa1fdd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540569, "uuid": "816edfb5-9f42-46b7-969f-05d2dc7355b0", "comment": "Malware payload (Smoke Loader)", "value": "8ae67242a441b23234d694723f9de5f0b9fcd8ea963968c7085ba6b95282b5c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540569, "uuid": "f90dd1d2-9695-4347-8bfa-5a1810107ecf", "comment": "Malware payload (Smoke Loader)", "value": "d393de620e1f5e4c774d83c2bed1b1534f575914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540569, "uuid": "d331d7f8-6708-48b6-9256-42ab38d3cc75", "comment": "Malware payload (Smoke Loader)", "value": "345486587dbfa48353f6561938a4a4b1f0f7c7c254f3bdec9fa5844115053844c14788cffa1742d8d07e1b2218345a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540569, "uuid": "bf245732-9e16-4d50-b672-98c703e9ca06", "value": "T1784523836EC88933EDFA2B7484FE02931E31BDD19A7487572795E59A08F26C054353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540569, "uuid": "f84a6f72-040f-4e6a-ab34-46afdc8addba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540569, "uuid": "248d2d29-078b-4616-a8e9-13e2ded453c9", "value": "24576:FyrW5vQZFOhkJnLfj03JSwSoty4e82SGGAtpsL9OvUhJKSJVE:g+6hwZSw64I+hJKSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697540569, "uuid": "79b59d18-6e06-4f03-970a-29c454a0b747", "value": 1274880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697540569, "uuid": "bfaec587-f03b-4872-a7ca-ab66d0d2c296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540569, "uuid": "27934f3f-6e2d-4cb4-ad56-7e4fee47f46b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe59c134-6d30-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697576768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576768, "uuid": "9e0c8aff-2778-41ab-a65f-94326d122263", "comment": "Malware payload", "value": "6775763a128341cb275a54fbe053fa3d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576768, "uuid": "8d69a2d0-95a4-40d9-bea8-a6c4d91518b1", "comment": "Malware payload", "value": "8be57bcbe7e58736966c6b46dc76d9d3581859615b0164000d07801f5f5bd886", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576768, "uuid": "949b05f3-6693-4fca-aee3-ce5c79d530e1", "comment": "Malware payload", "value": "effb8b1de42286bc103752411e4236a2af409cd7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576768, "uuid": "5d962ef1-227f-419c-8ec4-de6fe0248f81", "comment": "Malware payload", "value": "4c519aead08e3090e25ee1693f3a45940c86f61ff814ed990fe1034f9fe948f0e8b891ed2d7d4892fd87f39cb5ed1b09", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576768, "uuid": "9689d164-8fbf-40a7-ac4f-03cc6d7e40cd", "value": "T1F6C5337440E7184B99CE066D3A90C13A6AAA5DF042E9D87CDE3E62BE5D77093071F68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576768, "uuid": "87659635-e824-4d9a-85cd-6554a3dddbef", "value": "49152:jDNOxdLf2o6UB+8N961m/VWE6ZHje8oMOMMItJ75QjFA4XQ4GRXDuAGTfy8:IfoU3jN8ZD8MQIt7QjFA4XgzuLTfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697576768, "uuid": "91b49abb-2330-4e12-ab84-44bc501968f6", "value": 2711093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697576768, "uuid": "33620e3b-9014-45f9-9e56-68458dd552ae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576768, "uuid": "011d47f3-cd2f-4f9f-aae0-652d0565ae8e", "value": "Part_File1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92624a53-6c99-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697511733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511733, "uuid": "8f06e905-6410-45e3-adcd-d6cfbeafda8d", "comment": "Malware payload (Smoke Loader)", "value": "fde83bdf3116bb0eacc0698194a57c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511733, "uuid": "a360eb1b-8fad-4b8f-8de5-d7507aeb1f12", "comment": "Malware payload (Smoke Loader)", "value": "8d8e53d7e6b78493b1abf7fb862715071a6f0226a6d80e8d45159db576d1922a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511733, "uuid": "9e47f2cf-4460-4fdc-985f-fdb53bf889d0", "comment": "Malware payload (Smoke Loader)", "value": "d8a2badac9a54bfee691fe9eac3b6b77f9306ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511733, "uuid": "3756edc6-5517-4878-bf68-8ff3dcfe6657", "comment": "Malware payload (Smoke Loader)", "value": "26de38724f0a33b675aa74e33916654c7cdfd26379ba2093c3ec57b749b315cbd1d65e256c623dbaa58a2262e63c863d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511733, "uuid": "14e0b5d7-60b5-421f-b1da-8eee2e2785e9", "value": "T124352305AAD944B3DAB51B7255F60B831F3BFC406A7C42675782D98E0C733C8A93273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511733, "uuid": "fbe739c8-9742-40bc-9bf4-9ab9df1ac204", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511733, "uuid": "43e6b654-44f6-4a73-8523-ceb29d84f289", "value": "24576:YyI1YGzv17X8SENAUYzr2GGe4lmF+0zJ2YsPikMxSA:fI1YGzv17XrfnbF+0u6xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697511733, "uuid": "ca6b0956-7d4e-46c5-a8a1-35071af84567", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697511733, "uuid": "44a35221-5433-4e04-b846-128c4dbc693f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511733, "uuid": "d4b04593-9fce-4ead-9ded-41e2a1a11978", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aec9f06-6d48-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697586856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586856, "uuid": "028a225e-a161-44a6-8521-59d950eaf232", "comment": "Malware payload", "value": "c174543665fabddc86daa38d5124a7f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586856, "uuid": "3cb0cf1f-3553-4d65-857c-746bc984f789", "comment": "Malware payload", "value": "8f183dbd92b2586af0a22dfa53449c714e21b0600bc98f3174dd4bc695e3ca58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586856, "uuid": "c631808e-30bd-40e9-9d86-63a6e4282f08", "comment": "Malware payload", "value": "19e16480732f7f82136e3588031885628c86ba06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586856, "uuid": "775a478d-7a4e-44c7-bf3c-a213dd13c369", "comment": "Malware payload", "value": "ea9ad835264adf0608b34fff8203b503a6b49ab83b6e469fdfa4907a850804e20550d46875c4010c87acec7f4879bbf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586856, "uuid": "223ee663-50d6-4bd8-90a6-5683b58ddf6b", "value": "T1E9948D5A3D4A666FCD826FF23C5C2C241096F36D7E0F8BC3D0A91A461A6D778C6297C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586856, "uuid": "f8524806-2718-47ac-80e3-98e8f755ef2d", "value": "7df1bdeeff2cf1f94a574bfd468d38f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586856, "uuid": "149cb769-abba-4502-acde-5787dc18a3cf", "value": "6144:REpIG36syVrQQL94eI0BFAkJblku+scWjF6ohPoRikizmzSoK:REpBsbp4oBFAkXku+sTJO7izmNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697586856, "uuid": "014c9f4e-7f1e-4573-b147-9c0f62c370be", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697586856, "uuid": "09e3ee31-752e-4ce1-8167-df213cfb535e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586856, "uuid": "1dafaa5c-855d-4038-9599-740fa3139bdc", "value": "677c295ea4c9d7cb2c3980cef912cce002ff11fb6d571347367f9994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4256c946-6cac-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697519759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519759, "uuid": "c29bd9e3-8053-46da-95a2-5db4d7845c20", "comment": "Malware payload (Smoke Loader)", "value": "fd56a4cf4486da84cf2e6cde66050459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519759, "uuid": "fe6d5a34-2d08-4559-ab4f-07b5b42c2f7e", "comment": "Malware payload (Smoke Loader)", "value": "8ffb7be41e2bf10c6a02278c18c6e6774515546def735345897347cde15c9f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519759, "uuid": "cdf43aa9-a5a0-481f-bb3e-72eccb1cdc99", "comment": "Malware payload (Smoke Loader)", "value": "d7dc3b56b017ddffac0fcc070c5bd705567622b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519759, "uuid": "90d4fca7-bd60-44b6-b528-dbfaafd8c567", "comment": "Malware payload (Smoke Loader)", "value": "4400a8df41da55ff97f3218a2e71c8725f4ea1801975b94f0d20566bc69a6e566d6548d4ba94299878eb43da6a09ac63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519759, "uuid": "89554c63-23e0-4cc1-8503-7d41c4ba1879", "value": "T148552343A3E89527FCA66B7588FA22A307327C605F34935B3793969E1CB15C0742276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519759, "uuid": "0389b910-c420-4a09-a97d-336b99b2489c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519759, "uuid": "18bdda72-87f7-4e25-a51f-87d0891dfbb3", "value": "24576:PyQcDFOCuys/b36qsN15z2yEXIdTLrOWL1OG2pNAssI64Q5GJuRjDjmEO:aQ6FTuZLJA4IhOWL125sIwc0RjDjmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697519759, "uuid": "eb429f95-9831-4808-9bed-8c127bd9be2d", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697519759, "uuid": "f489d63f-bf54-404d-8794-4704098632b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519759, "uuid": "8693972e-d198-4fb1-bb22-5ceb6e0731db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a52cf5-6ca7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697517636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517636, "uuid": "d0269135-0bee-45cf-ba14-4eec88a25a64", "comment": "Malware payload (RedLineStealer)", "value": "d52a69029e732592d50f70ee3fb65649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517636, "uuid": "d738bb4f-bb82-4053-9906-a7eef0cca4b6", "comment": "Malware payload (RedLineStealer)", "value": "905f3f53793ec1dedf41004ce670338af9c14a62d1de20d7bc5c160b5e19940e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517636, "uuid": "e7987e7f-78ec-4ef6-8f51-7883ef207844", "comment": "Malware payload (RedLineStealer)", "value": "a355d8fc19a14b590c62fae900152cbf09b339c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517636, "uuid": "0cf32afe-ab98-464c-bfbc-2a4046b84221", "comment": "Malware payload (RedLineStealer)", "value": "a9aaa72b8e6325177468e5d9783cb9cbc5dba13be29f212a3803e3da0cbcc5939e52f0e9695206d0ee046ea788ffb32f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517636, "uuid": "9e716ad3-6405-4a6d-8a35-9a1041561176", "value": "T16704AE15B4C0C072FEA3193605A0FBB05E3DF8740F60AE9F6B940A755EB02D19A7697E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517636, "uuid": "a23a1e9f-34c4-4e82-a45d-d412567ea4f0", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517636, "uuid": "f83b6ad8-a6df-4302-9465-a94503df2c34", "value": "3072:nDQmnizKw/kal99mdVeiOEru0PIBkc7o9i756V1dxnd:nBK3l99cV4Ew7osF6Pdxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697517636, "uuid": "e0eb5e22-0696-4c98-9d5c-6a57a0d04314", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697517636, "uuid": "067cae46-09ea-4b27-8ca4-51163544a594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517636, "uuid": "54c7ee44-5cac-40b0-9b98-d23511b7fb74", "value": "d52a69029e732592d50f70ee3fb65649.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f62ccd-6c94-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697509718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509718, "uuid": "95c1ab59-3f02-4720-ab3f-22dcb0df2f12", "comment": "Malware payload (Smoke Loader)", "value": "7bdd8c7be0311662f1ae248fdd22c447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509718, "uuid": "c1893dd2-69e3-4be4-bba1-c1599920517b", "comment": "Malware payload (Smoke Loader)", "value": "9086d6633b478527d8a0f0e9e969388c269bccf183ac6d346978383ebed86f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509718, "uuid": "96b6ea72-e1a4-4e33-aa4b-11006ec62b27", "comment": "Malware payload (Smoke Loader)", "value": "e6e6114bf9414c09e7eee53ae3a7149faaa890ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509718, "uuid": "51fa8aa9-6fb8-4013-8a52-7f0c780accfe", "comment": "Malware payload (Smoke Loader)", "value": "474dc057de5a76d5b6411bf606270fcbf7e03180644dc090f568328af160e9bb2b7fcbecac97b69d7f6c0b7417b83a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509718, "uuid": "75388c8f-09df-41a4-9f9f-b5e12c333ff2", "value": "T1B435221099E4C471D8381B358DF6068B163BBDA15E749393238079AF2DB25C4E63AB7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509718, "uuid": "0f6b6c11-5188-4126-bc3d-b532c232254c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509718, "uuid": "23d61f6b-230e-4f42-a492-faacab7f0287", "value": "24576:hyheBRgbgMSZSrw3Iv/6aKzFb1onVT6aIzyW:UIBRgbgMSoAIv/oFbUQaUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697509718, "uuid": "4b8d1e8e-b4b5-4132-8f8e-e34aea360a8b", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697509718, "uuid": "ca80aa6e-26ee-4803-9155-221d3ae7e60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509718, "uuid": "ccaa3392-e82f-415d-9a16-04ec15b4cf83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54555070-6d1d-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697568323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568323, "uuid": "bb270f76-7322-4310-9ffc-b5bc7a5b6d97", "comment": "Malware payload (LummaStealer)", "value": "ae8dd3d68e117ba84629f0b73d220780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568323, "uuid": "abb94349-24b2-4614-9914-665ea7e6a06f", "comment": "Malware payload (LummaStealer)", "value": "90feb91f012900b5ca1b1636045814a3a1973a6ed29e74cc6f7776813b72f9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568323, "uuid": "f634d8fb-44bd-421e-b791-43d3086c25ca", "comment": "Malware payload (LummaStealer)", "value": "ffee1f3682a0a3cf3b1d72102ce1cef17c58cc62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568323, "uuid": "fa241d7a-742e-48ea-893d-b8aa9039458c", "comment": "Malware payload (LummaStealer)", "value": "8ca56799a0e724ccb2677bac8bfb64b737422b9282ea353454477dcd487db290a210b064e70f854e79826defa1cd8e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568323, "uuid": "497171ca-ae9f-4b5f-8b6f-e694e810778e", "value": "T12AF3BE0575C0C8B2DA7219320930EBB14EBEF8350E60AEDF67D4567A5F202D1DA39D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568323, "uuid": "ac622c49-de02-4d92-8a12-768421f7c377", "value": "993e953762ca135b10079a743060f9c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568323, "uuid": "0eed9cbd-f9f6-4129-8b17-36b0bbe4cdd4", "value": "3072:IZGbygBQPsQ6gty6VpdpA6JaIUgUBZKJHzlo3blNOABC+nJ/t5hftZl:RygBQ0x6VpdpNJCgg1tC+JPhftZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568323, "uuid": "02bead14-250e-4e28-9d1c-d96c246463d6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568323, "uuid": "7fa81c6f-7f53-4bd8-b669-00b74744f28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568323, "uuid": "2270fc8e-39d9-4476-bf4e-eddea9b1b091", "value": "ae8dd3d68e117ba84629f0b73d220780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f42aa99-6cb7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524613, "uuid": "4b2bb8fb-ba84-4fd8-9316-c3b899066815", "comment": "Malware payload (AgentTesla)", "value": "9956e6ba2f20f1cd3983baf3b33ca74e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524613, "uuid": "47ef386d-3f5c-43f5-b34e-9c6509dd7b46", "comment": "Malware payload (AgentTesla)", "value": "91e46a1f92b62a00123f07c5ab34d2c3f4655e8801e53766e82fc4603b7f6d4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524613, "uuid": "e866401c-e517-4ac5-a211-cb4bb49322a1", "comment": "Malware payload (AgentTesla)", "value": "68cebb2a6c0d98eb7780d97efa21aedc8160d385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524613, "uuid": "751be312-321e-4fc6-8357-97128801f1b6", "comment": "Malware payload (AgentTesla)", "value": "a424b8e8f542b8955267958dff972e2394f7e181910b5dcad99af94e462617020a83bd4c12374cc44f6a9e18f01fc68c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524613, "uuid": "f72ba2f3-2e8b-4e9a-abd1-6f8ada48c155", "value": "T1A9E41305A2FDCB27E23EA3FE582211449BB8F553A47BD7C55E9224DD053FB0109BA227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524613, "uuid": "ae3105ea-b74a-4962-b458-c1d7c061f1ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524613, "uuid": "c61750ad-3835-4183-a47f-b46b02d555bb", "value": "12288:zBLXmsrJM1856N8/utlvl1f2uDr+LcZGOcDWUzx52OWhqQ06mI4Z/B59nOJ+aAE:9LWiMK56NEcXnPkAobxReqQ0XI0L6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524613, "uuid": "a709bc8f-19d7-4aa9-9852-dabdb9a6542c", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524613, "uuid": "2d1a29ad-d92c-4ba4-8749-c72365465577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524613, "uuid": "887d4afb-ad2a-422a-a337-28b8f081bb6d", "value": "SecuriteInfo.com.Win32.PWSX-gen.15240.24455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43dc153-6cd2-11ee-8907-42010a9c0042", "comment": "Malware payload (Phobos)", "timestamp": 1697536352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536352, "uuid": "39d3af21-daa5-41d4-93b4-4ef2c7caf9b9", "comment": "Malware payload (Phobos)", "value": "fe2d1879880466e24e76d8d0963feb93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536352, "uuid": "31961e82-df5e-40cf-8b90-057c62dea320", "comment": "Malware payload (Phobos)", "value": "9215550ce3b164972413a329ab697012e909d543e8ac05d9901095016dd3fc6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536352, "uuid": "ccfb1826-e216-4d1e-9150-c641dea4a678", "comment": "Malware payload (Phobos)", "value": "18ebb65842ccd3a1d1eeb597f2017267d47daaf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536352, "uuid": "0f5d1d17-1d28-43f8-82b4-009ebaae30f3", "comment": "Malware payload (Phobos)", "value": "1e87c6638e31347f346ddab31d8eb28372eb03eae92957f608f0bb4a3b49533cda882b6013250de8b53d05039ba0f1da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536352, "uuid": "e0f83fb1-6892-4779-bb32-41da09fd4276", "value": "T16494BF1BB6A687F0D7495F37C6A712104BB4D2C9B613E70B2A4D23ED1883BA79D0464F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536352, "uuid": "93532640-9b14-4fff-9941-6db4767919cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536352, "uuid": "c1e35e25-b41c-401c-8c8e-9b054477d544", "value": "6144:YVtrvQVm+214icCgPMmcCs+XhmOi/h/dD2YYWs6+ClKflgjBMf:Y/QVQ1D/Nmfs+XhZodDWWsJClkCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536352, "uuid": "c1484a89-a4c9-48de-b4d6-3f0b987b467c", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536352, "uuid": "bc31a9e7-b3dc-45ed-95d4-f2d5a32cda1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536352, "uuid": "fac4a77c-4f4c-48a3-9bbc-4202abada8de", "value": "fe2d1879880466e24e76d8d0963feb93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a50b42-6cd0-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697535225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535225, "uuid": "2e4395c6-fa52-4774-8c80-4f591754bc4b", "comment": "Malware payload (Smoke Loader)", "value": "d50ac4c837847b51ddaaf3e7ce50d55a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535225, "uuid": "c23ae2ff-dfbe-47b1-98d0-530c39a6f3c7", "comment": "Malware payload (Smoke Loader)", "value": "935c5fecb33cf62c93668fd1d168da367bff0574e06ed33d1b872539889642ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535225, "uuid": "f2494d5c-28d0-4ce6-a451-64e0de7cf755", "comment": "Malware payload (Smoke Loader)", "value": "392fc4009e2a4416b0fbf393967e457a4c3ea41f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697535225, "uuid": "8ec23fec-766c-4c6f-a1bf-5a76ae56cf58", "comment": "Malware payload (Smoke Loader)", "value": "2c6881e5c64d22580e0bff052477de8c1d849846034aebeacc29bf32c55235fbe06be8342352b526a5567abebf9c384e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535225, "uuid": "3939f4aa-f76b-4faa-b377-5d7911c370af", "value": "T1A4552313A3E8C623E9B723B08CF60793093EBCA1947092676386DD5A0DF23A65571737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535225, "uuid": "30306033-4d3c-48c4-aa47-e344b57ccad3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535225, "uuid": "3becc7c3-793b-4323-808c-c3e1666c6564", "value": "24576:iyUrinrU3FLeXP9Zam2CRs9S8fL2ngvvzRbiIi+c1Sx6NA73x+F3:J1nA3FLOFQCRs9XL2n49eEc1vGx+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697535225, "uuid": "7c657841-616f-4707-99b9-d83f38490997", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697535225, "uuid": "e5539f7f-bca6-428f-95ba-0aa4956e0d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697535225, "uuid": "2ff5218f-2988-4654-9765-67ca30f62aa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9627fb-6d33-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697578032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578032, "uuid": "8197312d-40bc-4190-8185-8ab18a48b508", "comment": "Malware payload (RedLineStealer)", "value": "9e61aa0ed60364a305a35081d1b159da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578032, "uuid": "2101c426-03d4-481a-b50f-fd22557ed541", "comment": "Malware payload (RedLineStealer)", "value": "9368cfd93da7beb18c6e3bba2c906e1c228b79adb1d20193086ea11f22184fd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578032, "uuid": "bdc63656-8d70-4d17-9ad9-d828fae49821", "comment": "Malware payload (RedLineStealer)", "value": "928d71344570dbfa77361670d50054a90b00d24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578032, "uuid": "b1fef61c-fa20-4918-a271-89fbd8d3a11a", "comment": "Malware payload (RedLineStealer)", "value": "95b00b178a3c3e495a1bd54b23ee461369ae8686fe4048cf1cd693d2c6a7abf435637dadcd01954daabdc1b34ba81838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578032, "uuid": "a9a17075-f5a6-4d5a-9efe-6d4f2c2d6b4f", "value": "T13F352366E7D8A132DD65277408BA17E30F36FDA14C71D6AB3B51B9061CA3784A23133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578032, "uuid": "b476b298-e89c-4a12-ba56-6f39da086bec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578032, "uuid": "38ace6e4-fab4-49f4-b54a-d0f249d7ea21", "value": "24576:IyABH9SNAMlUzcF33MKlfChDCpa9LfdQK13XeweH:PAA43+Ppa9HdXe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697578032, "uuid": "01e55028-4edc-4dbc-97f1-6cdc7e6ec2d1", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697578032, "uuid": "7037c47d-307c-4418-bb9c-21624bb54284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578032, "uuid": "457f368d-7439-475c-95a2-4f946af47d28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf81e3-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697523317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523317, "uuid": "32c5538d-f276-4d0c-878a-67d79287fc82", "comment": "Malware payload", "value": "bd9eb687a98b7e970ee36e96822ea121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523317, "uuid": "2e833d42-473f-4db9-932d-8c735893fd3c", "comment": "Malware payload", "value": "93df49c5fac744cc4b208ea069154a41dc8dd4ea3a7222b9b728432ef10ae395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523317, "uuid": "69f78e44-a669-41e9-80f1-b8d1bcb4978f", "comment": "Malware payload", "value": "d9f06f155bb02b2124fb480c4a3a9f01c8b51cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523317, "uuid": "4099c3aa-10ea-4b4d-b03f-527e5423d69d", "comment": "Malware payload", "value": "9f12101c61d11e64661e423eb43c00735268eddd33963621e619b4271a221e866cc2f4356f6810915e3ed0d7a52df271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523317, "uuid": "36620380-aec2-4346-a60e-664dd4a9c444", "value": "T191D42348B7A5C897EC8387724DAC62BA6775FE0508A027DB6B00B71E7D772C1A60C353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523317, "uuid": "1898ccb8-0a06-429a-b88e-1bac0391334f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523317, "uuid": "97480184-476e-48d5-af5b-49fba23f8038", "value": "12288:XY78MWlBqH29r7ctZP7VCz1ciT7oa1HAsu+4kPgpMnpi36p:XY78H3yw1c+ka1HAsuVkPgpMnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523317, "uuid": "c90109ab-ce7a-49ed-94f3-b476e607c960", "value": 648112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523317, "uuid": "6553862a-2b02-4f55-8cfa-1b82073b0478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523317, "uuid": "fdb011d0-649c-482d-b8de-aa8839506d4e", "value": "9876544567r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f77b4f1-6cd6-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697537954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537954, "uuid": "7c62d769-8472-4941-838e-31e6c532c97a", "comment": "Malware payload (Smoke Loader)", "value": "0061b5559959c06e0214810d83f11a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537954, "uuid": "d234608c-498a-4161-adee-73fb7d74113c", "comment": "Malware payload (Smoke Loader)", "value": "94cc2140ff6fdf800f0b6ab19208b01c979fa3c955744b75c8816ec046e7eac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537954, "uuid": "4c227409-3e34-4405-8a0d-d5ea30f24f7e", "comment": "Malware payload (Smoke Loader)", "value": "9597153b4b400af6b98f59e00ea718bfcadf156d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537954, "uuid": "d50d38f7-c921-4a7b-898a-7d1a9f10f52d", "comment": "Malware payload (Smoke Loader)", "value": "20e88fbeb62b72b22e84cfe1372ceec81c9323d57090d46f2aabebe54e1fe0b84442f4ac6c203479c651f3a5e99590df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537954, "uuid": "6fd4d32f-c4a9-481c-b779-8729a6d8b3fd", "value": "T18C552309A6DC8073F9EA23B48DF523831A3AFD92DE60575A3351D09A8D32590B47973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537954, "uuid": "55461549-70b1-4579-b889-66f55abb4ac4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537954, "uuid": "ac74810b-7a87-44fe-ac23-08dbb471328a", "value": "24576:jylNSNGPi//qIftlJXCUpTsIghji8Wnk0HdYsp6LeAus:2lNbKqIF1pTZ1nkYdzMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537954, "uuid": "48894f56-7dee-4a31-b6ad-b3de13de8158", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537954, "uuid": "a9ea3ad1-6238-4a2e-84c2-5806be4254d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537954, "uuid": "83f8fb93-ba1b-4654-8dcf-bd518e3bd69b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d26870-6cb9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697525270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525270, "uuid": "f539d5b1-c104-45dc-a240-e904dc6186e4", "comment": "Malware payload (AgentTesla)", "value": "649a3147128eeec8733fff2fe62483a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525270, "uuid": "a85138bd-8d08-489b-bf81-89189dbc41ec", "comment": "Malware payload (AgentTesla)", "value": "954ae52d71114f4e45fb12c0045bc4440822b855c3c2b4c5b685823709729e3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525270, "uuid": "c37ae93c-7c69-4a8c-8c0b-15f862f5242a", "comment": "Malware payload (AgentTesla)", "value": "7b995f7402c93bc27e178cef4df8b6e02bdb9d3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525270, "uuid": "9c584215-02d4-40f6-8fa3-0d83345952e1", "comment": "Malware payload (AgentTesla)", "value": "80930c64d6ee0b40faab52d6e946c47e67c58e79b2a3aff181625787e1bb296c4c3a979be6e7aaf390d255459ecfcd58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525270, "uuid": "90663441-681c-42cf-903a-9aa7a9766b6e", "value": "T1D0E4136A16A8CB1FE97257F95432C244D7F17826203DEA390D8154CF5BCAFB89106EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525270, "uuid": "c49d7d9f-3fb1-4bf6-9809-ee8f5cf61fa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525270, "uuid": "c10231d9-a2bb-4e95-a7f1-382551ee0936", "value": "12288:yzfqBuFf+k/rNhTC7myFVSQGzX9lXbvgSLaHLm3R/73xVTEaC:yT6+f47myFgQEXjvjKm3RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525270, "uuid": "072a79e3-a8b9-4b4f-afdc-550eb81d5c3e", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525270, "uuid": "c19bf8bd-89b0-4ff7-9d86-c120c4a2257f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525270, "uuid": "e3be07fd-a47e-4dbb-8700-325d7f64ba91", "value": "MlyCKkKAIVkgTYa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbdc4e5-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697545954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545954, "uuid": "5cdb34da-65ea-46d4-93b4-b3036227dbb1", "comment": "Malware payload", "value": "b5db6b474b34ee555976cd193f4f3484", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545954, "uuid": "774c4fdd-02d1-45eb-af48-c8844a08cbf7", "comment": "Malware payload", "value": "95bf62ac49d9ca0d832c4a05bbdbb5abd1f68f8200f44623ef878fc7e4c15021", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545954, "uuid": "aabe8185-5961-41ca-bfe0-a35d5231fe95", "comment": "Malware payload", "value": "0c8bd8006564c57a4272eec58c4e04183f626c17", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545954, "uuid": "7e7156e7-8b07-4268-a77f-4c3b4ac5743c", "comment": "Malware payload", "value": "5a480ffe78237f457def02e25879911e34eb8be21d065298a3e8e173662d9e2dad5797b7c5571589d97c0b3a4ec8f5bc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545954, "uuid": "247ca651-8c70-47e4-912c-a04fc7a4d6e5", "value": "T198D423F77836C511B9C3D7099267FFB22620FBAB4DA295CA41EC80C15258E722CE5D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545954, "uuid": "ec1f3d29-c457-4a8a-a311-d7409d9c1097", "value": "12288:OYQXUsQym0vDUwc1FfO1q+CgHHxFzP4EdVoJTE9axOYYK+c:OYsTAwwfKqRgxF8soJTLIYoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545954, "uuid": "56af290a-72fd-453c-8f82-8c1f5f60ccdc", "value": 624429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545954, "uuid": "aa06833a-1076-4355-8999-830c530a3dfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545954, "uuid": "154d35a7-174f-4127-80ae-4900002171e1", "value": "NEW ENQUIRY.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c394847-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697523641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523641, "uuid": "dfae4bf8-c00a-4c99-bc10-26a935078911", "comment": "Malware payload (Smoke Loader)", "value": "e4e6f3fefae2d87fa662ab12922150b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523641, "uuid": "5420478e-c4eb-45ae-877f-70c6809e6e60", "comment": "Malware payload (Smoke Loader)", "value": "9868f1d43765629156c25df937b774563c0d7d31a360b515103965ad06afb1e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523641, "uuid": "5faa7857-1dcc-4dcd-8180-eadfbfebbf74", "comment": "Malware payload (Smoke Loader)", "value": "2d4ebfd930a5107ffddb029532448620c906bd5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523641, "uuid": "81d0b39d-6d1a-48ec-b5d7-07491384b19d", "comment": "Malware payload (Smoke Loader)", "value": "13f04946328e57b143534484d67099a70471d714419a93c2abf4d5067e09cd55bde748fc22b95de532e375c86d88bb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523641, "uuid": "03455f9c-cd45-47dc-8601-e82f4bf9f1f1", "value": "T113552312A7E6C632D8B693714CF742431B357D61FE386A5B6762696D0B322C8B432337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523641, "uuid": "efd0e099-7118-4675-9fd7-6da2d2dd0c64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523641, "uuid": "996fd75d-e72a-425f-b6c7-60f5cb102aa1", "value": "24576:jysNBS76DIEb+qI1l8A7nIIQJdxWJ9qs4Vb9qsaeNDxwoqIKTDINR/j:2sNBcQI1l8AEIQJwh4VRo+xw7DIP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523641, "uuid": "f109b58a-3b36-448a-9405-1685e893e29e", "value": 1332224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523641, "uuid": "546521a1-00c9-455c-b058-19033b840294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523641, "uuid": "29919b60-793c-4a12-a693-8d5276f0530d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9571c8c-6c82-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697501974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501974, "uuid": "c21e7292-bc9a-44aa-8981-6e5c871fd67b", "comment": "Malware payload", "value": "8b28bce018b7224ac3a81d90739459d6", "object_relation": "md5", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501974, "uuid": "9fa3c945-8702-4d0d-9730-400e95aa3c57", "comment": "Malware payload", "value": "98721539c4c390bc28b1e5fa5e4bec70f1dfb86520310a58b0e2c914053936d1", "object_relation": "sha256", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501974, "uuid": "3b86df8a-940a-41b8-b2f1-dda8e5eeb907", "comment": "Malware payload", "value": "245db7879cc99322c11eaf82ed98efd6c14d33be", "object_relation": "sha1", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697501974, "uuid": "ed823ad6-18b1-4174-a250-99a9cbca05c2", "comment": "Malware payload", "value": "fc9b87b7b1bb548edce6e99952dadf999fa848dd3fbebd472bd791560028dcf01513e06bcd6824599fc6812481f81a29", "object_relation": "sha3-384", "Tag": [ { "name": "FakeUpdateRU", "colour": "#208A58", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501974, "uuid": "86dc99fc-f04e-4a33-9183-ddc532420876", "value": "T14AF733A0F975069BF2BEE732A93685DF608A202CE5537C3757338785ADC71D20B127A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501974, "uuid": "15c5b0f6-3ecf-46c2-86ee-964c6e0461d4", "value": "1572864:10cvcQt5SvVF8tANHxitgqwj7xCiSHRzCYaCFykmOpZ7/gZiLfSBdJgC2VY7y:ecvcQt5k8QItgqwj7oRzCzCF7pOZgSPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697501974, "uuid": "50340ae9-d06e-40c1-9200-b23e4338cb6b", "value": 73255585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697501974, "uuid": "4658862e-84e5-4f2d-99a3-569441e464bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697501974, "uuid": "eaace961-2220-409d-8df1-ada0378b8a9f", "value": "EngineBrowser.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f243ba2-6cfa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697553362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553362, "uuid": "54c795f8-95f6-46e8-ad8a-e71eafa8dfe1", "comment": "Malware payload", "value": "55f090913b8846ddd263427dee436842", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553362, "uuid": "b4b7ff1b-a81d-4a71-a0ff-47211bab7768", "comment": "Malware payload", "value": "99252478a75f0a80a54b589b134680d0248be93aa6d37cc337418c6d3c586102", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553362, "uuid": "9753d6dc-ad9d-4f2c-9800-e6fde3660c72", "comment": "Malware payload", "value": "cf4554c995c33f8d9abd64f803c2fd3bde3fcd6b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553362, "uuid": "385c5d57-ac4e-400d-9909-882dda6aaa65", "comment": "Malware payload", "value": "938639852b8e240eeb8686430b9014e14874bf97ad4ca568e3ebc19b4c8955b53d2f2cb40fe9b03fdf46c6f80bf0974b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553362, "uuid": "a948f098-fff8-49bf-9675-378ab80a3fd5", "value": "T15C861221E2838532D35C01BBE978FA1FC534EF63432121F77AA5799A88B0BC152FD656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553362, "uuid": "48f25eb2-16ad-49fb-a506-6435cd38370b", "value": "196608:AoDPPjk44nvp4iDQqi8wl2bL8DmSn5KIghec:FDHAHbql2bLsmS57gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553362, "uuid": "92b8ee6d-291c-43e2-b0f0-92afe20b5f09", "value": 8266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553362, "uuid": "754aff22-4434-4ee0-8325-f70395065932", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553362, "uuid": "ff146656-d22e-451b-98a9-3b2d5cc11ccf", "value": "GSignClient.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a90a22-6c83-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697502040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502040, "uuid": "183cdef2-0321-4d24-b4ea-37db514722ca", "comment": "Malware payload (Smoke Loader)", "value": "7f4d66d501fbedf7a004873320c11104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502040, "uuid": "dfe5715a-19d3-471a-bed8-65aca49728e8", "comment": "Malware payload (Smoke Loader)", "value": "99265a8dd1ad3e71cc45699b96fc6f167cc7583c4b09f522abed62ac8b98bb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502040, "uuid": "ed95bbef-1c6f-474a-b99a-0fcdc7338823", "comment": "Malware payload (Smoke Loader)", "value": "4d953b4e72d3f42156054d5d6a70bbbb8e829e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502040, "uuid": "8fb61468-b1f2-4ff7-9cef-00049b47e1fe", "comment": "Malware payload (Smoke Loader)", "value": "f1f7699cb6c952f729683ceb0a142b96228f32ca53fe2fc4be0a1b3d56f832f9490f7351ce5159a7c30cd5eaed3b8c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502040, "uuid": "c3e66667-f369-4e58-a7f3-4458375a00bf", "value": "T18E35234296D89673D4B113B51AF302430D32BCA62E78A7C777919D9F1EF2A8C843477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502040, "uuid": "2182ce79-f79f-46a3-9299-504132b539c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502040, "uuid": "398f53f7-fdc4-42a6-bb8c-07ab6054960a", "value": "24576:1yScQ7nrZ8944WtoFdI9r4FbaO+mT3svRCAueVOq:QScQ7a7dI9rar8vRJueVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697502040, "uuid": "c4e7ea20-c2f7-41e8-aa29-28028c8698ba", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697502040, "uuid": "949f2154-ce40-4a1b-919e-58ca3a4e785e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502040, "uuid": "b1f9c423-fb05-46c5-be1f-d3bcefd4ff02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef589ac-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697537470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537470, "uuid": "3c36d02b-8edf-4896-857c-6afbb18ad2e3", "comment": "Malware payload", "value": "75c98cf173038eaefaa706f007d37f39", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537470, "uuid": "ec43e58a-82fe-44fb-ade5-9fc03fcc84e3", "comment": "Malware payload", "value": "9a44adc1b48de78f1f7d977cff79e47f2e61c61a5d6a96c20f3ae973193670e2", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537470, "uuid": "bd16829d-2425-4c5b-9266-56c1ff87569a", "comment": "Malware payload", "value": "4e6dd149a343ba1946aae22e7f5c495a5ad63c79", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537470, "uuid": "1dc6bc5c-e6fd-4ecd-90dc-d4411548d803", "comment": "Malware payload", "value": "9108a917cf5c63604617dbb1538276302876d9b5f5e16d53064cd66808daa78331b8482d99c8bf3e3c3d0764ae86e9a1", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537470, "uuid": "7079f14c-2c07-4b64-83fb-b99f5b8c7cdf", "value": "T1DD83128493E2063153EB396B925B196F1D50CAE83F3DC11E9B16A508BCCD9673343D6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537470, "uuid": "9128ee8a-f0a7-4712-a68c-f2cbc259775c", "value": "1536:nhes6f1Fwl5y2QT37zS17OfTeb0cs4Cle6cgpOcpSiyqy1A7ugpDmAB0l6s11:EFUl7G37u17YP9e6nSiyqAOpDmAB0lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537470, "uuid": "b4e3e58e-0d09-4b21-981b-820bbe076b9c", "value": 84647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537470, "uuid": "eed3e64d-6cb7-4b63-812b-ba20bcbd47d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537470, "uuid": "c3ae8b12-f25c-4cb4-bcf6-ba52b21dfd76", "value": "k.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394cbdf9-6d03-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697557110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557110, "uuid": "ead8c69f-a58c-4e2c-b619-e3e7e2899cdc", "comment": "Malware payload (Stealc)", "value": "a9b5578558dfdc1e3c41d4b56ee402e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557110, "uuid": "b29f5586-1912-4646-8834-261763270738", "comment": "Malware payload (Stealc)", "value": "9a5c52cee57183bb9953b016e4edc9dcddd30963c9f78e05c2273c59a83c15ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557110, "uuid": "111fb1b8-d354-47dc-a17f-d5e907b2a72c", "comment": "Malware payload (Stealc)", "value": "394fad81ee32dc809f2f631c3cbd277c037f5895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557110, "uuid": "b9356dd1-9dc6-4426-bc81-a94f99a21fe9", "comment": "Malware payload (Stealc)", "value": "50af3032e9d6bb44c1e56287818b271586045271c8c375c9ae66d25f6ccb6b536268e2ca62959a7db332994f4f850b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557110, "uuid": "f2e1c298-0fe9-4f53-a086-efbb4ab793f1", "value": "T199344B9392E17D54EA268B769E2FC6E8764EF1508F4D777A26189E1F08B00F2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557110, "uuid": "21cbc913-198e-4fac-b83e-2d2376b410c9", "value": "16c23701599478a5f3c58f9b8290f3cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557110, "uuid": "db0bc3d6-54fc-49a5-842f-3d225855532b", "value": "3072:yniGin9a++P9djblRZurMTs2fbUsU51RZhPd7NBTP:2v5xTblj3TffYZRXPd7HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557110, "uuid": "221bae84-c28a-42f2-9a00-e0ecef549ba6", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557110, "uuid": "c5571b0c-2fbb-410e-aef8-1f383dfee175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557110, "uuid": "7efb7f4d-225d-4f51-8bb0-fccf720f19f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4b102e-6cce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697534565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534565, "uuid": "2d516b7f-3993-4468-857d-3a9456c4d708", "comment": "Malware payload (AgentTesla)", "value": "6370fb9c444816887ec23dc70bbf4570", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534565, "uuid": "204efb91-5199-492d-9a8c-d4d45977a7ea", "comment": "Malware payload (AgentTesla)", "value": "9aecf5734ff36e456fd5a50650b083c1d521d36212c0a440ec6202fc00d14380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534565, "uuid": "b6046163-7e1d-4aaa-99ca-8d49074c2cd5", "comment": "Malware payload (AgentTesla)", "value": "0f0717bb28ba315096a286efa67bb94e3a2766fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534565, "uuid": "0af34623-38ad-450d-8b0e-a7720c8c5ffd", "comment": "Malware payload (AgentTesla)", "value": "8fc03d12b15d8dd2b3d54481d78a61be39fb1ea33a36d3c31d098bb2f3f888d0fa2504cbc3a059e39d4f788b56fbe4d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534565, "uuid": "ab98d04b-efed-4f79-911f-4db6ffa65b36", "value": "T1DE155ED1F190889AE96B09F1BD2BA53024E7BE9C54A4810C569D7B1B76F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534565, "uuid": "1151e88e-bc7c-42c0-8dea-94baae11fbea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534565, "uuid": "94c68f5e-bea0-4f0c-a60d-7259e246acb9", "value": "12288:zlDJ92IqG5CQBIuACpdEP3P6uXTAvHsdSRIphq9:Z/MuAsEP3PpEOSmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534565, "uuid": "141995b9-e604-476b-932c-f77ea21ebdbe", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534565, "uuid": "7c92c2a0-2389-474d-836e-6118fbab0070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534565, "uuid": "15c51775-58fc-4970-8ef8-709f44a81b9a", "value": "Yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808797c5-6d01-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697556371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556371, "uuid": "25df7282-4145-4de3-aba0-951bfefa07d4", "comment": "Malware payload (AgentTesla)", "value": "67193f552cb5cb293d3514c2ff5f2474", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556371, "uuid": "d4c3df3e-0a96-4136-b7d7-82f5c27d640c", "comment": "Malware payload (AgentTesla)", "value": "9b15faed8bf8fc81cdc6831e7e0c89a27419fae8940e1fec61471f93d18b225e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556371, "uuid": "de2d901e-64b4-4958-8020-b970fee2a3a2", "comment": "Malware payload (AgentTesla)", "value": "ea04f38ea32e80745c1ace935146d5aad2cf7d1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556371, "uuid": "2fd4d524-8a09-4a6e-b792-057e9fa354fb", "comment": "Malware payload (AgentTesla)", "value": "1a9eb30c5845b87f1e8201fd5a2f5fa3e2afa8bff601d544cafa835df1d3848b6a500e53e43305917802c060c1846436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556371, "uuid": "79f53e2c-9da6-4723-b04c-b00737da21c5", "value": "T198E4235173FDAB52EA3BB3F79631100013F875A6645AE7C86E4B30DE8A6FB01087855B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556371, "uuid": "3f9a9f2b-83bc-42b9-b76b-6a0ea6038e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556371, "uuid": "cd24ccc0-6c10-457a-925d-3cf9be73bc80", "value": "12288:jBLXmsrJM1LRA6gtZc18gnfj/6RnAoLS6sJzyjo4bOBZVU:tLWiMXAx818gnfrQAoLStJzSo1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697556371, "uuid": "5b973311-04a2-47b4-a92f-bd15554bba4a", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697556371, "uuid": "6e0c55f8-ee4e-405a-9fd4-8e047d8106c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556371, "uuid": "0c0adef0-1e9a-4d4e-be86-90728623a702", "value": "Delivery List For October.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0789bbea-6cc5-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697530398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530398, "uuid": "74a21c53-db37-4284-af5c-ceb95f6c938f", "comment": "Malware payload (Amadey)", "value": "d4b940476375ed88a0584e75675617c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530398, "uuid": "23bb70fe-0015-4567-af57-2ea8d0e6b7fd", "comment": "Malware payload (Amadey)", "value": "9b407a1c2e907f13de6f840233ad1d2d181b835459ff028cb3fcc55ca09bc67c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530398, "uuid": "7aef8331-490e-49c6-97a6-1ab6175bd4e1", "comment": "Malware payload (Amadey)", "value": "828919c12272cf7fb56eb9952b72c07912635d95", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530398, "uuid": "b9dae80c-e08b-403d-b18c-2ad5318bb7ec", "comment": "Malware payload (Amadey)", "value": "3279670fbf5c726df30686cf128bbca84285e3a94f96875f55a68ca8dd8304f8ac1712b3caa330458682807bcb39cf71", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530398, "uuid": "5fc8e027-f233-488e-a2c0-27955a5b3a24", "value": "T1A6344BD392E13EA4E9278B768E1FC6E8760DF6508F4D776922199A1F08B10F2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530398, "uuid": "f6ab8c62-075c-487e-9861-031b7d225f23", "value": "305c32ee7516131cef129ed3db842454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530398, "uuid": "1f1cba16-623d-464f-a1b4-fe34f12f1e15", "value": "3072:kJdJOT/i/PeOfYER2nOHl2XrC3yRyhDl45WYo+R9hNw0:u7iOfV8nOHlCGXjTYzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697530398, "uuid": "d40ff1b2-a2bf-4b91-b336-581a28f3ccc0", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697530398, "uuid": "2712bba6-4105-4db4-a295-fd246b886bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530398, "uuid": "8387572e-5164-44ca-b9a5-0ad4d16c4776", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a823ebb6-6ca1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697515206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515206, "uuid": "6737d2b4-c525-4b5f-b5f6-8c4dfbb43366", "comment": "Malware payload (Mirai)", "value": "aac78e8dac94a7b7a95af8f04c1c3f63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515206, "uuid": "e250998a-3b2f-460b-8184-42ed6756e808", "comment": "Malware payload (Mirai)", "value": "9bdab07984ce01c7069311f119e738eeef71ab20df2511a2e148b7598e630bf8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515206, "uuid": "40dc40ff-257d-4a16-b94f-fcba48d7b8e6", "comment": "Malware payload (Mirai)", "value": "14bc7b9696f29f199a5dfb379685526842848930", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697515206, "uuid": "108cba13-3f36-49c8-91b3-3b965aa367c1", "comment": "Malware payload (Mirai)", "value": "64beffe4d0e776a93e3829d3e299abbb19fca108e907b3092ff3083785cecffccc50c76f503416b30d76c1b8869bec6c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515206, "uuid": "06a97717-f17a-4c23-b5f2-14aba57b3f8a", "value": "T1B5C2E1F53E777A5BDF251039349DCE3292B4E022D7AEA713A2419209210B1BCBB365DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515206, "uuid": "ce605b95-4da3-4130-aefa-d49db927f5f0", "value": "768:CMwKDZOFbBy6sSHRYfeAxdd8OiCTJpe0Nu:C2gTYfe6Kq9pV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697515206, "uuid": "77d79b12-442e-4cd3-b5bf-9daa600d1f9f", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697515206, "uuid": "ea17c6a6-9bf7-44a1-aba9-60c7aa5d867a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697515206, "uuid": "8f70ec45-b003-4f33-b6db-f4317bf880b6", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9d967f-6d20-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697569811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569811, "uuid": "b00c17de-6524-4163-860d-a8ce199df268", "comment": "Malware payload (LummaStealer)", "value": "f933eeb873ba740884755aa9f5a07559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569811, "uuid": "eecef9b5-d8e2-4552-953f-196c256f1e45", "comment": "Malware payload (LummaStealer)", "value": "9d738c0d0484d6c333e96d40daf993ceec3391f1b81a8d95701df7af7b15ac3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569811, "uuid": "0f751a2a-9982-45d0-997d-fc4b3ce9bada", "comment": "Malware payload (LummaStealer)", "value": "dba54e65629bc59c558832e05de33ba58439f106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569811, "uuid": "01a7940e-0b45-453f-926b-90231fe2ee94", "comment": "Malware payload (LummaStealer)", "value": "5de0781b7cc30d0086534dbf4f69e5aa191ee98c2b4d5b0ea893b849b3531f50a5a3d41ff798b12f997128d7ca7f4b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569811, "uuid": "05640dec-edff-42ae-a6a3-49ba214e9425", "value": "T160352307B7EC8276E8F957706CFB12E31F35BD9248B8464B1B8469421E63289D53236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569811, "uuid": "977f8d60-06ee-41df-a9ab-013c0362c6d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569811, "uuid": "f2e88ea1-5517-4be3-8544-f007f9e409ce", "value": "24576:3y19W70BThvnjAzDf7HjTp2zftkW5QYngHkfqJDabWGeoJD:C14oBT6DLjlijLiJWiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697569811, "uuid": "e87dd707-2d48-4264-9ca4-e25d4a47b0e2", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697569811, "uuid": "2b01b819-b672-4b4b-ab3b-3526b4b492f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569811, "uuid": "99ab9ea1-509e-4775-a07a-4e72c8144534", "value": "f933eeb873ba740884755aa9f5a07559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8d5573-6d06-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697558564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558564, "uuid": "72743ed1-a24f-415b-a36d-9eb4d6d98cc6", "comment": "Malware payload (Stealc)", "value": "a0195c307ecf5ab711f2665a488995f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558564, "uuid": "9dfd9d66-7140-4824-b631-e2c9234a73f3", "comment": "Malware payload (Stealc)", "value": "9e78d92953fd7ab0025a6b0e694725f56bb4290b7d11db87e412e75a7913bb33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558564, "uuid": "4460097f-6a13-488e-b33f-b7008fc8e661", "comment": "Malware payload (Stealc)", "value": "2e4e2b648de9a6559680eeca146047c1153eafc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558564, "uuid": "70cdffe5-c8e3-40ff-a2f8-f45fe4d9da7a", "comment": "Malware payload (Stealc)", "value": "ffee7e158793ee7b01ca911ff0d1cedb96543680ba87111097fee84a43d148e0249eaef55610700308d93443400a7604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558564, "uuid": "94ae3dd0-ab68-4ce7-bbb8-7be885bb075f", "value": "T185444A8392D07C54E9268B729E2FC6E8761DF5518F4D7B6A2228AF1F18B11F2D273311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558564, "uuid": "1db616bf-aa70-4853-bcc0-6db6fa4447a9", "value": "4fb0bcf26b1d5a4b99e9053f9366e05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558564, "uuid": "553bc30e-9e6f-407c-9909-82f75e87e029", "value": "3072:bJZ+K8b9LOMnnqRtsfT5OtL9gsFCOXWLjPROWHrfbuYJCSc5JyPGk82NlTP:6K8bJhnnULz8OmLjPLmcxMyxrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558564, "uuid": "afcdf3fa-0ecb-4063-b3c3-03a5fad4643e", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558564, "uuid": "347b1806-4b7a-4961-bdb8-7b339f592854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558564, "uuid": "7b013a95-97fa-46b2-a714-5e70e0a0fb57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138998c7-6cbd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697526982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526982, "uuid": "fcf7eb8d-fd79-45d6-b92d-5e9ffba46e2b", "comment": "Malware payload (AgentTesla)", "value": "944cbd3720565dd3132d42deaaf25cb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526982, "uuid": "2ebed50a-f2b3-4fa4-8315-e8ecfcecd274", "comment": "Malware payload (AgentTesla)", "value": "9e986879ac645f058d5deb6415cc90f40130a67e3d4263be55dbe1a8ff68ad2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526982, "uuid": "db002695-4211-416f-b042-959806868301", "comment": "Malware payload (AgentTesla)", "value": "57afb2192c60121c92303d75dbfdc2390ab83429", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526982, "uuid": "719cfac1-9eb1-4047-b818-40a03070ab14", "comment": "Malware payload (AgentTesla)", "value": "fdb04a0a2599e709cf8d0476a9bc331c16cb0a894242af1d3f29f8c29ee12c056a919d05ebbcce99af7e48104a4d3ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526982, "uuid": "d318cca1-a3c9-4c57-b2df-0b850c5834ac", "value": "T1F2D4121577FDD356FA3AA3BA09A0101127BCB69BE4EAF7C94F9A34C6841EF014518707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526982, "uuid": "45278cd6-8977-40a8-b18d-f325d24c7c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526982, "uuid": "c154ada8-c730-41f1-820a-0aa116bea113", "value": "12288:UBLXmsrJM1oJhDDYTq3tknabWwMHUMRErSGytfPGFm:ULWiMW3nYTq3tkabWwRM0Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697526982, "uuid": "fbf7ffdd-2e93-4c8b-8b2d-011bb47b7f03", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697526982, "uuid": "bfbce315-da4f-4bc7-8187-b47f94a82fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526982, "uuid": "6225ae0a-fc7a-45b1-bca6-ae28ee7d0f1e", "value": "944cbd3720565dd3132d42deaaf25cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d536190-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697545950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545950, "uuid": "19626492-bb6c-4f10-a428-e277659792ae", "comment": "Malware payload (DBatLoader)", "value": "7d17b2621b525557ee783901688298a9", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545950, "uuid": "e5f9fd68-1c92-422e-b804-a18e1d0927b1", "comment": "Malware payload (DBatLoader)", "value": "9fd26cbae8d741263a304f7532107d61d6e78b91a1e551dc2822131dc70eddc0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545950, "uuid": "4bf9dc15-788c-4760-8155-ccfdd295f6bc", "comment": "Malware payload (DBatLoader)", "value": "b63846b36e85f429189c9ee256bc2a6a9814b8fa", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545950, "uuid": "7f4c0b48-adbf-459d-91cd-e32a60cbf812", "comment": "Malware payload (DBatLoader)", "value": "26906848df03446dad563af37487484e4caff9c8e1732cfa113a2da2e2648950f421c1a1e8881f53112da3c50648dcf8", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545950, "uuid": "41f66670-21cd-4b5d-88e7-207bccfd7f54", "value": "T1AE25BF62F2820637E173C638AD1BD3785F297E34266D788D6BD42C489F366863C1A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545950, "uuid": "17b1edfb-f1d6-4aa7-95cd-9474d2cc148d", "value": "003d3d12d28525a81de6bbbfc27b008c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545950, "uuid": "f39b5f03-9053-460a-9009-5d5a78779aef", "value": "24576:PKEbMgZ1x1BaPhO/TvtcY6Rs7bvteS+BfUZ5puZP:iEogpU6T+Yo25puZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545950, "uuid": "36ec6504-ae43-47b0-a80b-db57edf0851e", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545950, "uuid": "4c3e54be-695b-4dac-b795-119ef991fcc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545950, "uuid": "428801e7-72c7-4e35-9ae7-18422ac11480", "value": "Mzcoqandgnyyyp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40a387f-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697539734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539734, "uuid": "b6383387-d3d4-4913-bccc-3755b0074ac8", "comment": "Malware payload (AgentTesla)", "value": "f1f7ff2930001b80e3b56165eb9af2ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539734, "uuid": "20b4478d-7237-4226-8a28-a9c6afdf3614", "comment": "Malware payload (AgentTesla)", "value": "9fe9a0edbf56394c7f65764f1fe3a567ef7689716ee94cd1b415a00f907520bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539734, "uuid": "eaad5009-c44f-40b7-9cad-c7b27ea90b32", "comment": "Malware payload (AgentTesla)", "value": "aa5d8d1a01d70f448a0abfbcd375bd99a90aad93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539734, "uuid": "cca21162-64c7-4c71-91c6-1a19d530d3d5", "comment": "Malware payload (AgentTesla)", "value": "5fa2ac4b3e096b613ae662211e18832c5f4b0be1d54a47442edc8975c09a3c1e0b37305e82aaa5a96e04bd8243af0456", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539734, "uuid": "7cbd179f-f28b-4824-bd25-40c46a70758a", "value": "T150E4234036FDEB26F6B6A3F71DF0241417BDB6C2626FD7DD4E8621CA802C70148A995B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539734, "uuid": "d31f735f-380f-4f66-8083-e4c1371b36ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539734, "uuid": "02a41282-8308-4a38-8880-1e93ff4cabad", "value": "12288:0BLXmsrJM1rgm7dunmck+yO55s2escqMzOWfag0dqEl+0gAte2:0LWiMTpokxOAIcfTagAqEl+0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539734, "uuid": "f3d08a38-b9ed-45ba-a884-45567c6a619a", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539734, "uuid": "96a2e30a-6124-4915-a660-1e8d75a02d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539734, "uuid": "7aa4b145-0491-4172-9d4b-059d3fd2453a", "value": "\uacac\uc801 \uc694\uccad\uc790\ub8cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233502be-6c90-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697507681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697507681, "uuid": "1a124239-78a9-4f0b-94f5-93bd38307f7e", "comment": "Malware payload (Smoke Loader)", "value": "1b38c50b5d1caf07e61e1e443b9edba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697507681, "uuid": "38d31ae6-63f1-449f-9462-bd916fec2aea", "comment": "Malware payload (Smoke Loader)", "value": "9ff153814ef1889412e1af97c60ea1853824c3b3012c018516c352a0e6e100aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697507681, "uuid": "ee0cfb6d-c613-466d-af10-31105dcb075a", "comment": "Malware payload (Smoke Loader)", "value": "5d990f708eb1f2a28a35693ad8a9217b0aa25425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697507681, "uuid": "5873426b-0767-4f54-8f30-f4b2b96efab4", "comment": "Malware payload (Smoke Loader)", "value": "812aa9009f0da8b8dc85f2fd6ebdbe974d3660fd2178159f2e6a334df1266c1f0784ab7737fce8d19878f59abad6453f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697507681, "uuid": "e159edc5-ae9f-4960-af8e-7439da3914c7", "value": "T189352303A6D49073ECB21BB05CF347870A31BD928D3897A637866DBD69B1A45A53133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697507681, "uuid": "7386ca47-bf41-47b1-9294-64447f836839", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697507681, "uuid": "2ce732d7-7ad7-411e-8571-1d7b16dd08d0", "value": "24576:MyoDzZO8I5yy9/I3FtL+wTvJoYLFILhMtyLWsitvv9lJL1W0:7oDdpIQAI3FdyYLF+aEisitvvdxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697507681, "uuid": "72d3230f-fb53-4e52-b196-649ee2d9dea4", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697507681, "uuid": "5fea6223-7fd0-4ae2-a3d6-3281dea80b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697507681, "uuid": "032f17cb-c0c4-4796-a9e5-32ec6510ab82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b66e90e-6d31-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697576951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576951, "uuid": "76ec70cf-d936-4b79-91c3-4ee1809ee5ce", "comment": "Malware payload", "value": "c4efc3600edbb2e69be5424099b4ac0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576951, "uuid": "8de0e172-b566-4012-bbe1-e019c9d7be48", "comment": "Malware payload", "value": "a04f7f2b0944df99c45575fab3422035e23a1b779c7b9bb994db9a214911a6ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576951, "uuid": "a36b991b-917a-457e-8b12-ca76f8b5f571", "comment": "Malware payload", "value": "8c9c57193f40b0230490b4e8d6d2a973d61dad55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576951, "uuid": "9d756bcf-5e16-4f7f-975b-b62d13b41d46", "comment": "Malware payload", "value": "c811334166cb60f41ed9ac24cfdc86ab343e758d8b0ab5f84eee3a02aa0d6c8fdb14b991bbff468fb674041ed043a316", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576951, "uuid": "a03052e9-c816-4366-ae4b-009ebfe4d556", "value": "T19FD50297B457900CD9148874E7E6FAA936B481B37ABD68C2270C83A7FFCD41A94C4793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576951, "uuid": "4dc895e3-4a9f-42d1-b16c-d55fadb4c417", "value": "3a7ed0a55ab6896f8b8ac464be3f6914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576951, "uuid": "8e558355-b16b-408f-88ba-2bb2e2f6f960", "value": "49152:vx9gUSf8V5Db2/Etac82RspA6fAS9gNMSw6mKPBWG2miCvRojsYevLkTIZX7tq6N:vx9LdV5Q8L6YS9QN5R2mimijujkTW7tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697576951, "uuid": "4db943eb-3e92-4521-8528-7390e5f216a2", "value": 2870000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697576951, "uuid": "6444fa0b-1927-4dc8-9347-f5ba5e5525bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576951, "uuid": "2c663fce-a9ad-4359-953d-45b030492456", "value": "aclui.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68543f16-6cce-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697534426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534426, "uuid": "d20c8890-6083-4635-999b-e10e63b81172", "comment": "Malware payload (RedLineStealer)", "value": "26f5998bea0431346c00abedaa6bc271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534426, "uuid": "700237e6-2f7e-473d-a442-8255b4fd04b9", "comment": "Malware payload (RedLineStealer)", "value": "a1102dd11028ad4bc79afb22e0fe60505cbae055dd86483fa043c1411ee1c2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534426, "uuid": "cbc9a6e6-efd2-4cbb-a05e-92ee7fc7f832", "comment": "Malware payload (RedLineStealer)", "value": "99958d6477bec8cbc850d4505ee40acae658d969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534426, "uuid": "b5bf7fdb-d1af-4391-9cff-aa72ad9501ee", "comment": "Malware payload (RedLineStealer)", "value": "9c024e7eda4a2f887072c3d09e8aa5b6cbfbfc9a90758e92643a7e5b3b77c8a2b0bc5095a448d6014c071ac647e269c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534426, "uuid": "b015a648-6048-411a-b0b0-6514f7e35bdb", "value": "T1F2E39D0175C0CB72D573193104B5DBB15E7EF9300E209EAF63AB1ABA4E742C19A36A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534426, "uuid": "cec433c3-ab9d-4a48-b202-a3547038634c", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534426, "uuid": "d8aa78e4-9627-4701-849e-6aea24728476", "value": "3072:60bw+FTZINhlleMIkYo3TNfGqT9aKNFiMfjqKPio+IGvFbO:XLZINvl0yu+Nsujlqo+Iab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534426, "uuid": "82b64b5b-737e-4691-a7a4-6357beac6694", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534426, "uuid": "299a70f5-7f20-4b77-84ef-55297e6980c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534426, "uuid": "219057ad-e488-4a9c-8ea2-59236c1fc027", "value": "26f5998bea0431346c00abedaa6bc271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22ef7e3-6cc7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697531543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531543, "uuid": "2c350e6a-0eae-4273-a163-06b22debc9f7", "comment": "Malware payload (AgentTesla)", "value": "a1225afd917b14a2194b63384ff82163", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531543, "uuid": "09f8fdc6-0b1b-4306-a5b4-e9b50a704df5", "comment": "Malware payload (AgentTesla)", "value": "a184d2ce3480d7760397c33df9cb2558133468bf0872d9653a44efc2d85142b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531543, "uuid": "4eb83255-2c4b-49f4-a7cd-9b6f2ce8a5e8", "comment": "Malware payload (AgentTesla)", "value": "2e57cc965696ac50536b36a0724db0b76b1d83f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531543, "uuid": "25b39871-1330-4bbd-af3b-457da2aa2435", "comment": "Malware payload (AgentTesla)", "value": "0d9e7e66b6e392368678c2bb68684618e583271d43ea66c96d4a8ea898456a3ba44ed8622ada936edbc449d2862ac0d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531543, "uuid": "1e5b353c-a316-4590-8a37-33340256af39", "value": "T1CBD41312B3FD8786E53EE7F95561107517F8B21AD4BACBC82F9A38D9841DB0005B932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531543, "uuid": "a0ccddde-9905-48c2-9221-51947c708d1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531543, "uuid": "d0db522b-9f88-4b25-9b21-ce6da0ad4b04", "value": "12288:xBLXmsrJM1riHsHF4N6bXB8NGjZjY1OuSPynH/68pNdtmFRe:LLWiMGsjbx8mgIyfrNGRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697531543, "uuid": "fff892f4-9a25-4822-a6a0-31a908cbbee0", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697531543, "uuid": "7b72e51a-ebe6-43b6-bf37-d98d31937406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531543, "uuid": "cad9b774-5877-4840-a7f3-d43271287bd7", "value": "SecuriteInfo.com.Win32.PWSX-gen.12391.31887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30a9e7f-6cb8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697525183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525183, "uuid": "a75dbb5c-0052-406f-a27b-8c07435d5478", "comment": "Malware payload (Formbook)", "value": "34afa893a8432707fa6e3493ced4934c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525183, "uuid": "786d29cc-1ebd-477b-a43a-a78a137b6cf0", "comment": "Malware payload (Formbook)", "value": "a217b4594093f3db0e915ed2a5ed293683269e29af9b0d5a220dc813edfd19d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525183, "uuid": "050fbcff-a8ea-4aaf-93fe-8c2f4663f41c", "comment": "Malware payload (Formbook)", "value": "c7b03d8345d6349f66465cf95de986861b5c7f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525183, "uuid": "4a7535f1-a8e1-46bf-9e11-6e9efebde79e", "comment": "Malware payload (Formbook)", "value": "ab044c9518677b1eccb872bb56136d6b6ed575aae828a7c21468bf3f0ffd42f7711f1e0ec0981ae783e313fb12a8e9ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525183, "uuid": "b2e01bf8-c9bf-41e8-87c7-fcacfa3ccc1f", "value": "T15A841281EBF68632C991813A097EAB821A755E76196097478350FF2F3CF22D16D0F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525183, "uuid": "2f95e60b-6e70-406c-8001-42122e39c6b7", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525183, "uuid": "0957c7a3-09b5-495d-88ad-338ac20223fc", "value": "6144:xfL+oqP2bXAOI5p1ScjLOkUY+v+w9NZD0sdQ7J0aCtYDbgAxzGBkVF4OhwXxvlum:xfLKUXbwDLDS+GNWsdQq9YXjzfVu0wXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525183, "uuid": "a1ebbcd5-e134-4e90-aa6e-125390f21ebe", "value": 389160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525183, "uuid": "568f5c7c-8196-468b-8bce-a2b3f3d2c107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525183, "uuid": "5e70a4bb-6f9f-477b-b19c-0d850455a2ed", "value": "PGHPC-10-DE-000-ME-MRQ-0033-B01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0142cbcc-6d1d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697568183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568183, "uuid": "10b4c9a2-f48e-4736-8704-42ef36fc2183", "comment": "Malware payload (Amadey)", "value": "a774528a427bb692c26be8062b12b20d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568183, "uuid": "ebc0cb04-c342-40e1-8ca0-1dc15ace6072", "comment": "Malware payload (Amadey)", "value": "a226ae502f3cbe11a01bd8d37eb2fdb50c7eb800067e5e55650534b30c7d7267", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568183, "uuid": "8ab84d22-fcc8-486f-a620-c2459ade74a0", "comment": "Malware payload (Amadey)", "value": "5dd41a082caa4a75c805a813d5a7db92e0511dfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568183, "uuid": "225f306a-db1d-4624-af48-2317272b5cef", "comment": "Malware payload (Amadey)", "value": "ecbae4b3b4e467155cbf919f6bb3a077646d6f0dd121e7f915fa311a2e648b3053b8cce59e525dfc7638a1136a60fcb5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568183, "uuid": "c7c038f8-7df8-4df2-a291-81a2edca65a0", "value": "T16D352315F6E56172ECB61BB04CFF57432A3AB8522D38D3162390AD1B0D73680367976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568183, "uuid": "18df1e72-c27e-4475-bade-dd18667070d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568183, "uuid": "784fa967-ac40-439e-bc80-f556b304a76f", "value": "24576:JypHpUMrNoSknxDLx8fDDL5Jn7bEbGIBh9lfs:8pJUMr/Ix/KtJ7bAGIBh9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568183, "uuid": "83f6861a-f1b5-408e-861b-29aac8ff3da1", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568183, "uuid": "8ffeaf25-f379-4dd7-b761-cc203ce2c255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568183, "uuid": "22f4c693-a9fb-4540-9599-bccff42411b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c773928e-6ce3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697543605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543605, "uuid": "33ef5498-3f7d-4dd6-a609-8b1bf5dcf276", "comment": "Malware payload", "value": "6431ab8180291d6f4d1ff76f595dbaa8", "object_relation": "md5", "Tag": [ { "name": "p-2023", "colour": "#59747B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543605, "uuid": "c2cf40eb-71b9-4d72-b6fe-33c9dedb2660", "comment": "Malware payload", "value": "a2d2bc9b00b2edc92e13e730350d946b8d04953e20f730321e792e3bb08db922", "object_relation": "sha256", "Tag": [ { "name": "p-2023", "colour": "#59747B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543605, "uuid": "6a23740a-2995-4b10-8463-0cea165c46cb", "comment": "Malware payload", "value": "0c4409d8d40fb2565d2621cbed1e099123ce2c18", "object_relation": "sha1", "Tag": [ { "name": "p-2023", "colour": "#59747B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543605, "uuid": "f619975d-1a92-4323-ab82-2d5f8f4959ec", "comment": "Malware payload", "value": "cbf3de81a4dc2e2a5823ee2a9d14e199afb867de55ee1731bbe802d8722cfe967f5cfd533638717787721a4a91fd933a", "object_relation": "sha3-384", "Tag": [ { "name": "p-2023", "colour": "#59747B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543605, "uuid": "b5e278bc-d073-41ce-b28f-221e981ec7a3", "value": "T1F4173355C5BDADF34471E2CF73E75F8E22BE8262EB240F423DD4CAA625E127509600E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543605, "uuid": "2e843cbf-349f-4333-8567-18a14baf2be3", "value": "393216:kn8mGHKqYS1IWhKKXLg7gMmugsDWVT5y7R6kBNtQSpZKUC6a/:4jqrII13LCNv2NUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543605, "uuid": "8fbf1f80-670d-49b9-8a48-d3d277781897", "value": 18523462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543605, "uuid": "6580805b-5567-4e0b-b73d-281e8d11dde0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543605, "uuid": "837a7950-76e8-4f33-a516-59e3e326d8c3", "value": "Passwrd-2023-Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f20761d-6cf3-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697550168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697550168, "uuid": "62533c58-c840-4a88-bd57-aab68c63c664", "comment": "Malware payload (Stealc)", "value": "69cafd0f40cb51a1626d9918842f524d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697550168, "uuid": "1de7ea2a-91d2-4acc-a8d9-e4951d64659c", "comment": "Malware payload (Stealc)", "value": "a32fea79322c50eba46e95d2d2476fc7f96cc56584945779fef44d61e93f8d5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697550168, "uuid": "e8ad4052-26ba-4c70-bfb8-99b27684b8d6", "comment": "Malware payload (Stealc)", "value": "560d59ec5d8b564d994ae68d9817d2f830e05274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697550168, "uuid": "78cc371b-f72c-4721-a33d-228f1a8498c8", "comment": "Malware payload (Stealc)", "value": "33128bccf814a6aa71d2fdaa487ae3428f11433e71b0dc799dd9b0cdaf86396a159803d8b84ccd4ec786847ac0746c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697550168, "uuid": "742155fd-5fed-4ce0-940c-75d3c745146c", "value": "T10935224772DA5D32EDF463F158F34BD30A363DE28974969B6741984A08732886A3237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697550168, "uuid": "8415b775-0dc9-47b2-9d96-b735d5d7dca6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697550168, "uuid": "1f8c8370-8518-4eb8-bb76-df44a2ec1639", "value": "24576:dywtSepQO5Lhrst1585RDrQuSXZm9x3OQTrcvSE/uYIT/f2qQVYe:4SSuQQAXMQuo03psTWH2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697550168, "uuid": "78a44261-f54e-43fa-b80c-47f5a39b022b", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697550168, "uuid": "c83a1489-6bfb-4cea-9e15-81ffc226c36c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697550168, "uuid": "7c613dcd-b5ec-4b14-8d13-7dd0d0faf359", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53aefa9a-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697539975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539975, "uuid": "e9f2c9f1-c1d8-4c4a-89fa-177bfc66eeb7", "comment": "Malware payload (Formbook)", "value": "5dc9185191d639c955367a880101e252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539975, "uuid": "25fd24e9-049a-452b-8cb7-da65d6e12987", "comment": "Malware payload (Formbook)", "value": "a38cf104fcc3366e6bcd8c6f947b0c6fe7ee30728a2e72b45e96e9b4b0dac384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539975, "uuid": "26c33a6c-eba6-4f25-a297-2cbf8431f86b", "comment": "Malware payload (Formbook)", "value": "7a59a84aa5fd6b0dd9aeca7bcc8aa149d2b6ba91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539975, "uuid": "6bc6b54d-7c4e-4e63-bf6f-6237a2235368", "comment": "Malware payload (Formbook)", "value": "4a9488df1256f446919853d079c7de7c0821ed88a667edfb0b01a384da337b78b4f01ab4f34cbf2636e4cde7b4defde8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539975, "uuid": "41f0cee1-664d-42c9-b6c6-58c7440242b5", "value": "T10A842343F8E0CC27DAB613722A73A3BF1EB1EA2D2184594B17707E5B3522293691F355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539975, "uuid": "c44563ea-dc0f-4067-9ac9-9f9e29817865", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539975, "uuid": "da9626d8-7c83-47a7-bfa6-5cb63b84d437", "value": "6144:KfL+oq2XMMNBWX5b8rsUclvLNlhsTuXTN+Cfl0mF4Bct6cZ5JPVMyd47LGDaDY8f:KfLRrNBWJgEltsTuDN+Y5+Baj9VPd4WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539975, "uuid": "7d0aff6b-ab80-4a53-9783-7e827fa18aac", "value": 388874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539975, "uuid": "3c4c160c-66a0-4bb3-bca2-8b13a57857cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539975, "uuid": "49c50f1b-2d8c-42f0-a01e-b0636355aaee", "value": "5dc9185191d639c955367a880101e252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29dc24d-6c97-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697511036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511036, "uuid": "dc10531c-efbc-4895-87a0-733db44ed0cb", "comment": "Malware payload (RedLineStealer)", "value": "12c15a30d6aec29422ae4fb47285e524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511036, "uuid": "cbf48587-d8e0-4f78-9035-3c08e721a13a", "comment": "Malware payload (RedLineStealer)", "value": "a45f029880d68f5aecdd4ff22d8b74181e32697a2c2a4e92066d71bf2067f3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511036, "uuid": "eb8420d0-46f9-401d-8d9f-67989b368cf2", "comment": "Malware payload (RedLineStealer)", "value": "27411bea49b284ef7f9f9dcb518de6e0d3d9ac54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697511036, "uuid": "52059afb-194e-46cf-aa29-090b8ffb3d61", "comment": "Malware payload (RedLineStealer)", "value": "beba4f23ef3c32fff44ca42f0bd0fd19cf7aa8b0f2c816f54cd15ad8ce456be7593d60dde3e58935f2b9b14e0acf211e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511036, "uuid": "d8d70886-1b41-4e63-8b43-aa46122b4022", "value": "T17904AE31B5C0C072FAA2D93205B0EBB05A3EFD340F909E9F6BD40A775EA12C19675976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511036, "uuid": "f8c50d58-147c-4e1e-b2a5-4c4310cc4a5b", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511036, "uuid": "a4cbf2ad-37e2-4c64-9059-03ea3fe0953c", "value": "3072:wDQy7izKw/kal99mdVeiOEru0PIBLcFWyzdJy+Oxnd:whK3l99cV4EPF1BJTOxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697511036, "uuid": "95e392ed-e205-4e0f-9027-f1126463dc5e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697511036, "uuid": "6b4a7af1-1e7b-4996-8076-7abb696b6c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697511036, "uuid": "d5b476eb-6fc0-4361-8d02-4ee346efd237", "value": "12c15a30d6aec29422ae4fb47285e524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a6c4fd-6d42-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697584235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584235, "uuid": "916138d6-c18c-419d-8f72-9273b2645ee1", "comment": "Malware payload", "value": "096e5177da532ddec603044550cc8a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584235, "uuid": "b5c6baf0-2b2d-46db-bfaf-2d14d36a4bab", "comment": "Malware payload", "value": "a49ab61753bb048f7b9dfe408350452d3250328a7e0952e66105effe3756a4a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584235, "uuid": "76776f77-7c00-4e8b-b466-bf8ea189aaca", "comment": "Malware payload", "value": "ab22d57d83a98a95ac629ee58e18a63a5042697f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697584235, "uuid": "c527578a-ddfa-40ec-b804-c4cc8158b641", "comment": "Malware payload", "value": "0dbc6df3928e42b98cec8c9f946390e96d65bdfb86213f1e66dfcc1387e671ebb8da810fd4faceaf248ea28bbc13c550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584235, "uuid": "eb35d70a-70ff-4d77-9cdd-04996991acf6", "value": "T1C3352323ABD85821D9F5377118F712D30A36BCB18A785B2E679DA45F19B3380A53132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584235, "uuid": "9bee3354-0cfa-40e4-84f3-6ef0aa3987ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584235, "uuid": "97cecaa7-004e-4a35-bc32-bc013864a7a0", "value": "12288:vMr7y908MoLIBdS2I3xkl4HRVC/w6sxoRNM4eogyyFs5n3tko5xlWVk1yOad0+2E:syD9IBc9EoQNCoPy+BtRxB1+0NJfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697584235, "uuid": "6df931c7-9ec1-4988-809a-1296e2e3936f", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697584235, "uuid": "ad32d02a-2037-4d89-a012-54b05fb90603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697584235, "uuid": "0ba54d16-5304-492a-beb5-26d44fdba136", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c74f2be-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697545949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545949, "uuid": "f315f851-e73c-4656-a732-fec944eb7ab4", "comment": "Malware payload (AgentTesla)", "value": "13677a8e74fe15d5e262c03f29eb7968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545949, "uuid": "a87ea2a5-fcab-43fd-8cea-b15698199dc1", "comment": "Malware payload (AgentTesla)", "value": "a5241a887d2466c065ab41a954c7a0f9e4203dd0d3f879be94f1a953582aa11e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545949, "uuid": "9374f551-beb7-4999-8245-395b916f5ebf", "comment": "Malware payload (AgentTesla)", "value": "88ecddfbfc0b171d5f076591ad12fd82f8e2d287", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545949, "uuid": "ecf11f95-ba50-4431-b9b9-c647612e754f", "comment": "Malware payload (AgentTesla)", "value": "8e02f322a45b1d212f4188ec7679b054a0e4e7f28879904e9f04ddb9debdcd2929fe9aea36cc628cb7ef7eb054926035", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545949, "uuid": "0f66d39b-d5f6-4ee4-90e4-472f112f38bc", "value": "T12D45127526DB1D1BC7EE02369090965B0F31934E22B7EF19F8DD20ABAF177C07182692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545949, "uuid": "3f793ba7-758b-49b9-8197-4728a5c914e9", "value": "12288:5dJlUICvo+GI+Zk4TyLCM5uS5748qNoU2QIuPndIg7L:5dJlvCvo+GIxLCMISPU2Qp/djL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545949, "uuid": "5f169954-689b-4b34-8065-b077d073e299", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545949, "uuid": "f383238c-b120-4f92-8eb5-90e84ffb9a2b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545949, "uuid": "35eb2c90-9378-4717-98bc-d406a4a81c41", "value": "L-409794.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbde9db-6d00-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697556128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556128, "uuid": "f434014d-74d9-4135-bf6e-81da16637a12", "comment": "Malware payload (Stealc)", "value": "fb3806f097f2cd8b73cbc17aad05c610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556128, "uuid": "fbd5efde-2414-4e16-9b5f-d6b0c4268534", "comment": "Malware payload (Stealc)", "value": "a56356f82dc7c482f8c5d394e654b9e3774897c5ce728979d12f4c99555f9a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556128, "uuid": "8fdb0576-fc9c-4724-a8c9-bb7e9d17ce4c", "comment": "Malware payload (Stealc)", "value": "57ddabb615f376709558a55cafa92d7e774eb4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556128, "uuid": "1110f170-9509-45cb-b296-d6447a82fa1c", "comment": "Malware payload (Stealc)", "value": "ad32ac11f909f6b5bd57e44b9d08b56dbe92874bb79bd7e8b22565c812efc9d05a6be6e9105330f4b72337ac7b67fa54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556128, "uuid": "04ffef4e-47bd-4448-b393-e978a480de49", "value": "T170342AC392E17D94E9268B779E1FC6E8760DF6918F4D776522189A1F08B00F2D273721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556128, "uuid": "c7058fd8-7b7a-4bfe-9939-7794ffcd95a7", "value": "16c23701599478a5f3c58f9b8290f3cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556128, "uuid": "1a0ba9b6-acb2-4d2d-99a9-ab02db31f3aa", "value": "3072:di1Loqchipp9Ju679ohOhgOYQ551RNFvafnrNBkP:A2qchipDAm9oh6gBQBRcroP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697556128, "uuid": "c52abddc-0f01-408e-9ea0-4d5b37fde804", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697556128, "uuid": "0f93c35a-4de4-46c2-8b50-5b4580d4fc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556128, "uuid": "d1888511-cf26-49f1-acc2-2d1d2c8f3b34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d041aa2-6cdc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697540286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540286, "uuid": "fa5dc759-3650-4fbd-a9c3-e9ef7850423e", "comment": "Malware payload (AgentTesla)", "value": "5796315d4909f06ae1b74d4b6035445e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540286, "uuid": "72af0631-fefe-4b84-a9a8-29c24528e15e", "comment": "Malware payload (AgentTesla)", "value": "a733065ba4e8987727892b1c9ff5e562624385b175ed2e80af74c1fc4579bd58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540286, "uuid": "dbc494e2-9697-428c-8793-5fe3038f34a5", "comment": "Malware payload (AgentTesla)", "value": "103b33ff6eb3a7d2d2635a2ca92962e346625500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697540286, "uuid": "61fd01b0-66d2-4e88-b825-8534f87c4e60", "comment": "Malware payload (AgentTesla)", "value": "b46775af8c785d228170d38d0b51dc51a4694b892623ecdc335c7913157aa3c3f920795b758b0e994ceb90c2f9524d40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540286, "uuid": "45366106-c3bf-4fac-8ba1-25b82d55a58d", "value": "T1DDF32769929A4D13D33D43B8C8B1114C0BB29173565BE76D0DB1ECFA394E7CB323A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540286, "uuid": "e9fa3d3c-b257-4f08-a277-84df92c1bf97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540286, "uuid": "4d01143a-c4af-4c83-93a1-85d1096e5af1", "value": "3072:EOc13n2cqSJlV51DE5PjMXqvKSh7AZ36eQuOSlzwnN680VEL:Eh2cqaV51DEh6qnh7A6fcwnN680", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697540286, "uuid": "b951459d-5021-4f3c-919c-3832f1a01de1", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697540286, "uuid": "946f2fa4-7bbc-4b9d-a341-3aeb6864c0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697540286, "uuid": "d8eb3a31-046f-47f7-abef-863a29310a3e", "value": "1697540284637a144c6fd9c272a54dfa0afdb232409d1a73c4b0917517cba1e762d1b8b7c8738.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e212e0ad-6d25-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697571996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571996, "uuid": "1834b0be-610b-466e-bd65-3b79f29e13ae", "comment": "Malware payload (Stealc)", "value": "d696b267d38f3a99d80041dc169203c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571996, "uuid": "e4986540-a8ae-4000-a057-4c11f70e54b7", "comment": "Malware payload (Stealc)", "value": "a7c9ec53c468ae62c5335ad77a4da85d19aaa0772be626559ceac59dab42acfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571996, "uuid": "1b3c6294-3a11-49a0-9391-e1650e83944b", "comment": "Malware payload (Stealc)", "value": "1f918b4c8c93edc960d39c7290f11ec2185763cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571996, "uuid": "0027d583-e9a0-4f67-8777-25b055db6094", "comment": "Malware payload (Stealc)", "value": "3510b4caba0413fd0f4d7960e4d597fd08981a1a36b879eedb8e8e3a458145ca8f9468c6b5fb0ef9d69db02c447af21d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571996, "uuid": "0c3abb47-3a0f-4727-bff0-4b8fada2a8bd", "value": "T17F443C83D2D1BC59E9268B768E2FC6E8761DF5508F4D7B6A2218AE5F18701F2D273310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571996, "uuid": "b6a4cb66-c7fc-4526-99ed-f1f30b817b55", "value": "4fb0bcf26b1d5a4b99e9053f9366e05e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571996, "uuid": "26224074-e9d3-497b-b51c-5a689fb29f54", "value": "3072:ZNH1TNV9LXfy1hc/Uf7IAaTnkSHVztDMI+AZ181bGo0y5JyhMNltP:BTNVJvGi/K7IDnkSHU681bGl6yKFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697571996, "uuid": "9c4773dd-cbfd-417c-b273-f0c4a88c051e", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697571996, "uuid": "e2a39cd7-2ad0-4d19-91c9-7b9c55568875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571996, "uuid": "896bafbf-96e3-4c7a-9402-b9d81b615bf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227e8f7d-6d28-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697572963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572963, "uuid": "a5f13a1b-5c66-4c02-9c6f-8c35bb963c64", "comment": "Malware payload (MarsStealer)", "value": "4b62add9be90373f7d39a3489244a08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572963, "uuid": "69b99b52-133a-4f24-b835-1820baf91e30", "comment": "Malware payload (MarsStealer)", "value": "a7db740553ea08fc816847b2d000244c617b6cf90bb6730fe29c71e9cf5c2dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572963, "uuid": "1a381ed0-c03d-40f7-af9d-e29f55e6f7d4", "comment": "Malware payload (MarsStealer)", "value": "8105b3807b62de723c3395f9dfd3d48ddf6972a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572963, "uuid": "aaf9a4a6-1ec5-4352-a4f2-ab416e3746ef", "comment": "Malware payload (MarsStealer)", "value": "1049c8e49c7e8fce34bbe3feadb5d6cea037dbfe8503daec636489b859dbe0ceba86d0123d74ed4ce5825e67031c80b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572963, "uuid": "a21836f2-e0c4-40bd-8fa9-ceef40f7f261", "value": "T14C444B939290BCD4D9168B769E2FC6E8769DF5508F4D7B6A2218AF1F08700F2D277321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572963, "uuid": "d807b97f-cbf7-42ed-a8ff-e610f98ee2e7", "value": "fe0b386ed1fd8c25368aac6a4d3a2597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572963, "uuid": "61f74884-1e66-48c2-b141-ad1073747dad", "value": "3072:CIG2sGvQtirGcSAFqXocShM5tO7kB9a2YJnaqNxAq45AQQDANlt/:1CHtiKbRXocShM9YJaqNxAq5QdF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697572963, "uuid": "b97a5d24-b108-4bbe-a1c8-07a4aa0c1c27", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697572963, "uuid": "0f7047c4-d104-405e-bcfe-c207179cc912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572963, "uuid": "3b59926e-260d-4481-9404-026b4112965e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a80103-6cfe-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697555136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555136, "uuid": "aa84cef9-5ad5-42de-b487-f503ae88e8dd", "comment": "Malware payload", "value": "86b0ae9a51e132517bd5e0c131433539", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555136, "uuid": "6140aec6-134f-476b-b790-a09ab91cd899", "comment": "Malware payload", "value": "a7de04ddd6e6ec7059d96c8cda976daf6365b40f1ac369c0ecc10726f8a77977", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555136, "uuid": "88e87dd0-9f81-4144-b29f-386f8e7e0f53", "comment": "Malware payload", "value": "9ebe9e87ef00d9aa29ec89b250b0466de9850582", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697555136, "uuid": "427068ee-4d6d-4de7-89da-55943d54f40a", "comment": "Malware payload", "value": "f911f26ff7125828e8cfe4b91d607ab9e713d95607e485f3cbe6afef7f8bfc37637c77c2d10b75df4930a7573df1c9c9", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555136, "uuid": "ac6de974-0ce6-4852-9a24-e59cdfcfe091", "value": "T18205E035F4606662E84DE63908B15DA517FAAC3E023B2BE42136358F57E3F789E2403D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555136, "uuid": "9d08a6d5-6d69-413f-b698-a99087d3606e", "value": "1536:KBYJJvF+F21G4H/zJKfB++aqbi5VDGQ35zN:4Uvu2/H/Fu9Pbi5VaGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697555136, "uuid": "8ac9c60d-07f7-447a-bb8a-f4d26a1274a7", "value": 840847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697555136, "uuid": "72c341e8-46b1-4b23-8af4-b6c1a61b1aaa", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697555136, "uuid": "c5ae0d7c-ec11-462b-b660-05261b261d66", "value": "Gecikmi\u015f-\u00f6deme-pdf.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23d4643-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566870, "uuid": "307f3d47-219a-46bb-bca5-215526e6d7b7", "comment": "Malware payload (Mirai)", "value": "8757f6a7aa9cee064a7858d198655536", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566870, "uuid": "aa398ae5-f314-44fe-a6cc-05f1ed74ae64", "comment": "Malware payload (Mirai)", "value": "a8290fb1465300c0cc436ac26f3dc1ac3031a9251a4480de58d5d9ab56901343", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566870, "uuid": "fdcecf01-efef-4d70-b408-ec58efc43192", "comment": "Malware payload (Mirai)", "value": "409e457f99eef85dc672e433a8bec91789784680", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566870, "uuid": "cf80838c-b2a1-42fc-b2c3-a3bbabee2fd7", "comment": "Malware payload (Mirai)", "value": "b4f6882a212894421989ff931362f870184c3147b9aa895adf7946de2d08dc186f05781465aa5d40633170402efccd6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566870, "uuid": "e6901d13-8f44-415c-8096-ceaf3d47f63b", "value": "T15DC2D004F041DA05DFEA29B13D54CADABBE06F1EA9668E9062A453D1AF5D3A34305ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566870, "uuid": "c9c2b705-c3f2-4a3f-9845-ddc4eaa9cbce", "value": "768:tVdafO76jpmNJJKehmA7trpfIX9KeA7PZxK4uVcqgw09D:Vam+AnKehPRa9aRxK4u+qgw09D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566870, "uuid": "51f26fd0-9d8b-4a0c-988b-e184893546ce", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566870, "uuid": "1f45298a-16ff-4b68-b5f1-51c4724d7c63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566870, "uuid": "25b6f56e-1d42-47c1-ac44-323ff41fa579", "value": "8757f6a7aa9cee064a7858d198655536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da1f0b8-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697539938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539938, "uuid": "03f14af4-dde5-4baa-8e15-062c71ddda06", "comment": "Malware payload (MarsStealer)", "value": "2c129766d89af8cf0fde7145e72f41ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539938, "uuid": "5b6d9518-a366-4f91-bbc7-7a4d0ec08d22", "comment": "Malware payload (MarsStealer)", "value": "a86fe864b7d6fa84c9f36c398f74e5a0441d1bb935dedeefd4c100fd4fe1ff4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539938, "uuid": "7e045ce0-4cb3-414b-9f7f-ec9791e9658a", "comment": "Malware payload (MarsStealer)", "value": "350329a1b7dcf438f791cfa353a56046cf25dfaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539938, "uuid": "1e728e2a-2a03-44a2-8cd8-8136aa07c036", "comment": "Malware payload (MarsStealer)", "value": "37581a49d9f32b978abc87dbbd5f18432f2db17a85a0b681a84d571eb877fffdbe8a54b2d9e602dc1e6dca8c1d1b1bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539938, "uuid": "82acfa5e-0d85-4081-801f-d07854d1e43c", "value": "T138343BD392E13C54EA268B768E1FD7E8760DF6608F4D7B6922189A1F08B01F2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539938, "uuid": "62e8134c-cd92-47d1-be6a-0807baa555f3", "value": "305c32ee7516131cef129ed3db842454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539938, "uuid": "bfc6fa77-dc75-4950-9a02-3e83250628a0", "value": "3072:7pkFXFpmTcLLCsB3QlqH54nvifIkFjn+0Y4/nHFHT5W3E2ZNw0:lY7kcvn3HXfrL+0Y4/nHFHIU2ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539938, "uuid": "6b729c7e-0187-449e-931c-ac29a2e71a15", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539938, "uuid": "1e557cfc-7afb-40d8-8a5d-72fa44b62f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539938, "uuid": "8723705f-8268-4ada-abdc-84b2b1a983e0", "value": "2c129766d89af8cf0fde7145e72f41ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bae90c2-6d15-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697565006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565006, "uuid": "fea202f9-4dcd-4cea-9020-b4baff18c7b8", "comment": "Malware payload (Mirai)", "value": "7541bc61bb4c0253a0800fc0645a8fd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565006, "uuid": "b3c44336-f701-4125-a3e3-e01452f56311", "comment": "Malware payload (Mirai)", "value": "a900aca84939bbd8854cabf8d2a8a70e973cd3db73fc5c1cf99956400e34e1f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565006, "uuid": "bfd5805b-7068-4caa-9ee1-26ded7e2ef60", "comment": "Malware payload (Mirai)", "value": "3c1fe855ec12bc629389915ea13c9b146bc484d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565006, "uuid": "a49d5e52-d191-4412-98dc-af1f5c9e68c2", "comment": "Malware payload (Mirai)", "value": "5a0aad1acb00bc4debc7f082d4d6c0bbb58a3aeb5be8e40e3c5cd87a1f1e36a1f3dda29e6ea91c186088b2d74e5346a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565006, "uuid": "22d99086-b2db-4474-85cb-e5ac8147a7f5", "value": "T120C2E130A6BD1CB587600631F7F856C6BA530FBDF9FE2890114097BA7982D091DDA9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565006, "uuid": "89e4066e-1be8-4593-b6ae-d785e6d4586e", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEfjKh6hymdGUop5hg:ERsoTAZ3alkXLvFh8nNEf46s3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697565006, "uuid": "6f1f1683-5b5b-4e20-91d5-48920abb129b", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697565006, "uuid": "1495ce24-b644-41a0-83b0-0231bfca26c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565006, "uuid": "77817084-5fac-40da-8401-c80b1daf84a3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43891c78-6d06-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697558416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558416, "uuid": "11f50ca3-3686-4fe7-9f11-b647f682d292", "comment": "Malware payload (Amadey)", "value": "cf8093a576ce3d72fe2229c1a8d4dd93", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558416, "uuid": "b22f28b5-c091-49ec-a0a6-ad88f9a16849", "comment": "Malware payload (Amadey)", "value": "a974e09aa8fdb23e7191b48eb604e0f237c90f8a607c478583e6de1d4a99214e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558416, "uuid": "2fa1ebf3-7f02-43dc-ad5d-e98ec81c1a50", "comment": "Malware payload (Amadey)", "value": "3c048a2d69b8b86400dc9c5faffa9052e2f40c6e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558416, "uuid": "432dd580-49c1-4dbb-8ee3-fe96e09e77cc", "comment": "Malware payload (Amadey)", "value": "f675e11f1c3156c49dc8c75b588515f2f62220622aaceaadb8d79a6349c1a757b64bd0daaf8448dcce32f55717ca59c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558416, "uuid": "30342db9-4153-4389-a178-0deb3dcde95e", "value": "T1C3F3AE45B5C0C4B2E972193A09E0EBB15EBDF8310F64AEDB638456B94F302D18A3DD67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558416, "uuid": "8b7d80f2-1b7c-468f-84e5-b54533026b0d", "value": "993e953762ca135b10079a743060f9c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558416, "uuid": "f2862e02-36e8-4561-be27-8a53b6fd966c", "value": "3072:cUobygBQPsQ6gty6VpdpA6JaIUgUBZKJHzlo3bhNDwppDDGnRt5hftZl:iygBQ0x6VpdpNJCggRm7nwRPhftZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558416, "uuid": "58aac021-437c-43b7-b0ef-7010952815cc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558416, "uuid": "368c333a-1a63-4504-8eb1-b980b838e47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558416, "uuid": "d3d57f50-c0f8-4f58-bee4-177821decab7", "value": "cf8093a576ce3d72fe2229c1a8d4dd93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5074ece-6ce2-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697543118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543118, "uuid": "f40350ca-8bc5-4162-8a44-6232d277503c", "comment": "Malware payload (LummaStealer)", "value": "06c57b862c23f3b3df90853c15d91674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543118, "uuid": "65b03af9-d5b6-48d4-ac68-57d3a1aae5dd", "comment": "Malware payload (LummaStealer)", "value": "aa2d5b7443a4b58a2f12f0eb47046ff2e3c900fbcdbee2d9b85eb52284891c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543118, "uuid": "5a2ce726-e685-46b7-b16a-636b8bb5cfcd", "comment": "Malware payload (LummaStealer)", "value": "80b1bdcb20098d0d85c36c0a9aaad8eeb5c59545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543118, "uuid": "ef448d7c-3f78-479a-98e6-39938269ff0f", "comment": "Malware payload (LummaStealer)", "value": "49bff41b6a6db318501fe8529f205be5ac988ac0bcce388a457d9360976e1892da33bf66acd7c4069229d8a7b306ab0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543118, "uuid": "eed9e790-b64d-48cb-9a97-2bf3b95b0e5f", "value": "T18E44BF01B4E1C072C972263609E4DBB55E3EB83129A59DAF67F80FBE5F30381D721666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543118, "uuid": "139fc8a7-3d57-4018-b607-4deabe421e7e", "value": "282d146a9b3d87d6152eff920eef7769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543118, "uuid": "3abdbd4f-d17a-473a-a800-0f4d2703a6fb", "value": "6144:+eNCma/3cEowTX/JbXatntmPr7VYPAOpp4U14an5:davcEoiX/YBTpWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543118, "uuid": "0aa49ffb-3a02-4523-9bd1-045cb77b9bf6", "value": 261896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543118, "uuid": "981dd306-dafa-4903-9855-341c865ed70e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543118, "uuid": "7019168f-1abb-4973-af2f-214c19ebdb90", "value": "06c57b862c23f3b3df90853c15d91674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dda575e-6cc2-11ee-8907-42010a9c0042", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1697529335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529335, "uuid": "e44c7bda-610a-47d2-bf66-01b6c616075f", "comment": "Malware payload (RemoteManipulator)", "value": "415f6adef4388556501cb4ff794af055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529335, "uuid": "920c6324-aae7-4aec-81b7-975a20da8024", "comment": "Malware payload (RemoteManipulator)", "value": "ab331fd318fdc268d79d9bd4a4e01a02292041b70403da4f36fe8f310122cc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529335, "uuid": "e1f0c800-4416-48cc-96a7-cd253eaa4ef7", "comment": "Malware payload (RemoteManipulator)", "value": "1486055a9fc888a50e1e41c5004a04e61fd59879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529335, "uuid": "9b18cce4-1bb0-449d-b5df-69042ef7ebfa", "comment": "Malware payload (RemoteManipulator)", "value": "1967f3bbea3068e1345a3e2e3ca742297fc3c1ffff7bc4dd6f5ea46e5379505ffbda7b04bd3a6c2ed7cb1a3e4c2bc70f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529335, "uuid": "c013e4be-ff2d-4263-aa2e-14cdd4c35916", "value": "T10CC63353E7E69859D4FB4B7A49BD0B141B3EBC9D1A138B8D0395F0294C3238298B67C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529335, "uuid": "fb1e2db0-49c5-4444-a803-942baf7da9d7", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529335, "uuid": "95b5357b-7572-4fab-9f4e-ee9d86abdda3", "value": "196608:9oP6UZ0dTdMShx5GBzSSEGdIBCFucTCreKQay7x2FV3cuvsZIC192LDXz68bu0:9oSBTmHIBwHL7x2FV32l92/Xzhu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697529335, "uuid": "c5201d35-a31a-4e58-ba5a-2a2320b2ca0a", "value": 11762928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697529335, "uuid": "1e905efc-aea0-4bf2-bed2-7df49e23f0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529335, "uuid": "48409439-501a-427b-8ee9-3445467b237a", "value": "AB331FD318FDC268D79D9BD4A4E01A02292041B70403D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de046f8-6cce-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697534301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534301, "uuid": "0f87971a-f794-43c7-a422-127a36590083", "comment": "Malware payload (Smoke Loader)", "value": "21b105048dd296c787b5f21ec16c8d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534301, "uuid": "356b6e95-a0a2-40c2-b0fd-8814b5a7efc8", "comment": "Malware payload (Smoke Loader)", "value": "ac1e67cf9b4df4a1f88ba3f0dbef4910fd6ce2528d6f768a243ca60979642d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534301, "uuid": "e95a0710-3f4d-4d89-a530-9212d1c03424", "comment": "Malware payload (Smoke Loader)", "value": "846919e33a23d457cbfc8a2e77820733ee22d360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534301, "uuid": "11e5237e-bae2-4dbc-a047-e0ef0e609d61", "comment": "Malware payload (Smoke Loader)", "value": "a5f995b8a236eeac97ca9fecd637faf0cef0dcca1d6574219065bb3dd1da2272bd63cc2f5cb4907ac44b85a439a9f90a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534301, "uuid": "d232609d-a13c-43bf-8eae-020383eb9287", "value": "T131552381A8E89123DDF9273468F653C71F3ABC059D78935E27C1D8D65CB22D1A83236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534301, "uuid": "d7931c85-e789-44cb-9290-7fa312834adc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534301, "uuid": "4575f201-edcc-4423-aa8b-f412eeb4f6f9", "value": "24576:Gylm0GWEvkXoUTSTrXijoc8dPSrAwYeZdzN8KTK5jBBwEgsKg:VU0TykYUGDisckPcYEVz2ByEgsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534301, "uuid": "b61624fa-805e-4ded-bb2c-bd068882a4ee", "value": 1283584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534301, "uuid": "f193f476-f351-40ff-b72e-f673b34dafc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534301, "uuid": "3c71c400-8487-451a-a84d-a488249f02e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5c2f4b-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524096, "uuid": "7f6e74f7-9a54-4f01-908e-d99eeb7ebc06", "comment": "Malware payload (AgentTesla)", "value": "b57ff5ad232b2821751227d44f5da275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524096, "uuid": "6aefb65c-eb7f-4eda-ab3b-5414fae7f8f5", "comment": "Malware payload (AgentTesla)", "value": "acc86f14cc84e015b1c654946095fa6cdab0372df459070b9bd5dcdffd450397", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524096, "uuid": "9033cd33-74c2-411f-902e-08a880def731", "comment": "Malware payload (AgentTesla)", "value": "21dab0ad7ca7d54f98a8329abc83040319a0c95f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524096, "uuid": "c4a0fc60-a6c0-4d33-9027-d17f32e149f6", "comment": "Malware payload (AgentTesla)", "value": "80081a70b880e8e5ecc7fb35b9baf6c0d1927c1847e9f33e3097eee3daa5a469c59b820ed78d135ca2a02c95d7febb2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524096, "uuid": "eb3b0209-306a-4ccf-a1bb-f36349e18e6c", "value": "T19FF423B079A2F3D3863EF4FB55BAB172166738A580A1737DBDF1580052A2683B5C3C19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524096, "uuid": "4c9410bd-713b-498d-9c72-84f8d4cee93b", "value": "12288:n8nWHDP23zZRwsNXCMt2MSn7dr3MqlTJYvJcsBisneLXxWa2Xw0adJSEuGb0TCC9:8E2nwIX2MS53rrwo8XR0wGgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524096, "uuid": "d8218771-f5f4-49bd-8d65-75f60e5b64fa", "value": 734420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524096, "uuid": "8f0fb6e2-08d1-4874-b4f2-4181ab32d9ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524096, "uuid": "8d7ba011-e857-4630-b0d7-a96994b8dfa4", "value": "BankQmvE231814.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b71e597-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697566590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566590, "uuid": "99559b51-ed46-43f7-9dd8-8172d93cd8aa", "comment": "Malware payload (RedLineStealer)", "value": "d87430c6ac24acc18c285d2a874b291d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566590, "uuid": "5a968695-be04-406d-a6ff-73dc0d68f6eb", "comment": "Malware payload (RedLineStealer)", "value": "ad79b4136b9e78f7c6c3e18b60d3bfe663ef741b926c294a908bc4416b4b42db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566590, "uuid": "139cd52f-7bb5-4765-a415-37fa9d41e00a", "comment": "Malware payload (RedLineStealer)", "value": "c9336ff67990ca8bd8273059d32999fabe41e6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566590, "uuid": "765d1edf-7d37-48f2-84b0-b9fe0e5e9eb3", "comment": "Malware payload (RedLineStealer)", "value": "8a4f086c2a70c6a82fa9a5c8afb8275e190c3e786cc4051261d1586c33bcfafa1349ec16ea523346e002460878c89138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566590, "uuid": "eae3b00a-ff32-46c7-b576-8ee0037b5e15", "value": "T1D9352361B6D890A3D4F437B05CF353A30E227CA11DB4860A2B869C5E0D73FC96A75767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566590, "uuid": "0e43a08d-adbf-4f79-892f-efe1924d7f95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566590, "uuid": "d54fa8dc-e182-413e-8fa4-0ca1360502c1", "value": "24576:7y5Pua5WL2Tz9oy1Sl1f48U50RQ+gCD+JEm1FZ:u52aF5oy1S3+0Ziqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566590, "uuid": "b47febbd-a634-485b-b46a-57969b5dc522", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566590, "uuid": "8c141c02-db3f-4ff9-90f1-d94dbd9f791a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566590, "uuid": "279149ef-535d-4627-a662-38b350f78d29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc3c6cc-6ced-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697547830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547830, "uuid": "54bc7f9f-2248-4bf8-8c38-f63d321bc7fd", "comment": "Malware payload (AgentTesla)", "value": "8e615d87840465d311cf1630c5766e58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547830, "uuid": "94abc34e-b774-4f2c-a5f6-8de04c3e6d35", "comment": "Malware payload (AgentTesla)", "value": "ae6e098a29859cd730e5c34d63ed3b3b7cc79d2afa2135394d48d179e8909588", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547830, "uuid": "42243e05-ab9c-4aac-bac9-be427c0d1ae0", "comment": "Malware payload (AgentTesla)", "value": "a57733c701fbfe4f98ab24110d1933bbb9819314", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547830, "uuid": "aacd4b08-409c-40fd-b2a4-145dcf7906ba", "comment": "Malware payload (AgentTesla)", "value": "d3096d9c46e3ede4027cdad1e677188f09a4e5d65a99fbb1a8a4f4b882c10ee74e400ae7ff406200331337ba5ab30aaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547830, "uuid": "6c0ec849-c549-43a1-b92c-3ef5b50be0ee", "value": "T199E4224577FDDB56E93FA7FB58202100A7F9F043646BEBC89EC630DA482AB014965B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547830, "uuid": "a5e7bc6e-24be-4dec-8112-16c11432c1d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547830, "uuid": "ee0c7d73-6451-4fdc-9b37-608be9869465", "value": "12288:cBLXmsrJM1UltTcOfmb/NbYX0RoHl5QQFoubnJ0SDnXjn:8LWiM+llc71bYX0RokQzJDzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697547830, "uuid": "bececdb8-adff-40fc-9fa9-492096379cc6", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697547830, "uuid": "cd9c3a2f-0fec-4829-b918-0548dc595daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547830, "uuid": "23feec51-6993-4fca-b917-e5946868c8e7", "value": "RFQ 732mm0281 Bulk Oder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4bcfe6-6d0a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697560283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560283, "uuid": "e081fd5a-6acf-4c20-8e6d-217858c3f2e0", "comment": "Malware payload", "value": "7899d96e5d2253b5421440202ea68853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560283, "uuid": "c8a16c0a-0ac6-4672-9bff-2bf3c00bbc6d", "comment": "Malware payload", "value": "aee0748e565c625d4d4595eab41d5a0e721b9b0b0bab026eeea5c7f923139b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560283, "uuid": "84dc712e-3e3b-4371-a626-c4b75865b6d9", "comment": "Malware payload", "value": "816d85810e976dc102b77d5a4913c4e1c7339e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560283, "uuid": "f96a3703-9704-458a-b35d-62e2dd72e2c4", "comment": "Malware payload", "value": "e13c9e97abed6a9f489b0a6ff05630a55c9700141b63688385fc32924b2fbadd0f0d96e2d9130a0024ecace50604b211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560283, "uuid": "827c9365-bea9-49a6-9054-13a42a3ef6b8", "value": "T181557C223B91B036C66DC071C96997B5D7F3AD288D7349873BC6F93C3A35C418E26929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560283, "uuid": "dd7e734f-64a9-4194-b0c0-67066ecc545c", "value": "055223993af9d4f09133cf5b05f14e0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560283, "uuid": "fb4411ba-69df-417d-a3a4-339d43efc173", "value": "24576:Du8JzEgZUknnNzB43bz/3FDhMVGYkUmdNJhmtnjyFwTACQnMsijF:i8JqFVMEtHahQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697560283, "uuid": "d0e7a99b-f9d4-4c29-867b-b0b178d9431a", "value": 1300592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697560283, "uuid": "bb1fed50-47bb-43bd-91a2-a1b0da3387bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560283, "uuid": "89c56ab4-9acd-4598-af18-42f491e68a00", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036331a1-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697539840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539840, "uuid": "71405851-1b77-4d34-955b-afc8e84ff164", "comment": "Malware payload (Formbook)", "value": "8816ae2569502ee59b42b30f1f63c5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539840, "uuid": "72dd58b9-b28b-4c59-bf55-6cf7b1dd5f23", "comment": "Malware payload (Formbook)", "value": "af3da7cad17a62ffd55dff83580e4f63697bf6e73faec62269c6f6b80fd8516c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539840, "uuid": "e341e6d1-4b88-419c-85c3-0f26453f848c", "comment": "Malware payload (Formbook)", "value": "3cdced6525c139f9780c86d9cc009909dc8f6340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539840, "uuid": "f0fe37f9-5839-4417-aeb9-80894d088030", "comment": "Malware payload (Formbook)", "value": "2189e6155c53ea65829a46022b4f563a5fa3afc20e7d03497ba898aaa8b39a96befa8be1e0e781a7359afa6188de8aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539840, "uuid": "0416f6f5-1f31-462d-b5b2-45475edd9fb3", "value": "T1FCD4129902C4DB5EEEB60BF99422D604CBF278066230D7BC1D4658CF4BA97BC5484FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539840, "uuid": "8b5d3ec6-0c75-40b3-95a4-54616b53416f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539840, "uuid": "55e6dfff-5464-4622-b34f-51201e1cdf1a", "value": "12288:2zfqBuHyLZf5yAT+RkTd0ZRZch3ibZk8SzyBFzCac:2T6fRZ+RkTd0ZRnbaXSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539840, "uuid": "d427b453-3fc9-438f-8732-c404233c62a6", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539840, "uuid": "41244282-7e50-42e5-a164-e22ebcb809ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539840, "uuid": "4b617900-15fb-4011-941e-7b8cd6921a75", "value": "8816ae2569502ee59b42b30f1f63c5bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f041ab-6d0e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697561928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561928, "uuid": "c81ac758-e2aa-4b95-b0c3-9109ac6fa5f6", "comment": "Malware payload", "value": "003c33a22c4ee78e83e5e19033b5eaa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561928, "uuid": "d7c8c7d9-63d2-430d-9258-4b97d38ea3c3", "comment": "Malware payload", "value": "af426fc7c31256dc7fd7c1e20007be058da6e4f0cac128eec0a1156099a4c565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561928, "uuid": "41157417-49c1-492d-834a-ad7d6121ef25", "comment": "Malware payload", "value": "00419dd6a0b18c92e8e65bb3dcb640b0fc4d0c8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697561928, "uuid": "a436832f-a7a9-4857-9d1c-aab621fc7ab5", "comment": "Malware payload", "value": "c7d903ddd332c554c9bd0f39dd9b95c4593a15103caa0792aace1f6b69e74cd6d7d04dfcfc216e192786e6b676e39e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561928, "uuid": "940c8d7c-364f-4ccd-b410-8d316a306760", "value": "T151252307BBE59174DEB5277094F712AB1B307C615C34422A6B90E9860EB39C0B973B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561928, "uuid": "6d34febf-eff5-4396-8b7d-c63ca2053ca0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561928, "uuid": "580071b1-bc77-45ed-8124-5da52dfb23b5", "value": "24576:Iy3s3+fQdoei4lTKHJ/p40iIcoaR5MbwEgVhH6fk:P6wsl4qSEabwEgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697561928, "uuid": "f9c014d0-59eb-4c50-be3f-4913157e43af", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697561928, "uuid": "eff7e99e-0bd6-48d3-b924-7161f4526717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697561928, "uuid": "c8d4af74-3b65-44e5-81cd-ded1dd3454a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c74985-6cb8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697525159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525159, "uuid": "5faa3869-40b3-4493-abbf-2111ce97f235", "comment": "Malware payload (AgentTesla)", "value": "dd909f7194c6761279b2f1e449153b54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525159, "uuid": "c64f0105-44d2-40e4-8c38-239f76a422d7", "comment": "Malware payload (AgentTesla)", "value": "af58340e31f464e29c9d7f9f4b538ca71fdee3353e98827f75f4a4a8e63a39a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525159, "uuid": "73df4b8f-1b8c-40fd-a2ab-f9f885a876c5", "comment": "Malware payload (AgentTesla)", "value": "975d6d7b70bacb7dfec39eb7adeeaae93fce455b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697525159, "uuid": "4ed9b3df-3076-4287-8ff6-c1b4a2b342cb", "comment": "Malware payload (AgentTesla)", "value": "6aa2621eb54324cecaf4ada310ff62cd863089881ec8d819298870555b877e9580242a7b49613e74709f13d1517aaebe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525159, "uuid": "eedb4959-a685-44ba-9416-8d72e96f4c36", "value": "T125E412043BBDAA17F13BA7FB966610644BF832678867F7C90F8520CE8A1DB414974727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525159, "uuid": "9a746f17-2492-4ab0-9431-f6a2f18dc904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525159, "uuid": "ac863829-0296-4734-9ea1-f8319df3570a", "value": "12288:oBLXmsrJM1DTJVKtuhJn03iW/spkCO0z0O6BNmbzjRwBq4MxH:oLWiMZTJow0yH/dlecjh4Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697525159, "uuid": "a506c8e3-61e0-4aa1-95fe-d6b305d8ed91", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697525159, "uuid": "0c540751-ed76-4e96-97e0-cced8477fbf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697525159, "uuid": "b6cb214b-7b30-465a-9a7e-994383b96fa5", "value": "Payment Copy248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad447b0-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697545946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545946, "uuid": "efc9aab0-adbd-4bd4-ba7e-12192a1196e7", "comment": "Malware payload (GuLoader)", "value": "dd740a1c23e2998554ca3529a6cd5638", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545946, "uuid": "7eafaaf9-d143-4ab1-94b4-0524a03c695d", "comment": "Malware payload (GuLoader)", "value": "b02cf73fa5987e42dba6fe2ca82e5b1df81bb81e6fbaad92fa891bdcc01c20c4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545946, "uuid": "3c5d6395-3675-48c7-98f4-e3499217dcc2", "comment": "Malware payload (GuLoader)", "value": "69983a674dd50b30a94064f2f279d04992e76bea", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545946, "uuid": "4900f9c7-2ac6-4101-be14-1d1691adead2", "comment": "Malware payload (GuLoader)", "value": "b2d5bb9cc1aab000b5f9acc142a1e55f1b39d93b60d75589b26270e355501142ca2643c3de533f401d1bb2cf6dd5f084", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545946, "uuid": "762fcc2b-37eb-412b-8e4f-b2ef2a04f808", "value": "T1F3045A60CAD9263D0E431BDEBF428941C8FD853D832581ADE69E076E52135ACCB7FB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545946, "uuid": "70e3bd6d-c18b-4dec-b1bd-21a016ea1ed8", "value": "3072:ObeKZgLserKxIa+TLOXxQ9W4SAYIsdk0W3y30/fZySDBnmExKKJudja5nVIk5:OoYKlOXxESrIqk+0/kSNnmEdUub5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545946, "uuid": "0787bda6-8685-4489-bac6-2dfe5c24087e", "value": 173554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545946, "uuid": "5312709d-61a8-42f9-b6f7-b1ca867bb7db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545946, "uuid": "4a16d3f6-0266-42d6-ae43-f7c2583085eb", "value": "Kontro.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509054cf-6d39-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697580342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697580342, "uuid": "c907e444-0a97-4e6a-bf72-998b3d929ae3", "comment": "Malware payload (Amadey)", "value": "07883f721742180bb019ff6aef3cd536", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697580342, "uuid": "f8806668-d660-40a0-939e-204a6877611e", "comment": "Malware payload (Amadey)", "value": "b0c29552fa53272168a1bf1fab77431f7f618d3ec5ef77766caf04d37977a9be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697580342, "uuid": "efffe5f7-79b2-47e0-804d-a22f50be3efd", "comment": "Malware payload (Amadey)", "value": "2d47b6effefa8f89952f64903aae011cdcd1e41c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697580342, "uuid": "088b0b16-de9e-47aa-9981-af2521305315", "comment": "Malware payload (Amadey)", "value": "124acc433d8b7348631168c1e272a407a28abfe3cfde898d1caf18f27f74e18de103a9880852d3cccec8bcb1021555b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697580342, "uuid": "7c3ecca1-7863-4235-8861-b406f162e9a8", "value": "T14E652393ABE0847AEAB0777048EF13430F357968AD3583262751ED5E4C73A84D1B1B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697580342, "uuid": "c454b92f-5ca4-4d4b-81be-df5383565588", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697580342, "uuid": "1d7f4954-cd71-493d-82a6-e8aeb4d9dea6", "value": "24576:fyN2J4pWl+a6G8xrTcg8e6ZgflTFvBMGaNFl+2RvdjrdZjG2C4hcK5LkLGnph6:qGj+rGUTf36ZgfhTMGaNFl+QddF4OAL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697580342, "uuid": "9fbb333d-38e3-4049-a2c0-95e2390b6b62", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697580342, "uuid": "00269561-2168-4db8-8f00-3a0645be015c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697580342, "uuid": "d2e94d44-d973-4495-972c-ca697f15cc7e", "value": "07883f721742180bb019ff6aef3cd536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca81484c-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697546187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546187, "uuid": "534ff08c-4d63-469c-b927-6471743474c7", "comment": "Malware payload (MarsStealer)", "value": "bfc9c33a09577e6220f483739545e1c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546187, "uuid": "94d2f0ed-bb50-4bba-841d-01e9a804dc83", "comment": "Malware payload (MarsStealer)", "value": "b10009897585fc2f9ed215bc17db62a4334ab6efb83865b54126ad15138e0932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546187, "uuid": "80241377-bacd-47bf-aae7-907f3bed5d46", "comment": "Malware payload (MarsStealer)", "value": "21fa676e3719c35bfe181f49fc4c72b5bf32eb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546187, "uuid": "c30f41b6-22ed-4948-b0bb-0a73a76862a8", "comment": "Malware payload (MarsStealer)", "value": "889a2a50d5232ab8f4ed0c414e38f65e4fb1c583d7f65c7817a5d15e25d0cee5c1c3bfb3b62bbc2829be777000847e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546187, "uuid": "982a54ec-6ebe-417d-b29f-79d38a94a42f", "value": "T1B934199392E13D94E9268B778E1FC6E8760EB5D1CF4D776922189A1F08B10F2D273721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546187, "uuid": "ffed157e-313b-4110-b146-bbe858e14e6c", "value": "16c23701599478a5f3c58f9b8290f3cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546187, "uuid": "acaa7a92-c215-47dd-b692-9f04fb571256", "value": "3072:C3/KLjVo7K7UcEq9hk2yQoSkf/x6qb51BsJRNBk:o/ijAK4rq9hgQMnvBMRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697546187, "uuid": "ba4ed8ff-6e96-402e-90a9-dca483a68018", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697546187, "uuid": "08c5a197-5d44-4c71-83fe-02cbc1bfcffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546187, "uuid": "33e94c40-2fb7-47d5-b62f-4e35ea83f332", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37e503a-6cdd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697541102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541102, "uuid": "e5041c3d-2666-44ca-ba37-afec8d763429", "comment": "Malware payload (Mirai)", "value": "9a8d58ae04775d2ef9eae526e1fff86b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541102, "uuid": "6819e869-a6a8-420a-8720-8478367e2aee", "comment": "Malware payload (Mirai)", "value": "b5630a7d9ec1f9f411afa502aa8c6645e3afc18138f80f83c2d46426cff6da96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541102, "uuid": "5bdc6541-cad8-4f5a-9ccf-efe8b21dfed9", "comment": "Malware payload (Mirai)", "value": "217fb2d5579138e5166f6d20a45d4e8dd9b82275", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541102, "uuid": "d70cb77c-00d2-4524-9dac-100a1926b3e5", "comment": "Malware payload (Mirai)", "value": "fb9a12144191df0d39302c2d110a8f56cdc697bf2b49af1148b273741690a816c0cd2733febd0cb4792aa0ab56fe1051", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541102, "uuid": "14c388be-5463-48a5-b310-5b1418c0ce65", "value": "T161D32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365546EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541102, "uuid": "f13e30ba-13ea-4a59-ab78-4889c14d3dcd", "value": "1536:a0nwryWv6n/qZIR2SH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/zA:BWv6/2y8z+x57ndngpPMVtUpdbKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697541102, "uuid": "8e9fd4e5-34d0-4a3a-9fb5-7e887bdb9993", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697541102, "uuid": "73d2bd39-987e-47f9-9dab-f668c547de0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541102, "uuid": "8fa819af-9edd-4647-ab22-9c14b24b66dd", "value": "9a8d58ae04775d2ef9eae526e1fff86b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b22f9c9-6cd3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697536551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536551, "uuid": "9952a4ec-0f27-442e-8df6-6706ba3a4ea3", "comment": "Malware payload (AgentTesla)", "value": "02e3b9809f7f84dbc142e2c95ec1d348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536551, "uuid": "e2045bac-937f-4703-bf27-fbbd60760294", "comment": "Malware payload (AgentTesla)", "value": "b572882a705fb5963ab6184c49367cf73f720092d72f99cad222a26bf0318918", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536551, "uuid": "0fee1a6b-0099-4882-b845-1bfb34342412", "comment": "Malware payload (AgentTesla)", "value": "dae5e058e329f61db43f521b59a289393f61f1d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536551, "uuid": "6f30aab0-21f7-4bac-bf6f-95334cec2b44", "comment": "Malware payload (AgentTesla)", "value": "1b1a131773ef059ec550857cf753dd234475683f9ded1fd5d959dd1020688b1581174f02d67bb003b9ddad7ed4138e55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536551, "uuid": "f0038896-7a0a-4923-8207-d02ee4d41ac5", "value": "T15FE3D717BB9B9AA1C2C86B7ACDDF110007B4D5A1B653EB0F798E13D914433BAAD4421F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536551, "uuid": "4cd03ded-5a8a-4feb-a175-6f2c9ddb3220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536551, "uuid": "41e18675-7b39-41d7-9e51-093245161417", "value": "3072:MykMM/MqOaeZ91TT+lLChW5EzdYvh0jR+q:My5iMqO5Z9tT+9ChS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536551, "uuid": "0ba6d838-72a6-460a-a92c-d3749afbbbe5", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536551, "uuid": "43998f21-ef93-4c0f-850d-43c2a6ff070d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536551, "uuid": "a7ea2b29-d906-44dc-bf42-c153b9f8510a", "value": "RFQ EO-230807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21af6df-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697546119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546119, "uuid": "63a01436-721f-44b6-b629-c82694828b69", "comment": "Malware payload", "value": "c2074ffa632f838d4ca07f8d4a7c7cde", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546119, "uuid": "28cacdc8-56ad-40e7-932f-66e27055ef73", "comment": "Malware payload", "value": "b5e5c020eacd587ed8d445bdcf40b2f51ecf136dbbb3a261624609df350bb83a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546119, "uuid": "cc9ea06d-273e-4fe9-893a-ef39d2f89b6c", "comment": "Malware payload", "value": "028c080bdf079d304666b3b178a2f5bb43652d7e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546119, "uuid": "32453954-265c-4293-9074-367506bb0941", "comment": "Malware payload", "value": "dd63a5b2d346222bd270b7d0e932e0e42f5e1829c5d6e7f4731f0a7b95f99df5d5f9005d451fd1971138daa0638d9b62", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546119, "uuid": "69814d20-2a58-4d98-bf3b-56cb74dea406", "value": "T1D3C7221593ED01A8D4BAE1B899BB423AFB72BC26033556DF4250C72D1F77BC06639722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546119, "uuid": "5704b59e-3060-4ca3-87af-958f7dbedb25", "value": "786432:qcdrpT2jqX78urEFou5p3CjBt7OsKmGJZNw9W+hqDeecMhrZs8KyTfkJm7/pvX:FdrpijqXwuaouejBw9jNw9FDvQlfEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697546119, "uuid": "29fdbde2-5a5a-4c5e-b9fe-aab33fe15bb6", "value": 53915648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697546119, "uuid": "a23b33aa-c471-4daf-bf8b-746b8526825b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546119, "uuid": "66bcbcbd-e812-4387-9c4a-7b6733813d3b", "value": "WinDirSt\u0430t_v.1.1.2.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8f68b3-6d2c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697575020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575020, "uuid": "7820dce6-8946-4a17-9579-f0110d8a08ac", "comment": "Malware payload (AgentTesla)", "value": "15a2ac6e23f605bc20d08c5188cd70e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575020, "uuid": "657e0ef6-1cff-4a2a-82c1-862212b93417", "comment": "Malware payload (AgentTesla)", "value": "b630b78934a6734c47a985812709276c146be604d285251b428130232484a890", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575020, "uuid": "7c26e237-544a-42e0-b3bc-9bf3250cb03a", "comment": "Malware payload (AgentTesla)", "value": "6788da21fd0f5d339e3cc5f6495a94e43dff03e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575020, "uuid": "7ec001e8-613f-471c-8591-635b644be2ac", "comment": "Malware payload (AgentTesla)", "value": "39d32487c32bf41e2c95f566a4571f941ccaff24f21cba2abd21e77fcb6c5509750f12776a4423678cfc01e38188dcc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575020, "uuid": "d7047358-2c42-4b51-b0d7-c1d00bab2948", "value": "T187E4120036DD8374EB66CFF814B1E04517B6B9713A22DEAD1FDE36DD9409B0AA112B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575020, "uuid": "bd9fede1-aaf8-400d-b75d-56c6c722aa65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575020, "uuid": "0c752bc5-3369-4187-979e-14949d6b92c4", "value": "12288:eGDJ92InrUuboEEdZiQDHPa1BmhOqU7i0284lJMX9yhzNg9:f/TU3EEXDvSqi32Di9y9Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697575020, "uuid": "e9d82e47-85d7-4ba6-a591-90a2d0b3f0f1", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697575020, "uuid": "96bfbf43-f783-4267-89cc-38273e565e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575020, "uuid": "be80ffd9-626c-4fe9-81dd-1740a61eb62c", "value": "SecuriteInfo.com.Trojan.PackedNET.2463.12658.10972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7ce4d2-6c91-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1697508338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697508338, "uuid": "aa2bd649-1fb1-4371-a6c4-1b95d0fde5e4", "comment": "Malware payload (NanoCore)", "value": "47cf778895d5e51b3be5ada7f81f7907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697508338, "uuid": "4c78b792-b974-4c88-b23b-db4a15745848", "comment": "Malware payload (NanoCore)", "value": "b674cc279ec0579f342c73a81a4a4bed94b6e7e3aceb017801053261bcf060b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697508338, "uuid": "8f7c18a6-f460-404d-bd90-2efbbbb407e6", "comment": "Malware payload (NanoCore)", "value": "17df042d1c8e7515f05f1029357f1ffae27ebc0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697508338, "uuid": "c3a7de2c-5cbb-41f5-8601-e73f047afcc4", "comment": "Malware payload (NanoCore)", "value": "4fd39fe9312615b8c1cf8ef9f757a5633207616dc1172c55e0986f9c7e55fa715fed91e7065cc8511375602c97762e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697508338, "uuid": "6fb8bff4-5b68-4859-92a0-e93f31c82860", "value": "T125E4F151F399ADA5F80707BE89BAF40022377A5A9465CE0D699F319EC97334280F7D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697508338, "uuid": "24ec5786-a4ef-4713-a9af-7282af986ca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697508338, "uuid": "24c262e4-4faa-4aa0-84d2-47ba55116c65", "value": "12288:5BLXmsrJM1eXihJhGV4Rn/Pm2M8XyRRzYya//bpKU7mnj8zmIdPZnYf8AokHH:TLWiMYSh/Gyd22Mq5yZOmnj8C0Znc8L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697508338, "uuid": "012d3ce9-be22-49d6-8b0c-82691b9478f3", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697508338, "uuid": "7b2b052f-fcba-43e4-b64f-c68bc37cb189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697508338, "uuid": "50044a94-8e80-42d0-b4d6-a64f7b117a12", "value": "New PO-02231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdb5d4d-6d1f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697569228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569228, "uuid": "68cff77e-5b46-4618-af36-218cfed1630f", "comment": "Malware payload", "value": "4b8ccdb549d6490a90948fce3886c722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569228, "uuid": "dd22be51-6939-4a71-b728-a1b5faeec0e2", "comment": "Malware payload", "value": "b69037a6cba7dddd7ec97a5af249e6776f0b432ef9ad04a825c9df0ced7f9d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569228, "uuid": "6cb5f0e1-662f-4d00-b227-2fa5f0e2fa06", "comment": "Malware payload", "value": "fb09d13fa019a4316770e4ce8a845fa1aee9038c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569228, "uuid": "b3e40397-f5db-4be6-a570-8095d2cc37da", "comment": "Malware payload", "value": "b6b4b0f81a33469592e6f800aa92f9f7dd1a575d2b7273460583a2df4ac1a2706107a4f729625722ea3075fdca317db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569228, "uuid": "2ec79ce3-c02e-4ecd-be7a-2bad94eaf02c", "value": "T18824E73AE304555DE87E433DB01C38B09E307C52E16EE36E45EA7EED693BB498A144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569228, "uuid": "38a067aa-a594-4125-b2c4-716a0e7eba51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569228, "uuid": "b720835c-45da-4d05-a082-e3d6ba543972", "value": "3072:szf+F0odnFNgcnWYGO/2Fhp+Gt/qYLIkZ79F9tDonob8:IWF0CFNgcnhGO/Sj/3IkZxzFono", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697569228, "uuid": "2409d491-bc83-42c7-8e72-23f439045e35", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697569228, "uuid": "7627ad84-2596-4e13-bc60-a5289722f170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569228, "uuid": "79c0b96c-7c01-420f-adf2-45d0408f3555", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7529f2d-6d29-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697573696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573696, "uuid": "98fa53a9-7638-49ad-a56d-77ce1e7865f7", "comment": "Malware payload (RedLineStealer)", "value": "27121df06efbeded912d9bded3279f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573696, "uuid": "72bb21d0-46e5-4f43-a4f0-329f836fecb4", "comment": "Malware payload (RedLineStealer)", "value": "b6916e92bc3a01c59eb34f0ec8e53b20948cd4dc26e84d06ae35f3ee2fa7cdda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573696, "uuid": "a2fa757c-eacd-4160-b9cc-5dd9d9e52f00", "comment": "Malware payload (RedLineStealer)", "value": "bcf41ecaccd1a8540dfabe9d9442972dbfa5970b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573696, "uuid": "67629282-c1ec-4438-b443-8bf221200e62", "comment": "Malware payload (RedLineStealer)", "value": "0e139e8f720cce8616984a053ceb399c1636d70bf9d3cc898f1f34b925e3436af125def6417b9c74d9883adf77b87b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573696, "uuid": "31267f24-db45-4879-b05b-a47725987e34", "value": "T10BD4F102FAD688F2D67219320A18BB55647C7D202F14CE6FB3D86E2DDE35090B225B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573696, "uuid": "a32e97c8-0002-4a4b-b04d-ce22f65c10e5", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573696, "uuid": "ab745b2e-c198-4113-8a80-408160360cc5", "value": "12288:JcrNS33L10QdrXZT+tcWnvlOAYnPQY5WEtuWcy1MERYs:0NA3R5drX/WvwpnPQY0x9uME6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697573696, "uuid": "4375084a-abb8-435d-ac35-7a8bf160fa0a", "value": 622577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697573696, "uuid": "bed0488c-72ad-4be8-9926-d57f3bb0b93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573696, "uuid": "fac7c046-f660-4379-8d9c-9499dc63259c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852903d0-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697537481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537481, "uuid": "06594c75-e883-4e6d-8451-ebeac5bc8bd5", "comment": "Malware payload", "value": "26a128ecc47bdd595d4954db1cc4cc88", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537481, "uuid": "7dd76257-82fa-49b3-a780-4e2cde398738", "comment": "Malware payload", "value": "b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537481, "uuid": "2a94354a-2b27-4432-a7a0-dac16b1ac9d5", "comment": "Malware payload", "value": "776858f3134ca4214e9f71f7aa9710259d3da102", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537481, "uuid": "9f80c4d0-3d75-4770-bbf4-75e25ffabb0b", "comment": "Malware payload", "value": "c1a3e55dba4dc39006f3620e84cabcf5903e707ad61412ab2ba06840782cd576bd109a12b7aa81a3119836edd7337c03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537481, "uuid": "e6ad3c6d-ec96-491d-8711-4f5b6d2e374c", "value": "T11255E126F6918437D233293C8D9BB6A49835BE503D245C4E37E81F891F397823B5929F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537481, "uuid": "51c2adf9-1ee4-4c08-84c0-97447f1947a2", "value": "aec94a0f6b56569be1fb44b408c9236f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537481, "uuid": "cf35ea19-dd66-4b42-89f3-616f165fb745", "value": "24576:9oOEiAA2FeKxWgX3oIkibGOM1sdpi4nO2unODRpiWs:9fsFl8Ikiri9gji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537481, "uuid": "2b83a925-c5e0-43a9-81a1-15d44af16e7c", "value": 1393598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537481, "uuid": "d7216910-9ed3-46ac-beed-f6fe6f521afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537481, "uuid": "edc35af8-f0d3-47ae-a561-295095fd1687", "value": "TR.log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e659a3e1-6d28-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697573292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573292, "uuid": "03e05679-1199-47a8-b4c1-d30d4f4a9061", "comment": "Malware payload (RedLineStealer)", "value": "58c7d8923f446dc0ceef3ec7048a496f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573292, "uuid": "c748087e-559e-4a55-8538-2cf98eca3e4c", "comment": "Malware payload (RedLineStealer)", "value": "b7dba9292ec5254cd028109f63605cfa2df4fde631c27ce714b3581d9e7ed199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573292, "uuid": "f9db2cae-5642-4eb6-be0b-37e2ff1f051b", "comment": "Malware payload (RedLineStealer)", "value": "127f58a8ed16156e3f13141b630d0a6a33ae74dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573292, "uuid": "64ae2479-c9e1-42ed-aa1e-4cde99a2e104", "comment": "Malware payload (RedLineStealer)", "value": "264dd69504bbc2755031b5ddadaefbf686d1f73a2eb969b02d7a940a9923273a9a82312cf28a25ef4bff94f260221a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573292, "uuid": "7e468d7a-f8f2-4e5f-86a6-2d2ca7d8a4ca", "value": "T1C5352356A7E96032D8762BB008FB13931F39F9B29828075B3B84AC9E1D73515353637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573292, "uuid": "e6a1818a-0879-4f97-b9ba-ee52508add35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573292, "uuid": "c0fdf6e3-1a3b-464b-a7e8-ad2e46a5a9a6", "value": "24576:ryo9QTpOTpIW4iSfoHr5EEb/Rqk03jOU:euTTpI/ZkEEb/RqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697573292, "uuid": "fbef36bb-5798-4066-870f-61f34999846a", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697573292, "uuid": "968d6b60-b619-48f0-8301-237dffe9a272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573292, "uuid": "d799d72b-5c13-45b0-bed1-cd5ae9a554ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6b20d5-6d04-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697557543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557543, "uuid": "0d410e87-0a66-45fe-95d3-7e247756729c", "comment": "Malware payload", "value": "c3980e421d1bb17bcb5631f8a86bb8d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557543, "uuid": "60e50f7e-b9af-4431-9560-83d3f7b30ad9", "comment": "Malware payload", "value": "b8c7a95f46a83546066a6be530e20c55ed26c594690b71f2704470c9f6b2ce86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557543, "uuid": "75429660-442e-40cf-86e6-80850c9710d2", "comment": "Malware payload", "value": "3ce82dc3958be1d590957daef364c5469e6b40ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557543, "uuid": "3573ddca-0293-4fef-9efd-2b8c18c9ae60", "comment": "Malware payload", "value": "3a022434faa94b74fa15ce7311a38e5a6456165a8fce33735c9561ffc4d29579767c16756d9b7bb9c2d8cc75afd00948", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557543, "uuid": "4eccd525-3494-489b-b4c2-4bc5f56c0ba1", "value": "T1FA34BF2F58225D46F46C52B47C46C6BD1B805E6C942325E7B90F7FB67B3B300AD2C86A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557543, "uuid": "6faad082-3c4c-4276-8641-a5265bb54837", "value": "388b5d3015eda854153fedd1b62e624a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557543, "uuid": "aef5556b-b761-4ce8-ba66-8303c7c0e19a", "value": "3072:LWMduDgFSQDLMvkGNW/25wS+M1gvYrFUCT4sfR6f7YOUD4p5QNNYIR8VX8s1lo6:sk4EHGNp+MGYuM/R9EseImVssv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557543, "uuid": "c8d26a5b-0f43-4c9c-8f51-d16ce5148d36", "value": 251606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557543, "uuid": "5f97ebb4-c1fa-4c2d-a419-fad85122723f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557543, "uuid": "68b6b0e6-6dc2-4586-9b61-443e23b3b061", "value": "SecuriteInfo.com.Trojan-Spy.Win32.Banbra.612.18764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84757430-6d3f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697583006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583006, "uuid": "05233ebd-af4a-4292-93d5-0280807d744e", "comment": "Malware payload", "value": "e787c24c13e01979ca09f76068452288", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583006, "uuid": "6b1b9019-2b66-49d0-823e-18b0c7b0ecf4", "comment": "Malware payload", "value": "b8c83ae6a4654ef994d242a9a8596c6180e731a9e3f5661843f4add2d397802e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583006, "uuid": "4e9a1d19-d7da-4fcb-8ba0-b1f137d91f18", "comment": "Malware payload", "value": "fd700d3ba1c2cbf7012aa4a3e740cb8a400ec6f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583006, "uuid": "0167b16e-2d59-4fff-ab74-208a09637ada", "comment": "Malware payload", "value": "6b94144870da68df1fee424196590ae822f605666ec1ddd1b07ccd6f9e155be5cf5ccf219ea649adb48209d0f2651122", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583006, "uuid": "68f043b8-ee73-4e96-8682-07399ec538aa", "value": "T1BDB2D0B0E75C6CB3DF501D7FED9D43809200973E63A62079962882E47AF304A35A5E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583006, "uuid": "469228ea-f8ee-4c76-8d8d-1368924ee026", "value": "384:i8xwYr+jy9fsPQPIL2HrYnbbC6aE/1u7VBZ3SA4zlq+pycNs0IVPtJX9tgmdGU5Y:VxLr+ulsPQPIAuXCTwEB92zvm0IVPHz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697583006, "uuid": "5e89a211-3991-4c2e-97f0-cb6e46f8ad17", "value": 24052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697583006, "uuid": "14b9e201-cf54-4f33-be58-0892a1bbcbb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583006, "uuid": "09d0571c-7457-46fd-bdc5-98378d6097c6", "value": "Eros.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d4ff56-6ca5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697517004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517004, "uuid": "b4e9fa21-c18c-4802-97c4-8a7728dbc4ea", "comment": "Malware payload (AgentTesla)", "value": "5e6e62c7d0b755d3a5de09599c5c21b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517004, "uuid": "d9d5d2de-155a-435d-8615-df20845ed819", "comment": "Malware payload (AgentTesla)", "value": "b9e042ace2e1ac33cfefd677bb466fe867ba7dbb277ba2716542b8601bda4a13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517004, "uuid": "6c722c76-0ca1-438b-80a1-d6b879f6daa0", "comment": "Malware payload (AgentTesla)", "value": "a26253e9c30dd6e1baa5045db0d62af1556bc89b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517004, "uuid": "95330fa2-de46-41bf-b715-b668c89b1b67", "comment": "Malware payload (AgentTesla)", "value": "47ae94ec2096b7c5031c3558412aeb11018f455d2dcebe122c2aafd740816a7f0f9e5529138ce875584d2446ec68a724", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517004, "uuid": "3d2cc31a-d7b3-4824-80bf-37ca35833acc", "value": "T157D48D17BAB6CD70DA645B3BD28231208F3DDEC56593FA8A284D33E81D76B635D09207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517004, "uuid": "9900569d-e028-4dc9-b60b-3f2a7a5dc452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517004, "uuid": "f644c8cb-600a-4c1e-8adf-3f24ebb1c044", "value": "6144:ZFW2K8qpfdmT1vZAR2ZI1AY2LTQaUJ/nP7LvpqyEeQj7paMzaES:ZFHK8gkvuQIu3TQjnXpqykjNaKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697517004, "uuid": "da0e68b8-6b04-4fbc-a9e4-6bb1a387a87b", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697517004, "uuid": "e23c6b2c-26af-4e77-b3e3-e5565ebc85d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517004, "uuid": "332d135a-c395-4391-ad18-f92eb268582a", "value": "SecuriteInfo.com.Trojan.Packed2.45681.10659.5439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c214c1-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697545959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545959, "uuid": "4e47c55d-35de-43f0-93d0-a8ae153ba26b", "comment": "Malware payload", "value": "3356eb40aa3fd6e31be849bc2db80d1d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545959, "uuid": "958dfaaa-0b95-4480-8ada-1943684a3e92", "comment": "Malware payload", "value": "ba645e2daf54a198b1adfd8b26af6353d702b1bfec46ce2d834dbbf6534582c1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545959, "uuid": "d97bd782-6fac-43c9-9401-929ddb54810a", "comment": "Malware payload", "value": "e5e07ca53143cf3442cd8161e70b59f26b2b0cfd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545959, "uuid": "55693a71-d3ab-4109-8ccc-ef1493934689", "comment": "Malware payload", "value": "af68ddd08ee67114b6237856780f8d29cdbf3178ed39ea41ef1ea369176fd6148f92197479509a316e56832f96122cbf", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545959, "uuid": "cfaac418-c3d8-4ff6-9725-e6a37e7f6640", "value": "T17442E1C196D52414BDBEDE76080AECBEED78F15FEB96C0E09E0272525D48175AD17303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545959, "uuid": "f5b6d0d3-eec3-4e91-ac6c-ec910d35ef06", "value": "384:L01kW4EFm5UIESUMLiPz6CekQSgdYiw7kTDEp:0kn5aSUMCySgdLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545959, "uuid": "e051331a-3505-4e93-a4cf-b3989d23ac96", "value": 12873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545959, "uuid": "c5e4c823-cdb8-431c-b379-05be8fc318fb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545959, "uuid": "5d94dc56-104b-4b78-8ff2-a534b3bbe2bc", "value": "Purchase Order-Project Drawing._fdP.Rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770261ad-6c96-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697510399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697510399, "uuid": "c96481a3-58fa-46b5-b1b5-5111f835070d", "comment": "Malware payload (Smoke Loader)", "value": "c8f4b868730e2e73fe5a80d1e07e7d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697510399, "uuid": "2ececfbd-e95f-49a1-9852-d5397f225fac", "comment": "Malware payload (Smoke Loader)", "value": "bb0ef0b4305930f93cc136ea3f951aeb72be32ab89e11a679fb1046b3bc6de51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697510399, "uuid": "4e44aab2-d99a-40c8-ba7c-f4afbc6be9a6", "comment": "Malware payload (Smoke Loader)", "value": "262949c238f3add4e8b5ce172303c5f973e32a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697510399, "uuid": "adb9c16c-5da2-4fe6-9d03-dd75062e9fb4", "comment": "Malware payload (Smoke Loader)", "value": "ff22d02d7cb4582d89c65ce1529d7fa93b7313e68b3503d6b7cf86a5da078fb6bed3f71e9cf3d4e54025a57aa553755f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697510399, "uuid": "98207ccc-64e7-4012-89de-5e4845dc304e", "value": "T173352356BAE84133ECB603715AF61A83173ABD80D87983567399442F0DF37A0D876B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697510399, "uuid": "fab50738-aa3a-437f-81ee-8a0f4c79dde4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697510399, "uuid": "3150e39c-6295-45ad-afdc-a9b3604acbdf", "value": "24576:4ySncUdSDI6Ax2TqC9Z30HIhLgJ47kuSSEMKis:/47S9qIvkHIhB7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697510399, "uuid": "4c2b5b51-0113-4f3c-8ba0-f1c5fcc2bffc", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697510399, "uuid": "bd1016a8-ff6f-47c5-8a3e-2c83a1555fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697510399, "uuid": "8594f6fc-f08b-4a14-9eb3-65560d3e61e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b3cbb4-6d0b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697560490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560490, "uuid": "b4fe7ed3-af3c-4ec2-a15f-4eec96215062", "comment": "Malware payload (AgentTesla)", "value": "bb4c1097b9d7b68140bce654626eea8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560490, "uuid": "b9c97c07-7fd7-4280-a7aa-e72949ea8bcf", "comment": "Malware payload (AgentTesla)", "value": "bec11f72190fee7497bb36abda739c26f56e0717bf3856f16559b30ec7ff29d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560490, "uuid": "ee49df4b-0d15-4606-bde1-8c16fd6b83cc", "comment": "Malware payload (AgentTesla)", "value": "ef7d250fbdbe77c78f1376586e225e6774b2ac00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560490, "uuid": "0b5dd979-f15d-48ec-8f99-cd5bc17932e5", "comment": "Malware payload (AgentTesla)", "value": "6f802b80ea7aa411d6c8137a9a4a4e05252e0529e01454dfea29a8cc130d6751cc34cce6259cceebb870a8fe2b627cb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560490, "uuid": "399b8442-2d47-445c-8186-55edb95f8488", "value": "T1D3D42304AFFC078DEA6A5FF8085881D80775F6B239A4CF7A4CE831C98455B1B916376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560490, "uuid": "2a6ce5a3-defb-4e22-9a39-e0248763f67d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560490, "uuid": "ab8d3333-9364-48e4-8638-786906950abc", "value": "12288:A3DJ92Ilv58FBW5WxHCmAKQFXRzaEk7biTWP3T4i:0/NvUYWxHv3Qv0biaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697560490, "uuid": "baa5c0b7-3c6b-4ad2-9705-d3e34e320b24", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697560490, "uuid": "20546c8d-d4e9-4ff7-be6b-dd6f239417d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560490, "uuid": "c171a125-c690-4b67-8385-76d1b9b0690e", "value": "Qamu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18df8d8d-6cc9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697532145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532145, "uuid": "a1072fda-dbc0-4abc-838a-bf48fe7e9305", "comment": "Malware payload (Stealc)", "value": "693e3f26dd4babe3b69a07581a91f1fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532145, "uuid": "86bc993f-85b8-4085-b4e3-7ad7dc7fd172", "comment": "Malware payload (Stealc)", "value": "bef82d455ffb2b04c61bfd27e17e4c229498c702d546c55246083cf07a97f1c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532145, "uuid": "ff9798a3-76e1-4bff-9be8-32f2dd1f1276", "comment": "Malware payload (Stealc)", "value": "17ea891772a2c29c8fc5aff466cc0bed09291854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697532145, "uuid": "e4b17795-658e-4325-a4bd-ac91b405f091", "comment": "Malware payload (Stealc)", "value": "7a79dc22932fd23338ae850c28873e55c4b22226e3f4137165f864dd13461bca9b73a36937a131b48ff07e5f13de442e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532145, "uuid": "c16a4332-7200-436f-a9e6-de3022a6a855", "value": "T1A83439D382E13C56EB268B768E1FD6E8760EF6508E4D776912189A1F08B01F2D277731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532145, "uuid": "e60685ff-1a81-4e2a-bb5c-6c6827f26554", "value": "305c32ee7516131cef129ed3db842454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532145, "uuid": "e968c4c0-45b4-4fea-9767-08d7c91f7677", "value": "3072:HQtr5YchS1zp/X10q7D8WGAwIyTp5WbrtNw0:wZY19lz8WGAFymbBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697532145, "uuid": "bf6a25e0-57f6-4017-9640-cf94bf2b639b", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697532145, "uuid": "1eb96d09-281e-48bb-ac1d-ab3215606cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697532145, "uuid": "a9b0c14b-98bb-49ec-acda-f073e850e14b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0ba88a-6c95-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697509793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509793, "uuid": "c4b9a401-626b-46ce-9203-e94ee3973c12", "comment": "Malware payload", "value": "127d9aa15745b8281f896ec39d7a38c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509793, "uuid": "22776846-9962-4ed9-a39e-0c76ddc8c124", "comment": "Malware payload", "value": "bf208ca88ac059bbd01a06c624628d02bae92a68d46589bc9903f6c2a69a334c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509793, "uuid": "1cf95e5d-f650-4263-9059-1a3ed529e6bb", "comment": "Malware payload", "value": "50fe9c2a7514614923409d74ee77ddc2be90ddf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697509793, "uuid": "1069160f-22b3-440d-8652-4b943b406c1f", "comment": "Malware payload", "value": "1afb5834130816704e75cdbe88e2d50bdb0b4221d253823f1b31b2ec46200887137668100460f348913a0ac0f7d158dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509793, "uuid": "3f2523df-87ba-4ce2-bc59-1971f2647437", "value": "T1F7E4122177A0E036E0A29D316475C2412E3BFEB7293489877BA03A3F5DF16E12E65717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509793, "uuid": "5f55bfd4-1edc-4ef7-9a1e-d1a3b2697f3c", "value": "5a48684e8db315337065104a0f86ab6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509793, "uuid": "848472ea-5267-4235-848a-7f6a8c700b72", "value": "12288:db18voF3C0El3Oo/GrcpBloALH6ImM0J84if5v0WHIBr5k5wMpet:dCoJN1jIpBOALH6ImxJRifGWHIBr5wXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697509793, "uuid": "276db57d-a7b3-4d71-baa5-c784578917f3", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697509793, "uuid": "caefe39e-e107-4670-82c4-b5c2cda71bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697509793, "uuid": "a523b8ca-060a-4aae-9621-ef8c80359cae", "value": "SecuriteInfo.com.Heur.Mint.Zard.24.1733.16425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee57c7e-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697545953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545953, "uuid": "7fd61b6e-994e-4155-bf54-37b0e6e3e157", "comment": "Malware payload", "value": "50fe20433c93a62d81c20ce05c599fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545953, "uuid": "46b1400d-39b5-47f0-a238-46c36c1832e1", "comment": "Malware payload", "value": "bf54a8b9a7e0ebb5442246c52673b2cc90e93c61e68ab0dc767b27bbd6d6e454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545953, "uuid": "927eeb6c-3cd6-4e82-b1ae-e5267e89f81d", "comment": "Malware payload", "value": "d5f67ca5e070469b6c463e31039c6b7d43ba8368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545953, "uuid": "982bb8f6-74e0-4fc5-b715-1afe7368902a", "comment": "Malware payload", "value": "446125e55ef7d23e516416b63bf5abaa6d01a24116762cfc034c2a8cdb96abdd74e9d3a4fad89b6f8b37087f765923ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545953, "uuid": "b16eba92-1595-4939-969e-086b2f58e38c", "value": "T149E412653269CB29E56A4FFA8132FA10C7F478672D32D54E1CD804DD063BF689A20F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545953, "uuid": "1fb93d1c-0de8-4996-b714-44f9d6c7c05a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545953, "uuid": "801e0f23-66c2-4528-8021-996759a5123b", "value": "12288:FzfqB0s8yoAvPUwO1hfKXq+CgozOZSQCEdrKJjDiOqK0cT:FT65zswYf6qRg5soKJLqK0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545953, "uuid": "939a849d-2df4-4c0e-9550-266750c083f9", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545953, "uuid": "554aea5e-1fb2-4362-9c97-fce464c505db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545953, "uuid": "1873b830-07c9-48fa-8ced-ec57db2246bc", "value": "NEW ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa06c63-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566892, "uuid": "6689066e-d916-49ea-8f11-ac0b3b474a5c", "comment": "Malware payload (Mirai)", "value": "1988f2c9a71ba30fce1a68b1d3bc3e68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566892, "uuid": "2c8e83c4-6d5d-4d5c-b304-772fc0e04dc3", "comment": "Malware payload (Mirai)", "value": "c0e7ced1f8883d2cca742cd7a29ee124452cc19374131312a1baf87027f87852", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566892, "uuid": "66117326-f1e2-4936-b801-934d328f5b94", "comment": "Malware payload (Mirai)", "value": "a32d06dd0eabef394ea140f12f195ca4fb0a2dc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566892, "uuid": "41b0fdbd-2713-438d-b163-542f18030a57", "comment": "Malware payload (Mirai)", "value": "449a6d6fda939b29c58505e99dc9c78d3307ecf17276630f32d042b853be2ea175b89a6b8b2e0d18b32a400e1f06747f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566892, "uuid": "a24afcd1-9c32-45dd-9bbd-4e4a24086b30", "value": "T13E536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566892, "uuid": "dcf9a17c-c41f-4b2a-885b-becd71099505", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8e:p5VHV8I9cKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566892, "uuid": "107cf392-7758-4404-a32b-0927a34f39d0", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566892, "uuid": "0a59f0da-6e50-4e61-8e1e-bc89452d4d31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566892, "uuid": "4e2d5110-b34e-43aa-bbb2-f8b24790577c", "value": "1988f2c9a71ba30fce1a68b1d3bc3e68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4b9da6-6cd8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697538759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538759, "uuid": "c29b56d6-9342-44a3-931b-b6a44469cc48", "comment": "Malware payload (RedLineStealer)", "value": "1ccd3322979c460652a032abdf8e713e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538759, "uuid": "04e921b4-2248-41cd-b8dd-695ba13caa77", "comment": "Malware payload (RedLineStealer)", "value": "c12cd7b0e10d152dfca79131f1bab8049b48c2c6694e6c8c40d15e22ba5b3bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538759, "uuid": "87722968-55c4-4f08-92b1-0f97e63170a5", "comment": "Malware payload (RedLineStealer)", "value": "318e929cc42a582addee4c270d2022072525ee3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538759, "uuid": "fa12aaf8-e9b7-49a2-9058-e091e648ab7c", "comment": "Malware payload (RedLineStealer)", "value": "ef7999e04da5276c004e6aca369ace9af3d9b42533d3da7d19004cc97a12a875a3d9b0f0790aa250e4cb95c182a99e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538759, "uuid": "f847cf37-11c9-4c4d-bc0d-cb864fb3b190", "value": "T104746BB1F89CAAA9DFD313728870B7E365EBC9719E40DE77438A75F12CD49829820057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538759, "uuid": "14579ebe-4ffa-4332-90fd-c9b7b9eb5fd1", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538759, "uuid": "d354e6e4-5224-45bd-875b-563735e7a6ec", "value": "6144:ExPJ4nbnduqWYYFYCjFX5aETw0MwLV9OsAVnGNLgaBvANaqwGab:ExPJ4OYgYlO2NT8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538759, "uuid": "bdcc2e41-23ee-4278-96af-90128044d51d", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538759, "uuid": "30e7d84f-1d34-4459-a6a2-a60fee5fad15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538759, "uuid": "741bb001-88f9-4a2b-acc9-ccbd76b80da8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882800e5-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697523742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523742, "uuid": "9bcf7e3a-b590-45b5-bb99-76cff2f11f55", "comment": "Malware payload", "value": "2b05512fdd486b161fa82776b7e52403", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523742, "uuid": "c5d78e9b-289c-4acf-9efc-cad0c73b2a80", "comment": "Malware payload", "value": "c4084616532d9c641a40a53102cf4e8d4201f314918eee6a1ab819a7af4ddd46", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523742, "uuid": "c09c9d14-fc2b-409a-8269-f76af7752f77", "comment": "Malware payload", "value": "8572d6104d92b7ac9ccda884dec1a024c048b4aa", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523742, "uuid": "3b56af6b-5d35-49fe-a357-7562585160d3", "comment": "Malware payload", "value": "4e092d939358f9328a465d960d7f7a324433dcb0d418865ad2a85a469707cf805eb57f5cccaca7ad395e47bef657111c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523742, "uuid": "d3ac3500-9ac6-436c-8e44-e8a6bb8be3bb", "value": "T10DD3F159B298E09BD097813A4DD5C6F70619BDC58C93CA0F3184BF8D297B1C3DA2772A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523742, "uuid": "6b97eee9-e5e4-4272-b662-89d1ebff1fa3", "value": "3072:7wzcgBbqotjT48A4LYWWvGAk2winJCp2VjIk0AbtGURwcJxNcz:7wzcOP9T24LYWWVkRingpY8k0Djkiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523742, "uuid": "d7f85643-47b5-4207-9668-3f164f570c77", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523742, "uuid": "a4e2e849-3338-4163-909c-b81743fc9f28", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523742, "uuid": "709873ae-9c3a-4151-b351-333a002e4e11", "value": "cotizaci\u00f2n.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b487a5-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697523255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523255, "uuid": "e153f9f6-fbc6-433f-9f61-f81e7b2a1771", "comment": "Malware payload (SnakeKeylogger)", "value": "12bbcd47078601a66f15749bca45573a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523255, "uuid": "c311cf63-1c0d-4f87-b4f8-96886d7f1622", "comment": "Malware payload (SnakeKeylogger)", "value": "c41b3639173707dfe1b070b92c1b3ed4ed451be6595fa150b930a7dfc4efd2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523255, "uuid": "b98fc077-2b42-4841-a8f9-2c8c29cdf679", "comment": "Malware payload (SnakeKeylogger)", "value": "ea72daecddca36a8acff3c0a8c059e76dde79aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523255, "uuid": "4f181bdd-aa88-42cf-be08-c8ba91bd06a5", "comment": "Malware payload (SnakeKeylogger)", "value": "96e77b28d52a9e94c31c72877d9e7421dd17a185bdb813deccae43161541389771edcb36b786bb0f2d4be95a025b6bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523255, "uuid": "1124697a-47bc-4233-b3f7-7347e924c23f", "value": "T194C4120072FC571BEA3753F79562500507B8B2AB6966EBC98EC664CEC61F7024EF421B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523255, "uuid": "a776873e-035f-4a0f-900e-42643c5259eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523255, "uuid": "4771fbc9-66c9-482e-82ce-294c75847635", "value": "12288:nBLXmsrJM1lmxJm83L6XD4JZyGdDtlUWZJs8UcGf:BLWiMAb3ubGLljnl/Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523255, "uuid": "b49010c8-4b7f-4c32-9e38-a8999d63d90e", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523255, "uuid": "8d207a7f-eb2e-4815-8e82-d36022188976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523255, "uuid": "e2ca6947-e99b-4f6f-975b-e07bfe28841d", "value": "Swift.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9f96e6-6d2c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697574917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574917, "uuid": "9a2accfe-db90-4b54-9b72-beab8fe7c264", "comment": "Malware payload (RedLineStealer)", "value": "ad6f4bd0d40da3d368fb4f74a99f086a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574917, "uuid": "31750992-38a1-43c1-b287-aba5f0e0608a", "comment": "Malware payload (RedLineStealer)", "value": "c46aad7a0a6648f113fe42628ff97adf3e5f8b2bbd625611f82dc9297450fb03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574917, "uuid": "ff36873a-755e-454b-ae87-edc5dc79afbd", "comment": "Malware payload (RedLineStealer)", "value": "8e4577e3ce45ec83d9f77b7e22bc65f934cfadfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697574917, "uuid": "40f82bd0-3488-40e6-b2b0-23c2cd6d3f05", "comment": "Malware payload (RedLineStealer)", "value": "0737b7ac1c69ac6481d371009374ec091ef3aab5665ea774cc861eec658c0b71499d20ba8d71d52d3fef81b9f6c38aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574917, "uuid": "ba72b260-51b0-4dc9-864f-a39dbc1dfeb0", "value": "T10DF41213A7DD5036C9F51BB0A8F602830B35BC565CB8135B1765996E19F3286E833B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574917, "uuid": "d1d1a670-326a-4b46-82ec-fc7726045872", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574917, "uuid": "443fd08a-777d-4265-a020-bf933ab76ee9", "value": "12288:GMrRy908pIDYh8/e8FWCwst2zNAVvRkXG3ssRK/iCMF/g80/E9NzEDu1X+fz7Ii9:Pyv+DO805zNPXGLiiCMF7yE9Oi1ici9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697574917, "uuid": "e125f0e3-931f-4e9e-adc1-bc69a76dea09", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697574917, "uuid": "cc3da27e-1d08-4078-94dd-6d22c2a47ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697574917, "uuid": "9ada60ae-f9f8-446e-8675-e9ca1e8ad052", "value": "ad6f4bd0d40da3d368fb4f74a99f086a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300229ba-6d29-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697573416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573416, "uuid": "34beb60e-d866-4ba6-9cc1-79ba134d26b5", "comment": "Malware payload (LummaStealer)", "value": "8b0cb1623434c7e3ddd75af319522a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573416, "uuid": "15bda939-1d9c-4d6b-a901-cad23e5072f3", "comment": "Malware payload (LummaStealer)", "value": "c47d3d4f5600c88a7e16fc2b68f46922a12ea02328e6bc5b9e4e4224c261ef01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573416, "uuid": "a951706f-2f90-4fc3-be86-add4644655fd", "comment": "Malware payload (LummaStealer)", "value": "fb486db388632fc2d73644d123c24fd104fa9d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697573416, "uuid": "17700def-f15c-46d2-8ecc-e878e3bc6721", "comment": "Malware payload (LummaStealer)", "value": "53e18f84a54a41f1274330b5893a96b16fd4a201654650ed7cb0ab921f7a0132a9c240aeaf5adfc136402d2993a99f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573416, "uuid": "400deb31-c1d5-467d-8aed-58dde4e78a87", "value": "T16D44AD0074D18472D57216328DE0EBB91B3EB9210BB59AEF77E41F7E4E303C19631A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573416, "uuid": "a7df5061-c5bc-426b-8938-be182118f923", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573416, "uuid": "d40bc356-058b-4220-a873-60c4484e5b03", "value": "6144:oMm6yb6crtLHthXcEnc/ilUpEhWqAO2jPDLe2x/QRf:oMFyb6c5LHthM+/GDLxJQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697573416, "uuid": "5929a406-c4f0-45f5-8bb8-edf5c8df1ffa", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697573416, "uuid": "affa66d7-f2af-4459-aa30-1ae6f2ee1056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697573416, "uuid": "533dfe4e-0d87-47a5-8c96-151478c9ca21", "value": "8b0cb1623434c7e3ddd75af319522a6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13a135d-6d13-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697564264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564264, "uuid": "20a11bb1-ea57-4280-8f1a-a6f91182e510", "comment": "Malware payload (AgentTesla)", "value": "68cf6b4b568cc8bcbfe7dc53607f0c90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564264, "uuid": "8f4d3cc9-612b-44a4-9f56-6ee7d5a79a4c", "comment": "Malware payload (AgentTesla)", "value": "c48248fb90e206349a782e77d256e3ea11fa13049a9f2047cb90f4eeb0e30eac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564264, "uuid": "daaabe1a-017e-46c4-9191-8ddcd24577b3", "comment": "Malware payload (AgentTesla)", "value": "f1bd57dad13dee30f79edb5051e04fe2518f9900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697564264, "uuid": "9893b8dd-0237-4008-9304-c3801a5f9cf3", "comment": "Malware payload (AgentTesla)", "value": "d767158f81d1cc766afab041be079efa9fa12293c715e688a72716280509347bb6ec298098964b4a78180d59308bd327", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564264, "uuid": "ec2eb2de-0344-46ae-9e1d-87eeae38401c", "value": "T119257D3D29B9273BC1B9C3A9CFE18827F154996F3521ED6598C353A64342E4639C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564264, "uuid": "421fb672-4894-4eda-b8d1-0acf6ebb2e70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564264, "uuid": "cbe195c6-a745-4ded-8cee-aa832acb3f9e", "value": "12288:rV28jSUpxZt8CfQtUdFo43VKO3tG9H6Wt69yXusbsV:g8jSiZt8Ct3F3tGEWt6slbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697564264, "uuid": "3ea551e0-c5f2-4c27-a69f-b9c8ae296e86", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697564264, "uuid": "3a4d9da1-15ae-468c-9edf-0c4fa35d7aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697564264, "uuid": "a172442c-a585-4d5a-a73e-7598ccf8606a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.18315.19280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8e004b-6cfb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697553817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553817, "uuid": "6f0c841b-d7a2-4910-8d44-417e170b6c8b", "comment": "Malware payload", "value": "752ee6f72c6e1d18624aab3097bf4f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553817, "uuid": "445f1287-1f02-4760-9bff-e808c9f07fbc", "comment": "Malware payload", "value": "c5e7366fee44e69ac1c6ac2b3b2830957c2c9ab0a7c2dad2e8aa11736e1292aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553817, "uuid": "e6eef3e6-e890-48e0-984e-eea7240de7d0", "comment": "Malware payload", "value": "a7d91d59ffb7bd60b1b46e2d840688de182ca3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553817, "uuid": "a95105af-2f3e-44d8-b038-450b19b7ffbb", "comment": "Malware payload", "value": "d6fba5d270ed6abf48306df2e7391b960c7ecb0bb7ee845c047bf832af4bf05a11167a50fc430c9a7119776c9ec19b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553817, "uuid": "993f8d55-5cda-4970-9830-54f816b5b82e", "value": "T1C5A7334D10B0860BD3DCF3BE9C447F9DE246A5E43A3BC59BDA8162DE59797E1800B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553817, "uuid": "4d1d991c-fc7b-4a4d-a0c4-ccb98b36116e", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553817, "uuid": "1d403202-b400-42a3-98b2-27ae9a131484", "value": "786432:G9vhXtwbmGpCSjll4VD5SZqtuSJzDMMnB7cAL+Yh0LTMME/aKAGC:Gt9twbmDSv4J5ZcMB7nL+YuEvOGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553817, "uuid": "0828345e-aa62-4c7e-8d1c-32431d797b28", "value": 46181903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553817, "uuid": "47c69556-95e7-443f-804c-11180f8c38eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553817, "uuid": "a8683d87-5637-4e77-a03f-06d98c7e4ecb", "value": "NatureSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59434fd5-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524093, "uuid": "709aefb6-14e6-460e-abb0-205bfb990f00", "comment": "Malware payload (AgentTesla)", "value": "ffba4edebfeaa0dad2609e98fa29adb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524093, "uuid": "a1615858-ebf3-4cb2-b95b-bce39ea468a5", "comment": "Malware payload (AgentTesla)", "value": "c60d35c27cf503d74ff1075615973f5e53ba37b54668c6bd7ecff744960226f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524093, "uuid": "668531bd-fc23-4a28-9566-8c98caf63664", "comment": "Malware payload (AgentTesla)", "value": "f0a99bde0969b3ee63d7b4903f4945d5e676bf2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524093, "uuid": "b2d509f3-dd75-4b24-8877-53918c62f6bb", "comment": "Malware payload (AgentTesla)", "value": "79c82ea31a40d168ba13bada6d41a8dc8725e11b2596f2373b3339b2d8fd9491ba1adcf33c604e4643506e93b64b778e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524093, "uuid": "b890e805-a28e-436c-8b1d-787aeae8e84c", "value": "T1B9E423DC0700615FF9A9A8F28EF6642027507A59E529173E7C045F5C54FEE26EB0E3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524093, "uuid": "c9b78fca-e701-467d-9870-00c6d043ea3c", "value": "12288:irnWUFZkl170198n9rUMa1MpAKAM139rWDmw5xf0h756LVv8SVpN7TioNxI6q:QFGh79FIMj9vcm7KVv843Tvrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524093, "uuid": "1604702f-3a91-42a6-a8d5-6a70c9b02bb3", "value": 703841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524093, "uuid": "cf36f611-26c7-49f9-93b2-0491f8204ce0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524093, "uuid": "5a404a1b-93da-4bf9-ad83-7d05c191d9ab", "value": "JABIL 301.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4085dd6d-6cc3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697529635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529635, "uuid": "1d2d1493-492d-4eaa-83f2-a51cad275d0d", "comment": "Malware payload (RedLineStealer)", "value": "6d9b7c10b59c84ccddf8b0b452cd7655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529635, "uuid": "ff73a5c0-1622-43f1-b243-8b67f812a0dd", "comment": "Malware payload (RedLineStealer)", "value": "c6f50cb47d61092240bc9e7fd6631451ddb617011ab038b42a674585668dc54a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529635, "uuid": "b52bee63-4f0c-4d08-97ab-630480bcfdfc", "comment": "Malware payload (RedLineStealer)", "value": "7b67f264e241bff54e01640f92728fbb752184b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697529635, "uuid": "07c1984c-d280-4800-ae26-e9232057cb96", "comment": "Malware payload (RedLineStealer)", "value": "d72670d5afd3f0fe70953f5b15d65fd6cac1cb5022f716781b4009b52e19e9df9b96489db88ff2e6f5b73170f7ccf4b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529635, "uuid": "6672a265-6e78-4f55-a747-fa42682d40f2", "value": "T1A823F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529635, "uuid": "b732eb03-3912-4890-b90e-ab67af7388d9", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697529635, "uuid": "162cc815-d8da-487d-beed-b700c7632926", "value": 46692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697529635, "uuid": "0ff7299e-c2c7-4fc5-9a0c-d86c7c684d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697529635, "uuid": "058f3caf-223c-4d01-96e6-111054b80e64", "value": "C6F50CB47D61092240BC9E7FD6631451DDB617011AB03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5115c5-6d2f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697576287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576287, "uuid": "14d1b5eb-1ad8-41f5-a7ff-530abce05e11", "comment": "Malware payload", "value": "c783f66310bc4e2c01c7a1047ac5b18b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576287, "uuid": "2b73d2c6-b189-4ef1-a136-d8cf268e16d9", "comment": "Malware payload", "value": "c84c93503723e1939b5f3fa49c92617341d7f90ca5206c5984b497b6a907f94b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576287, "uuid": "4b0078a3-73f6-4316-aaac-1ea7c02a5838", "comment": "Malware payload", "value": "5b147474a64b3a03f15c2886d89bf457b527a650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697576287, "uuid": "891b2a2f-7b1c-4828-ad71-b53a145979a4", "comment": "Malware payload", "value": "bb765473c6ada59bb6294eb9994b7332ff264e5d180c139f506caebd13ad1d1246e8f0cac7249b27dee2a3e7397a4af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576287, "uuid": "5fe9ec6b-568b-456e-88f7-f045248e35d1", "value": "T144352366B0D85436D9B527B008FA03E31F39BCD31CB8466F37409D5A1DB2685B9B532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576287, "uuid": "bfb9a492-ae0f-4f7b-bffe-69422a842181", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576287, "uuid": "e5d1e575-a4bc-4511-bda8-d2cba095711d", "value": "24576:jyUToFHe1QRTGgquoGqJX2uvrfdqg5ceG//1xyalOvRip45/Z+:2rFEQRTGgquoGqNxTBceGBOKUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697576287, "uuid": "c11bee63-8a7f-4654-bedf-f817dd34af32", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697576287, "uuid": "0864ec6b-d012-4764-9ccc-8e9dbf3909a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697576287, "uuid": "90cfab0f-9e75-4783-a4ce-e3df796bb116", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c989cb5c-6cc5-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697530724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530724, "uuid": "b447266b-c02c-4c2b-b0bb-2ce245cb6ab5", "comment": "Malware payload (SnakeKeylogger)", "value": "01a7162eb2da84efefb763bb32d7ee10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530724, "uuid": "5c629f6e-5e99-40ab-80f0-83c732ec1094", "comment": "Malware payload (SnakeKeylogger)", "value": "c93380dfdea6226e2c7dc68fcb69781e3a15bdda977e49c035991d0bf16bc16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530724, "uuid": "7154fd17-b7e9-42dc-ac3e-794bb0ed25b4", "comment": "Malware payload (SnakeKeylogger)", "value": "2fab8cdb212872c13d22746e9ae777e2c908b65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697530724, "uuid": "eda164a9-3085-4a3f-963a-c3480954d3fc", "comment": "Malware payload (SnakeKeylogger)", "value": "06117d8136df96cfc25f81fd9603c88fa21b23845abe79c96640e2a1a774228ef861f76ecfe68cf4e2c8055c07ecda31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530724, "uuid": "20fbbe78-9111-4eac-bcec-20239c07a861", "value": "T177552352A3D8D127D8B41BB012F70B534631BD92687997AF2353B84B2CB38A5653633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530724, "uuid": "9f38ef86-c892-404a-9c61-861566d712a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530724, "uuid": "a7571508-cf34-4749-8530-f37e05ec7f4e", "value": "24576:pyWSpEOHGwprOkcUtAdEJDZZkoe7N1j1uLerXdFX3/ATnbk:cWQvPaknfJz67jj1uS7dFH/AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697530724, "uuid": "7ca27319-d95e-47b1-bf55-7e7147e9afcd", "value": 1281024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697530724, "uuid": "13c9eaf5-63b2-4a0f-965e-9904f17d8068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697530724, "uuid": "f6223d95-9930-4896-a303-9730cf164012", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a00bd40-6c9f-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697514242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514242, "uuid": "9db724e8-3248-4447-b385-29db9e1c8413", "comment": "Malware payload (Smoke Loader)", "value": "be1b7e6ff501abe73e3495a17d9ae455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514242, "uuid": "bca1ae8f-9ac9-4505-b189-dc49dd3a8f26", "comment": "Malware payload (Smoke Loader)", "value": "c9c58a16b8b6717fea688d7e9d8e1aac6ef7cb3923928817afec54fc7cb3180a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514242, "uuid": "94a83eed-2e7e-4e2f-99df-95c366f0742b", "comment": "Malware payload (Smoke Loader)", "value": "2e5e5165c269a8553e6baefa9b6119dfaa5cd4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697514242, "uuid": "6ac002f0-b705-462e-abab-e50dc692f756", "comment": "Malware payload (Smoke Loader)", "value": "67b51ffd845abbf141584e8e9a5e8e8cb2d67c502151af91860c620bb30915d49d9fc08bf2e716660e7bef552ced3b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514242, "uuid": "1d1267b8-fe49-4a49-b993-d2b81b78add7", "value": "T16755230242E89131DCF96B704DF307832734BE628D394277A1B8AE6E5D736496532B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514242, "uuid": "31c823df-7af7-429c-9750-0dfe33d58b4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514242, "uuid": "28b48193-4d0a-4568-8a63-c549e6a6c2a6", "value": "24576:4yqPIBhUNr/us1TP3FgGIrls437kFasKjpPyUdxZ3HZC7NpoCW7RArr4x63NK1J:/SmkKwrIrlRlRHMniU4x69y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697514242, "uuid": "91d507af-54e3-4d29-8712-b9c6a84d40d0", "value": 1330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697514242, "uuid": "884c8bef-3a18-46e3-9671-7fcf3f2225dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697514242, "uuid": "3c61b1de-22ac-49e8-b7aa-0d340f7a2048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a211ba-6cae-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697520622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520622, "uuid": "f39c96fa-4529-43a1-8064-db7fec4deedb", "comment": "Malware payload (SnakeKeylogger)", "value": "e42156fff1c2d0a5ecb0d9f61b4cc97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520622, "uuid": "fabe137f-a9f5-49b9-99a1-efed6331bae4", "comment": "Malware payload (SnakeKeylogger)", "value": "cbc89edf3aa7a92b0421b1bb97f4dcc22197ddea97717f0fac9660064e674f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520622, "uuid": "edc9e729-56d8-4320-a89f-911c5f922da7", "comment": "Malware payload (SnakeKeylogger)", "value": "ffd8dadf37b197e816199f3997bdb688bba63393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697520622, "uuid": "a22529b7-9147-4dbe-a752-d7b6aee6039d", "comment": "Malware payload (SnakeKeylogger)", "value": "b1f199d58bb6fc6a1b22ff61e49a34a6d97415e56fbaca91bc783e81946799b99616e1a9fdbc0032b53a170eb44cee94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520622, "uuid": "70008a17-6442-4fc8-8cdb-26b48cc92fbb", "value": "T110C41210F7FCC78FE8A663FA116225001BBC76E6A90FDBC80E5630CB891EB51495975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520622, "uuid": "dac7f868-762d-4752-ad89-3858b14df229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520622, "uuid": "f59f8af0-cf45-4d29-b3ee-dc7a209aa523", "value": "12288:FBLXmsrJM1/hBz1uYizyLcJqaRehjknnjww3VBQu97GnI:PLWiM1htNqodjknZVdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697520622, "uuid": "411671d5-cd0a-46c8-aa74-29280a964c9d", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697520622, "uuid": "109874f2-f712-4579-8b81-f5af2299d715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697520622, "uuid": "78813227-f9ac-4feb-8c46-94503e724b5b", "value": "SecuriteInfo.com.Win32.PWSX-gen.29085.4612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0bef4c-6cdd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697541113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541113, "uuid": "0b625b29-a901-4af7-9c88-a7d6918191d9", "comment": "Malware payload (Mirai)", "value": "30869699cd9079990e701bc28a2ecaf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541113, "uuid": "3f2ee6f7-b97c-425e-acec-9758a8aa232c", "comment": "Malware payload (Mirai)", "value": "cc57b126509818fa35a5a79b7c4bb90b36d56bc9ad2721f40643122831a55448", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541113, "uuid": "c9a13e0b-7300-45a2-b611-3783b3bf4e64", "comment": "Malware payload (Mirai)", "value": "65dcbd777b5a6fc9d89f348319c5379c19b00c9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541113, "uuid": "f05b7abe-4e98-41cf-afaf-691929cb58f8", "comment": "Malware payload (Mirai)", "value": "7390301029e81e595891c583ce5f76cc20b24f88d0c6eb6e8da840d0aa49ae96a7227c948ca906a4f2aa120a2a93d596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541113, "uuid": "1ee556c8-21eb-44f5-8ffe-9d5a3ae6068d", "value": "T130E329DBF800DEFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541113, "uuid": "1d8e87cd-8590-4b60-85d9-1ed0f787013b", "value": "3072:RhRsZethrvKj/mCn9DA1wMlmvVrjbi1Lv16Ksy+O57O:RvsNbnxAllmQLv1Qy+U7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697541113, "uuid": "112a8aff-baea-4826-af58-6b6752d0bb32", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697541113, "uuid": "9e9e9556-4447-49c5-a6c9-1bff03ae8d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541113, "uuid": "dae1dff0-b4f4-43ee-8515-486501ee02ab", "value": "30869699cd9079990e701bc28a2ecaf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b812ae-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697545939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545939, "uuid": "a4c54bdf-40fa-478b-bd23-961afbbb1a17", "comment": "Malware payload", "value": "fa8f1b36a9950443804a6892d22f9307", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545939, "uuid": "fda5fcda-b127-474d-acd0-67b93375e0bf", "comment": "Malware payload", "value": "ccb646b55a9ab2a9080d1160e44a5e9d54d069ec1b4ac8ea2349a45a0d85799c", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545939, "uuid": "6a5a1463-4367-459d-909d-a9d08d9e3df5", "comment": "Malware payload", "value": "f389ac8c518f842fe251e9b78008ad5c58664090", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545939, "uuid": "a8c04287-57fc-4377-b0d0-d646f18dfe75", "comment": "Malware payload", "value": "32cbdcbe53b9159927e9f57cf7a7382bc5312b0973b2b91bc4410ba8b777e11b9285d8809767b9ab34ba092063cb8b2a", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545939, "uuid": "2c590625-cb4c-41a5-8add-4bbe178d9375", "value": "T1C6B423E762B0E908DA7D878ED9CD294D843CEF6408DF642D2DCE4F04FC75E286A52619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545939, "uuid": "75c30fb3-0e8d-4a5c-b863-e54076b88c79", "value": "12288:gfPJush4A0ZiQGdzEBSwvkXrLo6k3zlLCfV0u:goEQ8okvAlWfV0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545939, "uuid": "03cb8f86-6406-41ef-a35a-dd6390cbdd1b", "value": 509703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545939, "uuid": "d39c0bf9-e70a-4214-85f5-c9e8c0a28c13", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545939, "uuid": "2941a438-b5c7-4a4a-b925-0a8a073686cc", "value": "08A347B6-6FB3-4B5E-9A49-9EC1E49DF8F1.pdf_1.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4abaa3-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697523244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523244, "uuid": "2f0358e5-d1fe-46da-993e-81c844823a63", "comment": "Malware payload (SnakeKeylogger)", "value": "2646f36c014d4f64fc466dd76f4b5c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523244, "uuid": "43758be1-cb18-4487-84ff-26ba89216ac1", "comment": "Malware payload (SnakeKeylogger)", "value": "cd35f2049e2d52ad861549173a06f04df54a67ab7b7411ef5af51320de45039d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523244, "uuid": "863eff60-19c4-486c-ab5d-1c8b7bdd4076", "comment": "Malware payload (SnakeKeylogger)", "value": "82b128585b00bd33e916c5d3b2461ad8096ae3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523244, "uuid": "add43361-9389-4fc5-b064-06b30ac37e79", "comment": "Malware payload (SnakeKeylogger)", "value": "67595882c1fcf5eb049beb44ae2926882065c97e335b71ae4ddfdf143b5062baf9a3424dbd393bc7da61476092f5dc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523244, "uuid": "28acafd4-c940-4855-a85e-82aa9ebc393d", "value": "T16FC4128576FDDB1EE72F97FF5951400053B9B29201ABEB891A8320CF491BB018EAD717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523244, "uuid": "6b2a51b0-3c26-4a0a-9d10-2adea3132134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523244, "uuid": "0258d666-99cc-4d79-a8f9-1ba065186b98", "value": "12288:kBLXmsrJM12jMvEJQpCztZsu/K1YfiL8Q+WtyMpq0N:kLWiMcjMMwCztZy1YfTQ5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523244, "uuid": "a36a2ad7-a73c-4235-af8c-162b40a46b90", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523244, "uuid": "be4111ff-3a49-4db4-9172-ac6c181f7adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523244, "uuid": "57a70e85-9cd8-4a54-be49-47c3f079a93d", "value": "Quo101023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9344821-6ce4-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697544118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544118, "uuid": "c354b5e9-bd00-4fcf-b0a0-8dcacc49147a", "comment": "Malware payload (Smoke Loader)", "value": "a8faa2a9fdd99e2407c9d28390bcbb0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544118, "uuid": "c1267971-104d-4127-8282-b7ed380ef788", "comment": "Malware payload (Smoke Loader)", "value": "cd63d1d38684f9a7f5d7f86722e24281d3d88099e01f13db5f3fdf51aa974d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544118, "uuid": "f515097a-8f8b-49cc-bb83-818bc0f22f2b", "comment": "Malware payload (Smoke Loader)", "value": "502553f7dc7a4cb332289e882b3704c9e2815ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544118, "uuid": "b3d64070-b332-4d6d-9a87-49caff41343a", "comment": "Malware payload (Smoke Loader)", "value": "e031f24a405cf3eda3869ae01762dc8fa729e678b373be1b75868f626556734de4611e1c8abc3ef646247b4b18c33d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544118, "uuid": "d6ce0743-5569-4417-93ae-7f4cd9d0a6bf", "value": "T1C84523439DD8C832D9B73BB019F20383163ABDE98C7187175A9255EB4C72AE5943237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544118, "uuid": "e8f8412c-16d2-49b7-ab2b-8a84517a2caf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544118, "uuid": "94540b17-e39b-4ac6-9eed-732faea058d8", "value": "24576:eydgy+Rr+AGKOIEh1drMlX/Ncd9QIA/EIIwvlXERn9YfWW0kbO:tdgy+RrZG2aMN/r/ndsn9YfWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544118, "uuid": "51b26aef-67b0-47a4-a4d3-2b411d82fca4", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544118, "uuid": "48226822-5a02-4748-ac94-4fd097ddaa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544118, "uuid": "a4323d64-d17b-42c0-a8d4-f30beba324cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f59c619-6c86-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697503433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503433, "uuid": "b176007c-d44c-4484-a38c-e6f14037df7d", "comment": "Malware payload (Smoke Loader)", "value": "7983ace0764b3928cd54ad7dba92e8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503433, "uuid": "4007e7b2-1b8b-462f-92fb-5703e6575d27", "comment": "Malware payload (Smoke Loader)", "value": "cdaf288ce9ac84590ad0699363a51c97c155d4d5a96f19c0c6150df6f77540f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503433, "uuid": "ba1bfb31-f835-4332-a850-59534c500943", "comment": "Malware payload (Smoke Loader)", "value": "04108af6442c23417ee2a4398152e179889d5a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697503433, "uuid": "41fa36f7-c35d-4518-a573-4043696a5eb8", "comment": "Malware payload (Smoke Loader)", "value": "fafab45a721f1c6dc04f2143df2d55efa59c81600056e24e132de919457bacb4b0a3aea95dccf92a18c9de29e3b43f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503433, "uuid": "075bbdbb-9efa-4921-91fb-8559943d107a", "value": "T1323523766EF81172FCB1277108E642832F26BEE15CBD47672300D98E1DB2984E5B6736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503433, "uuid": "06b5725b-6dc2-42f1-8e16-cbf518d7cc86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503433, "uuid": "796de561-a40d-4cf3-ae2d-3331b1b4229f", "value": "24576:oyKmfzxzwcgwpcuwpRSD6zaCFaAnR0miu:vKmi52cjzaC4AG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697503433, "uuid": "9b4036b6-5eb5-41b5-8599-9be94f2398b3", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697503433, "uuid": "35ab40e7-c9e1-4392-a940-d2add1091f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697503433, "uuid": "d2d76117-c840-43f4-8c09-d81b109256ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c624fae3-6cfb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697553911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "fad4ff67-e8e6-44d3-b496-4fbbe5382bf0", "comment": "Malware payload", "value": "0dd5150067e4eb01f6397d7c97570528", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "62a16813-1ffe-4b68-b2ae-97410b497056", "comment": "Malware payload", "value": "ce0765fa670982dce7667ca3db07b5daaa092ff4a145ed7956bc384ad2492a06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "ff603e06-defe-4620-b952-fe0d2aaceb93", "comment": "Malware payload", "value": "2ac83d11a878974f85d846b88181acb487ed1b2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553911, "uuid": "17f5ca7a-33d3-41c5-992e-ab2dbf8372b8", "comment": "Malware payload", "value": "e5129f7f3aa3f4da60abaa93c1e7024fa8add691bd587fc131e769ac4a3be566cc90a9be8f6ee9073d6374533bdcdb25", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "6eb3d5bf-ceb7-44d5-af26-984410c10b78", "value": "T149831273372AAD64E1423019721C581FDD415F053C19C9BDF7AABBA0ABF49B70D27406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "0297ab00-dc7b-424c-a428-5073e896323f", "value": "1536:LPS+f6X6aJU/m/WV9a9s69RzOx4I4SOsP9xjMAsUWncwnvfcy9FV6pjJl3E1CPZ:LNencm/Wa9s69RziH4Gi1vf3FVKJlvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553911, "uuid": "3a57e9d2-8ae6-44e0-8d9b-ae26d23193b9", "value": 85272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553911, "uuid": "3f99ab86-d789-4127-88d7-1085e763b827", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553911, "uuid": "408dee8e-defb-443e-bad6-4b78f6db24d7", "value": "kni.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b8e3cc-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697539706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539706, "uuid": "2062d6fd-8fcc-46f8-bc16-f38d2e55e12f", "comment": "Malware payload (GuLoader)", "value": "70aad0715756d3db67a125f75bb592e0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539706, "uuid": "8e3565fa-f141-48d1-820d-4324f2fad906", "comment": "Malware payload (GuLoader)", "value": "cec79efdafd3631063553ec94e7705a2daef9422b05db00ca657464ada7594a7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539706, "uuid": "2d83f23f-36ce-4e6a-a566-4be88cf958ae", "comment": "Malware payload (GuLoader)", "value": "5fc764a149e8fccabf847f68f91e808f743be8f6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539706, "uuid": "dc98214a-8004-480e-8d39-c9f9119b3b4f", "comment": "Malware payload (GuLoader)", "value": "ec8de4ced47e67045320a78c4bac3551c1f42de30372c46950f2ea12b2d0269efb15d3dae855b731f0ce44bf390547cb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539706, "uuid": "ef6b4d3c-e3ea-467c-bcc1-618a020277d8", "value": "T19F8228A6CF1219094A5703F69B8AC636E56108FB71308537BC4DF6D86B177087AADE0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539706, "uuid": "e3c52fa1-8496-4fc4-aa5b-56ddabbab276", "value": "384:GTuYbTY5hgtnFrtveYWXgsWwAtbMlkGCdg+X7FWh3RuL/oRBA9dv5KqZeULAV:MuYb+YRvRT1ECdNrFWJr34hKqAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539706, "uuid": "d5c99ecd-cedc-49d4-9627-df2a040eb4d2", "value": 18691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539706, "uuid": "88a7cb6a-f4d9-4a77-9b0c-07e1f773b7b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539706, "uuid": "9131428c-6026-4e67-aa6b-f156daf83b52", "value": "Scan_October_17th_Print_Request.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169db1b3-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697539872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539872, "uuid": "d085df5b-f4b5-4f03-b07c-58dc4d428948", "comment": "Malware payload", "value": "baf15279ad83101726972879ee900873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539872, "uuid": "61baa7c5-272f-4813-b84d-9caeedf69d34", "comment": "Malware payload", "value": "cf079851e9a6655cd8cbcc53142b96e7b3b02b57cce859023bde447a1c01fc76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539872, "uuid": "fc6afd23-b463-44a5-87ca-30589b121f18", "comment": "Malware payload", "value": "7371d47e2d3b406fb7e333eba042cc94a01ed818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539872, "uuid": "dc3f1dc7-4e49-458f-97d1-6b2cf2ba0a53", "comment": "Malware payload", "value": "05634d3cfea3f9b6c3556a5a00124f2a43fe0292654d0284b3bbde566168bd63f821f98c0802d6ca8fa7be49792ea1db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539872, "uuid": "8ff4dc53-0eb7-4894-a78c-57b7a8a5eb84", "value": "T19664BE83B8E4D030EA79C43145417A21DA3DE7272F24AF53465F4BF31B64BD28A65CBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539872, "uuid": "3f03b46c-61b6-49df-b03f-bb7ea17e36b9", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539872, "uuid": "226002fc-c322-4e1f-96c8-988bb8bbb003", "value": "6144:7+K3l99cV4EvoDQYWhYmh+oP7XavubpF/1hcNQdqxnd:yK199lqWmHPDavipF/1qN8qxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539872, "uuid": "e76c7f26-5051-400a-a887-4cb35b996e86", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539872, "uuid": "ae594d12-d808-4e33-89f5-f97ed6c060be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539872, "uuid": "3e96dd24-0398-484c-8b51-a956e9415ed6", "value": "baf15279ad83101726972879ee900873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b127f6-6d3f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697583003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583003, "uuid": "083bffe9-56e1-4732-9e48-c9a58da47b8d", "comment": "Malware payload (Mirai)", "value": "bb7f752f994e2d75e0a414076fe972c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583003, "uuid": "a73fc823-fa3e-44f2-8d6a-7288a2668ca9", "comment": "Malware payload (Mirai)", "value": "cf082cc7fee845a33a90f42a64609b7dea3ebfb948355107aa8a6714685cddb3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583003, "uuid": "26e97636-5a28-4ea3-8445-283a3a6c9c61", "comment": "Malware payload (Mirai)", "value": "e34b24557ab8484cf514a9d6a1486df61a1ef998", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697583003, "uuid": "ed9933ed-e03b-4eeb-968e-3711c268edb6", "comment": "Malware payload (Mirai)", "value": "a43109ea760cc14809289c95ccf1aede7d20f4430d7a518f6dff81a37d94cafa01693b28f87c343afdfa6bc6663dfd05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583003, "uuid": "e09c9d12-7ec8-4a9e-a3fb-91d1e8247ea7", "value": "T19323F158D8432443A26B8C33FA1E4643D9ED27F8F4DEB5F98D5AC038AE4744E29E40B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583003, "uuid": "d81cef15-d817-4ab5-b349-96f49519c149", "value": "768:YD7GBFUknSwt0CG06gucVLrWRoQyCS/Z3DX57z81q3UI9W63gQz1ox6sm/1p/Lk:YDqmkSK0lr6L5F3FzNU65Wx6T/jjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697583003, "uuid": "d1641679-07ab-4bfa-a8b4-d4a61c02a7aa", "value": 48380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697583003, "uuid": "524242da-6cb8-48bf-ad98-0782e63acae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697583003, "uuid": "0d6f387f-03a9-4c9e-98a0-d60ddfa47484", "value": "Eros.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14b49c7-6d25-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697571915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571915, "uuid": "2a219e47-6173-4267-a918-bb07eebaf29a", "comment": "Malware payload (RedLineStealer)", "value": "a69cec565846beac7317edcac74f6579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571915, "uuid": "5169d212-fec1-4ee0-9a5d-cace0576f832", "comment": "Malware payload (RedLineStealer)", "value": "d0321327c8d78051e8bb218bd466cc790c4eb9144e71ad69535b14e02fe58756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571915, "uuid": "9b84408a-3ca9-462d-b906-f01b5d5b37d3", "comment": "Malware payload (RedLineStealer)", "value": "81b1e68593a2fee1ae99dc2d64c944cedc276725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571915, "uuid": "9990ce88-eee8-4a0d-8187-7a3a6bb578c3", "comment": "Malware payload (RedLineStealer)", "value": "0296eeefe3bd49ec6e94ba62409b1712b1913cf85e4ff353a3c524905202b61854d6d6f57721037e4e3be250faa6a6ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571915, "uuid": "1d15a3d9-1e69-40df-8669-dabd0c73911f", "value": "T1CC257D2138C08135EEF310F647EDFA3642ADD4B0071916DB56D85BEFE6206D2BB32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571915, "uuid": "31c5d058-0281-4055-bd21-0d276f93bc1b", "value": "9b0aa150c770a62666d246af48611e04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571915, "uuid": "0abc69d7-73c5-4dff-b35e-96113de018a1", "value": "12288:9B0NTrnmypsxYaKxgPo65N4foZxq/WiQ2hoVftPE4R+Hut8hlBRe71Orfz93:9wpsxYaKxgPoCNIWiQ5hSJb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697571915, "uuid": "ac53c00c-21f3-4d01-abc7-f541b3eb0d3b", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697571915, "uuid": "7f18fdc1-48f3-4f5b-bb08-dfa253daad99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571915, "uuid": "fcda9aa9-b8d2-4e26-aa92-30165390f230", "value": "a69cec565846beac7317edcac74f6579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2a99eb-6cab-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697519429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519429, "uuid": "4155cad0-87d1-4b91-af9d-a6a13c0e1089", "comment": "Malware payload (Amadey)", "value": "c8c52a6b8a8df00920bccb3c6f2c6738", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519429, "uuid": "9d108149-ae35-4c71-9e00-72b8ede79fa9", "comment": "Malware payload (Amadey)", "value": "d069d2f8f290c5b72ea64c297bd1257890066924f241dddbf45e66d6d15fb449", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519429, "uuid": "570e5478-3d4c-4e66-99e2-d3ad0995d49e", "comment": "Malware payload (Amadey)", "value": "696b881bbb6c6ae7ce7eff66b31c8cc7ced3c3b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697519429, "uuid": "beec0c70-346c-4aea-a9b7-dda145fb64ee", "comment": "Malware payload (Amadey)", "value": "640546d2f5d332ee1e4eceeca2eaa4a7200a38249c437753650cc8283f7b067c81ad1b27511d06f42d606d23fc0d0665", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519429, "uuid": "35e9b896-5f32-45c0-b969-f3a32c0336ac", "value": "T150343A53D2E13D98E9264B728F2EC6E87A0DF6518F4A7765361CBA1F04B1072D1A3F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519429, "uuid": "c399362d-140f-4caf-a8df-f9f3f96fa5ba", "value": "305c32ee7516131cef129ed3db842454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519429, "uuid": "71807f23-78da-4219-887a-5c94b5813555", "value": "1536:dSGw03s4gkacUrL5vrRQl+NDaXd+7I1+q6DjICMeDa4Yhyd5uRqSYNsv9uInav+2:d3q9LbQiWAdDN+4J4m2kdm5W4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697519429, "uuid": "9ce7b489-fc84-40d9-ac79-0da89bee5ed0", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697519429, "uuid": "4be22d41-d956-4ff5-8f04-4a4052582bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697519429, "uuid": "8a753cec-0025-4145-aab5-46424dd87452", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f72453-6cbc-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697526552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526552, "uuid": "65afd49c-9250-428c-835b-2d38dca9a3d4", "comment": "Malware payload (Smoke Loader)", "value": "67b95bc93f413c9b25ae71bf960f417f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526552, "uuid": "0ab93765-d3a3-4ad9-bccc-8e71f3b1c94e", "comment": "Malware payload (Smoke Loader)", "value": "d173b56cc37d26af7e2990037313a11d3811d90e4386ce2a957aef74840286f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526552, "uuid": "cb1dca51-3326-42b5-a7f1-82d416848e6c", "comment": "Malware payload (Smoke Loader)", "value": "1b12bb1567fe271be0c7058c433246411060414a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526552, "uuid": "536eac39-39ca-477c-a4bd-e39a0efedd25", "comment": "Malware payload (Smoke Loader)", "value": "6c5e7706c0448f827910986a4ef1b8364a1a491e994506ae57cd78dccbcf48a66f1ec86e568f6d855790242960bc8ade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526552, "uuid": "6b12903a-fc88-428b-9e74-a30136c749fb", "value": "T1F155231392D480B3E4F9273058EF03C74A2AFDF16A64D75B678295892C72A81BD7137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526552, "uuid": "df2a074b-d631-4c22-9def-1d4a1d7dc41f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526552, "uuid": "f3b214ac-f774-43f0-87b0-5b032798dd3e", "value": "24576:3yDZPsn1qYrcd/SpTIbO/eHCDqqnaFr+Nq+xOHJw7sudOGMSWgofglCNgn:C9E1qY+/IIbOVDqqnaFYcJw7su8GMkow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697526552, "uuid": "6c2953c0-ef2e-4e20-9bec-cbd0afc66519", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697526552, "uuid": "26a9e0ed-dc14-470d-ae1a-0b9355ceef11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526552, "uuid": "dc4e2a23-f7c6-4cf3-98ed-6dab6c8d067c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227f198f-6d09-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697559649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697559649, "uuid": "cd48af9b-0a99-4f61-aa43-bb32f01ba9ae", "comment": "Malware payload (Amadey)", "value": "e17008af865088a22ef9e081545466ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697559649, "uuid": "b81f7dd8-66ec-4460-b41d-0891e45c3538", "comment": "Malware payload (Amadey)", "value": "d1ef9cd10ac3659aa976acefef29b35ed97840f4eb0ce5d3c48292013322ac0d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697559649, "uuid": "9cb7d3d6-10c6-473e-9b3c-d5e08a133dfb", "comment": "Malware payload (Amadey)", "value": "d810eb85ebb9671d55fcb20747db585cb6a35e1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697559649, "uuid": "51921296-d033-4f0b-b90f-889034f7d9f2", "comment": "Malware payload (Amadey)", "value": "12eb88eb5a3d6f085455210dee7d3c79da90cdf870f69ad378f5666784c3ead4271aa063a7195c242ba58b88f55ced44", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697559649, "uuid": "3c4fa6e2-028e-46c2-acf7-6ea72b0a89f8", "value": "T1F9252242FBE84572C9B41B7058F703935A36FDA28D344307778AE91E0973AA49935B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697559649, "uuid": "a1d48aef-3b30-4314-8193-1f55b52aad5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697559649, "uuid": "45ab5ef9-9f71-4560-bd38-bbf2dbdadf11", "value": "24576:1yHeBEz6EBh4GM/c+lXC+s/0TBhaoeHzK65Y:Q+Sj6H/cyDosLadHzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697559649, "uuid": "ecb6e7b2-6fb1-4b01-8dd6-40353bf10d80", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697559649, "uuid": "f545dad5-0588-4984-b1cf-70aacf1fc542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697559649, "uuid": "619c6d90-3029-48d9-86b3-04373fb0fc56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837a66b0-6cd8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697538766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538766, "uuid": "f9e1e0bd-0d48-4e6e-a674-badf52db062c", "comment": "Malware payload (AgentTesla)", "value": "83601b8dcb111ff09bf97c29236a30d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538766, "uuid": "39a5b654-9251-4441-b36c-a8eed2d05184", "comment": "Malware payload (AgentTesla)", "value": "d2385aabbc2749063ca10bfcaff327062178dbb3da9eeeafef8eb0d479d06ba9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538766, "uuid": "9c7c4ee1-5940-4d36-80bf-ec70e22e0f97", "comment": "Malware payload (AgentTesla)", "value": "95633d7faf5eb8c18a08fe3618fb0c1959e8528f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538766, "uuid": "9488151d-624a-46fc-9ada-1c7ca2bc2d2b", "comment": "Malware payload (AgentTesla)", "value": "c4de59906826d779cbeb6313ea52737f2666e83eed3db7e39b803eb007a8d1c1438609d647c3984f7492ce11eb278f65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538766, "uuid": "e8b5f1f4-e9ae-4343-a193-0b9125a09457", "value": "T108F46B0675795971CD44DB35C9EA894482A7DE446BE2E2192CCCB2DE0B337BE4F03E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538766, "uuid": "48906722-ea52-4aad-99fa-dc0382246fe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538766, "uuid": "8766645b-9862-480a-b22d-cea0e7976278", "value": "12288:OR3EPwvAOuHw87aruEsQ1mCtJsm02qE/wd2+I:s3EPoZuHRaiEJ1meNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538766, "uuid": "78c6e02f-79f1-49fe-9acd-15357eb9d5eb", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538766, "uuid": "7163d101-d70c-45c5-9103-d9e516033235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538766, "uuid": "34c2df2c-9dc0-4044-bc88-32917af3b2ae", "value": "SecuriteInfo.com.Win32.RATX-gen.10114.13981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1310974-6cd9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697539246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539246, "uuid": "10ecb4b4-0fdd-4da5-adf1-da36ded1c45f", "comment": "Malware payload", "value": "9d38c0300873c2828cd736b5cb29fb12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539246, "uuid": "f62574e5-0b85-4eaf-868f-d6eb0568f0df", "comment": "Malware payload", "value": "d239d8926ec09c499b6cce0d0b90c23547bd63c8d514b6ffb0ce86eefe97310f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539246, "uuid": "b9c520a2-576d-4a9d-b311-ec18d7eb951e", "comment": "Malware payload", "value": "5ddb8aeb47b8bddbdb41cf8fce4dd0168f3a012e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539246, "uuid": "879631f5-d676-4da8-80d8-804318ae9615", "comment": "Malware payload", "value": "9ff93a944a05bcf0118586a6ac56c4bfd6747e9c538a8d2cbdb61a325d2623770a88d9ae94c5cfda8d5d512b7614328f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539246, "uuid": "5dfb78e7-b300-4b3c-89d0-c8045fac4db9", "value": "T19195A37C7A4A1C72DF8E8BF187E58A087B64C8526711E5DA254067CB7A1D3C3AB4D383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539246, "uuid": "8e7c35bd-da63-4429-9b21-ce3dc2921fb3", "value": "49152:P+i/lLTbSx7Mn7eFVyUvynl76eIf+E5ksiJ9fQN4Utf8pOFOT3NY0UJCo+LYJdx/:Re1l5V7WJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539246, "uuid": "d483b569-196c-4c22-8e5b-b2bdffe14cf1", "value": 1975296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539246, "uuid": "1a718b86-237c-4b61-96a8-099d874c11ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539246, "uuid": "8b056866-2f99-4979-aae1-088d907b78ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c145d7e6-6d1e-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1697568935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568935, "uuid": "dc0d8888-f7ac-4207-9d7e-d09f4a95a3cc", "comment": "Malware payload (NanoCore)", "value": "23ee6fc8b90d6619cc22f1f5577fa5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568935, "uuid": "495906c3-b5eb-4002-a195-095b24607f99", "comment": "Malware payload (NanoCore)", "value": "d24e8e1b9e5cdc40797bfc894bb086d455a679f5fee5a2a03c438e4dce141265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568935, "uuid": "55978272-438b-4efe-98a2-291399649eaf", "comment": "Malware payload (NanoCore)", "value": "41691753d54811793876d64bb7bc6628b6031ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568935, "uuid": "53c6417e-6e5a-4e9f-9584-d97cd8b5d890", "comment": "Malware payload (NanoCore)", "value": "83753fca543c30df499747b7ec87ec87e114fc3525f68853585d3dd81ac474cf45f38c713ff7624269f9c70337a40822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568935, "uuid": "2d11d50c-6807-4193-a3d6-163b8b055e42", "value": "T12425022C0CF809124161E19EDFD8EA57B2C08CD6664C9DA687C68F995A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568935, "uuid": "933d7303-fc47-462b-9751-e8285d05277c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568935, "uuid": "d625b124-3207-4658-9d24-3a7d5e6070da", "value": "12288:B8R9FeePVl8qP2nY7eClzNLsNuHBDCnGjlrUeL:yRyoVWqP2gh/LsNuHFCGtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568935, "uuid": "187d612a-9ba0-4c82-98b3-4db696ce98ad", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568935, "uuid": "a4af6835-f2b9-4638-aa92-0b2382368344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568935, "uuid": "9cb068f4-3e8e-41dc-a32c-b0792c68a45f", "value": "23EE6FC8B90D6619CC22F1F5577FA5ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6eca51-6cbe-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697527804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697527804, "uuid": "65b3ec20-7807-45b7-839e-dd8489ff1fd2", "comment": "Malware payload (Smoke Loader)", "value": "a831b78dbc453c8f543ffdb5e77121d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697527804, "uuid": "80ca3a12-2210-410a-9cd5-de6341ae42aa", "comment": "Malware payload (Smoke Loader)", "value": "d2a086b5dae7e9da84b9aad1a5394de531a75e1246daf2fdad7710479a7bbec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697527804, "uuid": "ce2b715d-44f1-4190-8eae-b292df052293", "comment": "Malware payload (Smoke Loader)", "value": "93bff69d920744fd4904f5eb236ee34b109679f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697527804, "uuid": "a7e2144a-765e-4ac9-9b4b-dd7ce9702073", "comment": "Malware payload (Smoke Loader)", "value": "b2d65415e5daeb594b297d3dd30510fcf90a47d3073f62300d72835d4eaa93b3db12de638259b65324aa33f9a9235448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697527804, "uuid": "1c75e38e-160e-430f-8c85-607db2a66077", "value": "T11C552312A7E59923DCB227B068FB074717367D909C38E716234A940F5D73994BA3237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697527804, "uuid": "f3a41a10-1ed0-4f86-a1db-20f8ee4dc3e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697527804, "uuid": "44fc6dac-a9c9-42a7-b8b3-7b631b7b65c9", "value": "24576:hyF4G0ylrwhMtY/g3/JtPaqA+21+7IZsJBSlg89cRJNx3TZHiLn:U30ylrttJ/5T7ICJ4lg8wRlCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697527804, "uuid": "6c8ab56c-037a-4567-95f2-30fbab86a99e", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697527804, "uuid": "2950e481-505e-45a0-accf-114d87344fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697527804, "uuid": "5933a7fd-631e-4352-8a3f-cc69726fd17b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d766cc8-6cb8-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697524905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524905, "uuid": "9bc44273-166f-4c22-8547-a6c4dfd8267f", "comment": "Malware payload (Mirai)", "value": "8be8e0fef033c0969938a3b1c0f454ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524905, "uuid": "90c1fe2d-a005-41b7-b354-507717aae79b", "comment": "Malware payload (Mirai)", "value": "d3b78dd1cb9efe0739dc521cfa67c95a06d424eeef7b6d8732eee4fbdced0e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524905, "uuid": "6c357f81-6c17-4574-958d-a693ef65cc8f", "comment": "Malware payload (Mirai)", "value": "ed566b8c074adca883ae1ab42d9d35c6d95df73e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524905, "uuid": "77ee177f-8b59-4f3b-936e-95173766bb43", "comment": "Malware payload (Mirai)", "value": "6588ec10f34b5691489b4ca72ca6f606cfa820b22b0aa38dcc6c9d0f9bba678d28821e32366484aecc4059bb8d0f7616", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524905, "uuid": "87885bba-44b1-4e91-b46e-c57660dcf8d5", "value": "T121B35A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524905, "uuid": "635f140d-6278-4765-9c7a-72bec0125f9e", "value": "1536:1a97/6/q0AmnC2gL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/z5:1y6HC2gZn+MCISxPKO8WL7t4Lb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524905, "uuid": "dc8b9dd9-1db8-4a54-9ba2-403f40aee60b", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524905, "uuid": "68ed542d-4ef3-40d1-9539-72f60aa10228", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524905, "uuid": "75a75039-c435-4c0e-b929-8f6eafeb08cb", "value": "8be8e0fef033c0969938a3b1c0f454ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82327b9-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538398, "uuid": "a3e98848-aa26-4378-aa02-9e08dd90d97b", "comment": "Malware payload (Mirai)", "value": "570be788a1ab4be1397171e1dd25d759", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538398, "uuid": "3a83e2ac-22fa-4726-b290-ebf431bd9b05", "comment": "Malware payload (Mirai)", "value": "d3f02b1ca3307852c033970596972b009b22e6351e42e9ab42856a1c790cd351", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538398, "uuid": "02ce7b0d-bd82-4aca-ac21-1dbb626b7c5d", "comment": "Malware payload (Mirai)", "value": "03ef1daaad6c80442b48dd13972b99e1cd4791f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538398, "uuid": "d8dedd31-6797-4476-8ee8-0f8ef852257a", "comment": "Malware payload (Mirai)", "value": "9870606cfc0d7955c6f83723d054580c05e44649bf0e207badad7f3280a4acf53d6f7b11a55570f3352746298905bbaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538398, "uuid": "6f074c33-3e73-425d-80c0-59cae6480018", "value": "T12C042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538398, "uuid": "76c3752e-e6c1-464a-8055-593b924ed5f6", "value": "3072:HK/lcENbBLbcBCkoajwdyqkk4/T/6EBpGu/hJjogM/RHWT+M:HK/pBLbEloajwdybkwRBEu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538398, "uuid": "c6cd03bf-7766-446e-a5b9-bff13f99abf5", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538398, "uuid": "f3f43c48-d829-42c9-b09d-03e23aa862b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538398, "uuid": "e74371b1-3ff0-446e-b598-71510d2e82d6", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643050a9-6cc8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697531842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531842, "uuid": "861cc010-c215-4a4f-baa7-f93ab6708828", "comment": "Malware payload (AgentTesla)", "value": "59a24c169235efa222e4920d39066e98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531842, "uuid": "dac2bc81-96af-42ca-83c1-1edff77d9519", "comment": "Malware payload (AgentTesla)", "value": "d4cabc1d20558dfd4f17b628730152e939056cc03ef5b2c11059de46e2ce1261", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531842, "uuid": "6694b037-ec95-420f-94c7-d535d67374ab", "comment": "Malware payload (AgentTesla)", "value": "7a6972f2e24b9fe5a4dfe76c42c52dbbc948bc9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697531842, "uuid": "b8516b0c-4355-4210-9801-770cd6ae2639", "comment": "Malware payload (AgentTesla)", "value": "b3d0cbff7453f3ce8c888013f34d19de08d6bcfbe09fe4aaefd223f197da1e3520192b668191dc95786791d6c87ab501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531842, "uuid": "11c8b549-de07-4fcc-8768-35b8a7e4496c", "value": "T1898423AED4A3B509E601159CB8BCC029315A270DD2DE9DEEAFF6C346F663C2647D2D00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531842, "uuid": "b83ba968-8145-45cd-abfb-39d6feb1648e", "value": "6144:ZC3VP4N5oiCVsgP0OPMv3a/T1Ok/j3oBpcyvNypnJbQEnuyTv:ZC3VP4DC2g8a0K/Tb3oncyvNAuyTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697531842, "uuid": "620e885c-2509-479c-b8f1-66e791e2ec84", "value": 373395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697531842, "uuid": "e09fd276-300f-4bb6-9ccb-057f0b832fda", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697531842, "uuid": "b5a118e9-710c-4215-8784-0d488900c08e", "value": "20231017_OCTQTRFA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7227eb90-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697523705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523705, "uuid": "18cd097e-b9a4-4e03-b3db-96f1996b2544", "comment": "Malware payload", "value": "d5a6ab76bb005a4e7f6f57b511e3d331", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523705, "uuid": "43dc9066-079c-4bd0-843d-f1a0c63b62d6", "comment": "Malware payload", "value": "d5bac99722ad9a33e97b7c377e4c3f46a4f20bc03c35b3016bd69183f2748d42", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523705, "uuid": "c8f90409-aaac-41fe-9eb7-4aaae5051941", "comment": "Malware payload", "value": "b92dbb8e7acc76045fd8784fbacf11988a526feb", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523705, "uuid": "634539c4-039b-4ff0-8314-8f79093546a6", "comment": "Malware payload", "value": "e509829fb7030bf32558ff3bd9e02d93e9c266acadde39d6c95ca64e5b471d5f0c9d92732d75b047b764ac9a629a0feb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523705, "uuid": "c1d8a198-2476-490c-9faa-6fd903c9002e", "value": "T10D854F01B522E626C39D91310C669AE537A6EC455A654BEF331833BF3FBBE548F462C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523705, "uuid": "92da37f0-6e43-4ad1-bede-1d9377596c8f", "value": "24576:Fj94vgpgFVUZ0uGPoKG/fM1IYn0FCF8lmLu1SMWQIJIulPVBI8lbIRIGlP5kZpl1:FL1oIYGeEwIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523705, "uuid": "d6ef33a2-1b90-4f74-ab6b-e9c5f7e790c2", "value": 1787392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523705, "uuid": "9dab4ef0-9a2b-41ee-99c4-405fb2921026", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523705, "uuid": "2aa26cf7-b745-4145-b6b5-0b09ff39e64e", "value": "VAT3_Return_XLS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62468482-6ccb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697533127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697533127, "uuid": "334cdaa6-12a4-45c7-ac34-87181e1eea21", "comment": "Malware payload (RedLineStealer)", "value": "42bd0da09316437fd0a46678ee00df52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697533127, "uuid": "55e7fdd2-2ebf-4719-90fc-2d1699c001eb", "comment": "Malware payload (RedLineStealer)", "value": "d66922b28048229f0d1700f944e7b94e282f99d838524e6a8f85f6bdee8c3424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697533127, "uuid": "4183305d-d579-4f9e-a5b2-acb9b65b6465", "comment": "Malware payload (RedLineStealer)", "value": "c1ed226a550d4f6f82f9759cbae41392122a68d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697533127, "uuid": "6b824bb3-4022-4a4e-9805-2f0140167a39", "comment": "Malware payload (RedLineStealer)", "value": "fb5eb987338ad85826cf3b6b843fb5fc0a25815e1d478f544b650ebb46be8b19fe2273fdd3986d2927eb65923371f511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697533127, "uuid": "019cf8d0-3c65-4beb-b136-8df79b36bd42", "value": "T1CB458D2038807DA5DDAF30BA8EECBB1C029DE9740B6B47C74B8517EF96142D26E33595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697533127, "uuid": "e6355c12-43a7-4ea5-ac24-7f01e6f323ef", "value": "871bf8c5bd762bfeb00a6e9197bdf650", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697533127, "uuid": "4394fb39-ab66-48b2-a366-5e3cf03229c2", "value": "24576:GZUJWFqMh4jlWYrCCd6XuCuEj2WOPb3QQ7fsMSq:GZWMh4jlrrxg7oPb3J4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697533127, "uuid": "405f265b-a59d-4227-bbec-9d4c87888fe3", "value": 1274368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697533127, "uuid": "a5174b90-5c97-421b-969b-c637bb1e5b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697533127, "uuid": "94f18526-4246-46d5-b9b8-ae875774d1d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ed5896-6cdb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697539838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539838, "uuid": "31b13378-beb0-4851-a478-07fa46d8bc23", "comment": "Malware payload", "value": "be26784b16e11dcb08784dbe65b4e0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539838, "uuid": "89f7f3dd-20ab-4063-87d2-d009b1faefb1", "comment": "Malware payload", "value": "d75fd74d31d11ba8c52bae4e3a7eb91f6532797e20afaa6eefe8c29f38bdba74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539838, "uuid": "d69ddd0a-7f59-4133-8b26-4ad402968802", "comment": "Malware payload", "value": "648216e8e5a1014bc161e87f7e50e71a11a99977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539838, "uuid": "66464673-942c-4984-bdd8-96f48b23ab63", "comment": "Malware payload", "value": "6acb52ee50b162ee7d5038b49c06e35c0ec02af796403b663d70c061830c06e586366f701b14468c7d04f17f96e2f53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539838, "uuid": "3bd0ceb1-eb16-4366-93eb-39f515741d81", "value": "T114468C03B29540D9D059C174CF069232EB61BC9D4BF166EF3690B6EA2A73AD03B3DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539838, "uuid": "19eb4d7e-40ef-4f1f-80f3-57e924f9a9b8", "value": "8c1d8d2bd9f2339f4d126ce8150151b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539838, "uuid": "81719e8c-9052-44eb-922b-8d5eba4c86c7", "value": "98304:87FaXAgaiU6tov8WXSB9KL30wcECf33cra/NF2GqWS/UYX6:8Wto0iYTwla/NF2GK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539838, "uuid": "ebea759a-954c-49ad-834b-567357972cd4", "value": 5756635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539838, "uuid": "84f6a4c9-a5a8-487b-98db-99aa0f59ee57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539838, "uuid": "e94b68c4-806f-4873-9448-20f093a016c9", "value": "be26784b16e11dcb08784dbe65b4e0b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a083eedb-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538386, "uuid": "cb6e74e2-7757-49dd-9ee6-41b6c9e23663", "comment": "Malware payload (Mirai)", "value": "f7f223b81aba3dd82b9878d0a0231074", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538386, "uuid": "30111011-a47d-4292-86ab-0e433e89d07c", "comment": "Malware payload (Mirai)", "value": "d829cd9495be1bfac5e9f1e33c67e3786aaedd1cdf0c224ea4b5dce57fa9c686", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538386, "uuid": "008e19b1-22f0-4a66-956a-d29070b0f4b8", "comment": "Malware payload (Mirai)", "value": "3bcbb285f3167c8202c3ffbc8fa59774ec30c563", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538386, "uuid": "57164187-8916-4d7f-af9a-9009bfb3f689", "comment": "Malware payload (Mirai)", "value": "0c463b420301fe8a54c194d3e66f5230b58a916dc37391576dcbd61590926e7bd5e967f87359a6cec52b9b7699643100", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538386, "uuid": "d024c443-edb0-4af1-9c14-9fe77e39f527", "value": "T15504885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538386, "uuid": "001ee58e-363f-4cba-8158-8b9f5ea3e47f", "value": "1536:Cl2JvnXPvL4QuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zzt/Y:Cgv/GcwZsCK9VRhAX+bShFSP0HbbzlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538386, "uuid": "5689bb73-e6cf-4c09-8a32-470e7a8efb2b", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538386, "uuid": "64acbba8-a654-4907-b0cb-2cf425a57dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538386, "uuid": "5b721da1-142b-4c9d-8e55-9529d8687dbb", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b271161-6ce5-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1697544282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544282, "uuid": "76734bdf-e490-4cbd-a367-36f89ea5b1f9", "comment": "Malware payload (zgRAT)", "value": "9bd29cbf6a0bc205a1202a1c61ce8989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544282, "uuid": "3720a225-f945-4653-aaf1-f4a6184d536d", "comment": "Malware payload (zgRAT)", "value": "d86748932f9cb3a50dff01edf92e500ada10750630e29ad61c55df9c247bf292", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544282, "uuid": "9193de9c-e0e7-4008-b6e0-7be864d707ce", "comment": "Malware payload (zgRAT)", "value": "052cdd15bdcf96cf5354fa6efbd8b0f12bab31d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544282, "uuid": "2c1ec838-0e49-4646-baec-c27f312a28f1", "comment": "Malware payload (zgRAT)", "value": "3e8d4855f99cccb7d5ae048d143458bc369c67b082e69c036bd6f65ef4eb90fcaee4ff232c5b1077f8cb7f9139844eed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544282, "uuid": "f4680a8a-4b80-42b9-be04-3d7165101d0a", "value": "T174A35D28378C5F13C2FC59BCC0A21106E7BCC1A77456F79BAD886AEA16937C15E2215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544282, "uuid": "41f691e8-5c0e-4478-b3c4-b6cdef2162c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544282, "uuid": "0470974b-b450-4768-bae6-bccba4b24986", "value": "3072:kH0TqQbVK6aNQpTa80ezyo+1J5Y23y23J8:kH0TqIaNQla8VzU1JxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544282, "uuid": "f1f8750e-9d82-48ae-8297-d9cc4cba2687", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544282, "uuid": "f0175a7b-edcb-499a-8e71-f95385e1dc2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544282, "uuid": "ce5c2689-97b9-419a-90ea-f511f0560a38", "value": "9bd29cbf6a0bc205a1202a1c61ce8989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875eb318-6c84-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697502695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502695, "uuid": "0fb95bf5-5e4d-4209-b2fb-fc83ae67eabe", "comment": "Malware payload (Smoke Loader)", "value": "c824b11f46e57ec73ddfa2f4dd50d590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502695, "uuid": "961b06da-3557-41d2-9087-e10654cdd12c", "comment": "Malware payload (Smoke Loader)", "value": "d87076fbb06c395f6d55ff504ad3d83f279dc48b65209b2c9dcd39f3539ca8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502695, "uuid": "f928e885-3a30-46ff-958f-56ff244838db", "comment": "Malware payload (Smoke Loader)", "value": "46541acfeb8e60f89d89b38d8981c9b7e644d679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697502695, "uuid": "5138170e-1fc7-47bf-a2f6-b005eadaea54", "comment": "Malware payload (Smoke Loader)", "value": "2ae981db487baca872ecf65cb536bce067068cc5d778933cccad80de7db31e3c8319068b0ccc1d07a59ebb4db6d65e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502695, "uuid": "8603ad27-9a2d-4a99-b598-f31e3fec2c4a", "value": "T10435235267D99432E5F94B3059F303A30F39FD92297997AB3351660A0C716A1F8323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502695, "uuid": "6491cd23-2b84-4288-b11f-e1e488a31e3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502695, "uuid": "a73684da-e55d-4d50-b69a-67179a06c2a8", "value": "24576:Jyk9yWOUONOQmXxNAiLI0EvzOVuiYpV8gZ48Dqz5RI4n:806ubXjI0ED3V8gZ4eQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697502695, "uuid": "a360556e-5152-4297-8fe6-123f114dc83e", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697502695, "uuid": "b3caf270-3e8c-4de2-84e7-91df881b69c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697502695, "uuid": "8219ef2e-74e5-4469-8139-7910efe06611", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb7eff3-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697522946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522946, "uuid": "f8bde865-c8a9-43e0-a47a-78b04efcb314", "comment": "Malware payload (Smoke Loader)", "value": "0cb00c4679757767c5d3dcb1d41e7bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522946, "uuid": "0dd6086c-8822-42f1-9e20-d63a0e10d5ec", "comment": "Malware payload (Smoke Loader)", "value": "d9ab0c637f1789479777d697b31c2f716ee5b93d455a057ad87eb768cc479cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522946, "uuid": "8452819f-67bb-4dd5-8ce1-148191cb6332", "comment": "Malware payload (Smoke Loader)", "value": "9ffeb768bccb19f04a851c5dbb5730d293e1bba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522946, "uuid": "0dc6cbfe-41b0-46c3-99c1-13f0d3d0134a", "comment": "Malware payload (Smoke Loader)", "value": "8496f3114ad5ab4ef131eed4d5fa1bb6808b0485237c482cd2bfbad21d67306ece01c1d7cf8f9a838de8bb9c4282cd8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522946, "uuid": "205e4f87-e4c5-4fb7-8890-1fc931fe559d", "value": "T146552342E3D84C63FDB62F7459FA16431A323CB2A639872623A29D574D326D0B53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522946, "uuid": "7e45bc57-6c8c-4412-b355-f7fdcbf20acf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522946, "uuid": "e6403c55-9f9d-4ff9-8997-0879d815fefc", "value": "24576:Ry2k3Hva1R9u/TKiEgBo5XdjefGNkFBdEslbmi+Nqh7cRTMco2R810:EZSn9umb9Hj7NEnlitccVSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522946, "uuid": "b2750a26-da41-462d-926a-ec04940aeeaf", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522946, "uuid": "30efde69-ddc8-4b81-bb89-579480fea338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522946, "uuid": "11edf172-ca88-4349-b780-e733959d042f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b6e3a6-6cd3-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697536403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536403, "uuid": "044085b0-29f4-4a64-b9df-509ed644a88f", "comment": "Malware payload (SnakeKeylogger)", "value": "ecdcf9a9a8c5a72023992090f438363a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536403, "uuid": "d3fd7b7f-ddf0-4050-9f58-8ef2830e2d14", "comment": "Malware payload (SnakeKeylogger)", "value": "da1625cff0bd555b8ffc29992a390ea0d863535428255f70cc54f5f0aecdab1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536403, "uuid": "4fbfefc3-3ef0-4ce1-afe6-ac3106d5fc96", "comment": "Malware payload (SnakeKeylogger)", "value": "f74ff6e6db3bf25d9cb71873e657eaaea85729c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536403, "uuid": "9b8db2df-6be0-441d-8c63-6ab19b7a1909", "comment": "Malware payload (SnakeKeylogger)", "value": "d7e8f0f0b6ccb798ab9df5a6ddcf1383b99998a8c589803b0ceaf01d3ad6a79520abef62ec1c80c799dc7d1424b08ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536403, "uuid": "af224ada-c76b-4428-bb98-28f01925e44b", "value": "T1DED41291B1756B0AD47E87FA0420A1E013F5BBAB3931E74C8ED674DA24ADF400AD5F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536403, "uuid": "402b088b-aaf6-430a-a3b5-04c5f40f58a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536403, "uuid": "ee6ac230-b19a-4bb0-9f02-4bf8103d8cca", "value": "12288:9A0hUnDl+ChzYyGPHz4cYCEWKvbN5U2i1PexWC3JO3k1+:CFzYfPHkcYUgN561mxWK8U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536403, "uuid": "ba80595b-7eab-4cba-818a-3333ebb40f9c", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536403, "uuid": "4c3379a0-6ef2-4700-9411-ed5c0615c6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536403, "uuid": "94b74220-8d0b-42a9-a781-72b86d4b082b", "value": "ecdcf9a9a8c5a72023992090f438363a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8168a4df-6ccf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697534898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534898, "uuid": "73f16829-4900-4318-93be-66b137113cfb", "comment": "Malware payload (AgentTesla)", "value": "d4b65b0b83fabf4324ae692adc7435a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534898, "uuid": "92c4c2ca-87e0-4a84-817f-13af2540a0f7", "comment": "Malware payload (AgentTesla)", "value": "db123305da5d41404e0ed662545b21a3dfb29364456bc2fdd580810d1c263019", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534898, "uuid": "4fb96686-225c-43e6-92f0-6dd6eea18e1c", "comment": "Malware payload (AgentTesla)", "value": "f0a09a0caf5cdbec4f512e1c5023df775b3de663", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697534898, "uuid": "088d1f23-b449-4455-ac3d-2ee40365c13d", "comment": "Malware payload (AgentTesla)", "value": "db705ee4ac15a4839a5422dc5efadccd67083d7eef91d370dff5cd9e51ca4cd4bcd37988178ca38cf83dca797adfb9a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534898, "uuid": "d728d82f-b612-4be7-bb65-17da08769738", "value": "T14265F1039804DAC3C45D83F8BD1329E50E0D7F2AE8D979DB14927F9B3A31AA7095E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534898, "uuid": "a2c5d125-fcd3-47c9-8610-fd6de3eae768", "value": "24576:zWQmmav30xsxZyZw6VC+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXX392AZyOw6VO:SQmmQ30G7F6V76c26VK6JM7XD33KE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697534898, "uuid": "f2b80176-97bf-464e-b011-d8d509828451", "value": 1493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697534898, "uuid": "3f3544d3-0566-4bde-b245-fc9c9efc9933", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697534898, "uuid": "626016cd-2045-4a5e-8b05-b480e15fa282", "value": "50__Invoice_PL_BL_102023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b1839a-6d26-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697572214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572214, "uuid": "58cdefde-de78-4865-9232-b57cba0dc1dd", "comment": "Malware payload (LummaStealer)", "value": "9edf898ca8bbb2021751c24cd9a21235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572214, "uuid": "30e031d6-60e9-41bf-bc9e-ec7b582601d2", "comment": "Malware payload (LummaStealer)", "value": "db5dd259a33863a47fc5e458e5ab89d0d2e67eb22a216c3431edd975b999234f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572214, "uuid": "18a41f18-ffd9-4387-8b22-0e7e925fa3a0", "comment": "Malware payload (LummaStealer)", "value": "f16c36baa9a4df15233518a0483a8c164a93eedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697572214, "uuid": "6e884ae5-d645-43f6-ae50-9e3981e663eb", "comment": "Malware payload (LummaStealer)", "value": "9874602b3d111167c2e4987fcd1bac3bc956d26d8534345c6e6f7030504ccfbbdb227e14d796a6e24c0c9069591dc98d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572214, "uuid": "5cd6bc62-8376-403e-a510-5594754fe504", "value": "T190449E00B4D2C472D572153609E4EBBE5A3EB9210BA59AEF57D41FBE4F303C09631A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572214, "uuid": "350005f0-de42-46d5-80f6-b59ae8290ee2", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572214, "uuid": "9f2e4b81-f364-4b87-a047-dfba064705b9", "value": "6144:b3u+SkpuhH55/jfoKgawoWqAOXl1QPMNNDp+:beRkpuhZj/1nDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697572214, "uuid": "6e195b18-e971-45b4-9145-95b2230e7f19", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697572214, "uuid": "b6cf8c72-2d73-46e3-a0b0-c1876d6316bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697572214, "uuid": "bbbe2080-572b-448a-bbe3-3a13204410cc", "value": "9edf898ca8bbb2021751c24cd9a21235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e28abfe-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697545952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545952, "uuid": "fc27c958-1aaf-48f6-a448-ed17bb0dcbe2", "comment": "Malware payload (DBatLoader)", "value": "638779c6dd7039bad770f888dbe7b787", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545952, "uuid": "e346fc7b-c05e-4d56-966f-2a3b89d0fdbf", "comment": "Malware payload (DBatLoader)", "value": "dba2008ed8c1139e43631af4468456a3233fa350d02efe9201311b58d3eaa7b5", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545952, "uuid": "e8b4bcfe-2308-48ec-96c4-cf56b147bce7", "comment": "Malware payload (DBatLoader)", "value": "198c6ca7dfbd6b69a15f34addbaee90fbd378eeb", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545952, "uuid": "853cd132-4354-4da9-8127-0efda88f4f6c", "comment": "Malware payload (DBatLoader)", "value": "bdc98609ada5bad4d23c1fa75a011caafc7e17706cd57bfc78f6151d4b551c4b2db6f09e0d936aef77ad529098f51c23", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545952, "uuid": "a290f357-3cb9-4499-b06a-a877a1459739", "value": "T193B423D9403939284492172FFE4BC31A74C6C6D62735925BB00B8C994F29B57BE39B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545952, "uuid": "369875ef-91de-4277-b9f7-53902267180d", "value": "12288:podV3FKoEr28cLsY+lW+u+Sm6xdoyzd8IoujtEpD:ydV3FFEr28xl9+oyzdSujKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545952, "uuid": "f832743a-018d-4e2f-9ee4-cf181bc6a0cb", "value": 520836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545952, "uuid": "79fca0bc-015d-4016-962b-048326b0ef5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545952, "uuid": "756bdd31-38ab-4abc-b97e-a6e94b3e422c", "value": "Mzcoqandgnyyyp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0dbc66-6cfa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697553253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553253, "uuid": "4c52bf28-4a6d-4752-9f86-0bd704eaeed1", "comment": "Malware payload (AgentTesla)", "value": "7a1f788b4ed2838f2afbe1bd4ca4d1f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553253, "uuid": "699abe30-a046-4ca2-8d53-f2b2394f1132", "comment": "Malware payload (AgentTesla)", "value": "dc8a077600f7e0fe27bd970f0d0aded18612f849e8e2fe53f8b69609a0b38fd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553253, "uuid": "e222b8f4-94f6-43ce-ba5d-a55f3588d4d8", "comment": "Malware payload (AgentTesla)", "value": "47a44c4498442ec72ba70bf1cc292892c771883c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553253, "uuid": "4eecb20f-33b8-415d-bc7f-c47d2b72167d", "comment": "Malware payload (AgentTesla)", "value": "ea24edfc39040d91af0e12bcb269809954ad0b0a73f5c1e439c83663ea062a05460adc4472295d11696613b24add0d46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553253, "uuid": "0891b4c1-9d74-4898-825e-69d3a6484e93", "value": "T157E423507F6DC13FC74CD8FC00696950ABB1D3363641E6E86CC927F9806A78911A9EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553253, "uuid": "6e267fc6-a071-4544-86b1-f9f3c60757ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553253, "uuid": "02e0e322-df44-42dd-ac20-2f077e8fb8d3", "value": "12288:z62DJ92I6Yd+8mV5hvipj1gV8EEkzPh9dy7LdemyfNVTgt/yD/://Sr8mV5hqpj1gZEkrh9zEqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553253, "uuid": "28f8b80e-6eed-4575-83db-ae2e69e589df", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553253, "uuid": "32b0feeb-d2e9-450c-9afb-333fad2d5df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553253, "uuid": "8dbd9c9d-cee7-4500-a31e-13435e23efd3", "value": "PURCHASE STEEL PIPE MATERIAL #RFQ230216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca64936-6d47-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697586510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586510, "uuid": "6882ae9a-793f-417b-b6ad-e2a0c2c67c39", "comment": "Malware payload", "value": "5248110a6aecdda2829fb1cb261a7329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586510, "uuid": "6c90dbbd-3582-4975-8d00-5f40445d6bf2", "comment": "Malware payload", "value": "dcb2b2c59045e96be7abc80a047109afe1e52bc02fc1806035c842688ea194cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586510, "uuid": "b13f73d2-7570-4672-987e-773effbfa8e8", "comment": "Malware payload", "value": "a1b13963902d78367569500e636c4ddb76726115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586510, "uuid": "eb3e40bd-c259-41cc-ba88-b2a54bfd24f0", "comment": "Malware payload", "value": "df919eceeb5c1415c631754221884299bb1c6f17cff47bee7de6899db3f59181f3512e6511288d171f07968c54f9071c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586510, "uuid": "187d0770-aa1f-4782-96e9-652d3a245109", "value": "T1DBA45C56AFC33EC0DF89A6B24800FBAE176E4275CA42D0C4BD6CE5525B275A7D70B234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586510, "uuid": "be5594ae-33e3-4cc9-b5df-7c9f6df70927", "value": "eca0c30b65294d02a6c6180a6b323b58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586510, "uuid": "3fbfcafd-0895-4ad4-9927-fb1d2ea09015", "value": "6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+0:2uWP/BZUyoLu8Agsmxwrvejkd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697586510, "uuid": "fc2cf782-cc6a-4a3c-8099-42940cbed2cb", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697586510, "uuid": "bf321d03-b45a-4f6e-a3b5-a5c0f80a5bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586510, "uuid": "be3e2b96-31c7-4fde-af7a-f65778ac7c1b", "value": "48f133c3b3c63620834f67fde1d59e45cc013beb32af3c1f07649d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d697b32-6d3c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697581518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581518, "uuid": "405a0af6-fd7d-4617-9dab-13ef6d8c0902", "comment": "Malware payload (RedLineStealer)", "value": "fbc173f8b7d8b38dabee565aa85fef22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581518, "uuid": "2b1d9f22-1405-4013-8574-7cba4425f98e", "comment": "Malware payload (RedLineStealer)", "value": "dd23cd6c9799424dd6e56f5e02a194dd6cf06f0272110640dfcbb49e5b613997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581518, "uuid": "764751ad-a794-4c3c-923f-5d33ebdda443", "comment": "Malware payload (RedLineStealer)", "value": "b1c44d698d30fe40a4cc1e187d1e76325d984648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581518, "uuid": "320341b3-cd5d-4b32-92bc-8d8fb172fd9a", "comment": "Malware payload (RedLineStealer)", "value": "e02a915fc0312677b698f92b81bfb9093ff0fa91b6b14674402fb0c4290b9b00b88f3114a3d34c59002b412e0cc7a05f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581518, "uuid": "2927e40a-a20d-4aba-ac80-d79f7207f780", "value": "T1953419657912C032D660A5B619F4BFF2C19DA815ABB149EF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581518, "uuid": "ead9f7ef-3368-479e-9c2a-8d70c66558a5", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581518, "uuid": "83808cbc-aa6e-4ffd-a094-f4f0bfd772e3", "value": "6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697581518, "uuid": "232e7081-919c-4cd9-8408-85563cb77a80", "value": 248097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697581518, "uuid": "fd3b8e9b-2803-4711-901d-7765afff34bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581518, "uuid": "cfcb6b4c-69f0-469e-a168-a09d67721b7e", "value": "fbc173f8b7d8b38dabee565aa85fef22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db8e4ca-6cd7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697538381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538381, "uuid": "62a63caa-4294-44d9-81d6-fac856113ec7", "comment": "Malware payload (Mirai)", "value": "13a7372cf23643c9ba5b21cb038ba400", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538381, "uuid": "9cfc0c0d-5fa1-48ae-beee-93de48dbc56b", "comment": "Malware payload (Mirai)", "value": "dd2f74566682d5eb39892807c0b34cdcaae57013b547c630d311c74a4515ddc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538381, "uuid": "3ce90803-38dd-4b8d-8cec-a6652c7b26de", "comment": "Malware payload (Mirai)", "value": "d0b1ee88ef2e5f7cb94ef7ad63f912162d6c85c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697538381, "uuid": "1540478b-da66-460f-b696-9986f3da21cc", "comment": "Malware payload (Mirai)", "value": "12b9b97e892b416fcd4856dae22c85806aa9801d99ef81790bc3b8c49952a8e2ac4e112b1bd22c67508007ea247dda91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538381, "uuid": "3fbafaa9-fe81-4903-989b-55a8680496b8", "value": "T18204D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538381, "uuid": "80b600c5-b8bd-4368-864c-808dbf6ffd1b", "value": "3072:ueEksFM+wX5OMaVR8H3NaMZOTTMJxt9U+7fKbLE:ueEnO+wXYVWdaMATwJHy+u3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697538381, "uuid": "46a9c465-e9ba-480d-8ff8-5590ffedd58d", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697538381, "uuid": "9f37d64f-845f-4fa2-b790-3e395e4c5732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697538381, "uuid": "8f1989d8-2375-4d09-8909-ff90cc72561f", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e7ecd7-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697523312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523312, "uuid": "1f8396a0-d3d1-4fe0-9b81-09af886a8859", "comment": "Malware payload (AgentTesla)", "value": "17028657a60ae04224953bcf52ab687a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523312, "uuid": "60f2f3ef-219a-478a-a877-659118288155", "comment": "Malware payload (AgentTesla)", "value": "ddd5d81f5be6314dfaa80c13fb6332b2b7e94b218b049447b37ead946f21be78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523312, "uuid": "7457c65b-15bd-41d6-af68-99ecc0ea4e3c", "comment": "Malware payload (AgentTesla)", "value": "a8048ea993b5f34326244fffae76f51b568ff193", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523312, "uuid": "2d545bac-959e-4f10-852d-8103c4ccfcc6", "comment": "Malware payload (AgentTesla)", "value": "600e82f0dc5e284cde1abb1402b97f1c930639c8242eb102e4f238d2f6447d0f58f9cf1803292f3c26746a8270b39017", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523312, "uuid": "92f4c94e-55d8-4c0e-bff6-cccdd48b65b5", "value": "T1E8551922BE55CF02E78F82B4CBA250F806E7AE69CF02D3C798557E27B5316556C4A073", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523312, "uuid": "50cbb566-4fc2-4df5-b5a6-7d23f33d5bf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523312, "uuid": "69c87072-d138-44b8-974a-30626f0a68b8", "value": "12288:jpKQjsYkTySXDS6HUdL7nsXEVO5Vxs+erylGqFhRjmNH2hruhSNWKtQgnO8Lo/xX:kpXD87co+eryYqjAewSNqgnNmxko5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523312, "uuid": "c6e86b7a-2359-4c39-8c83-2efc28923b7d", "value": 1369088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523312, "uuid": "068d19f2-bd88-48cc-98d7-1285ad6944d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523312, "uuid": "0fce29d4-d80a-49e0-ad53-59d0a8d164eb", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a2a0a3-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697545964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545964, "uuid": "c283ac32-2740-4ea1-9ae3-e88d498ece95", "comment": "Malware payload (SnakeKeylogger)", "value": "1c303457fdadd02d4847cbb1278725f6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545964, "uuid": "4caa3c2b-6626-467d-b872-0a48620e2acd", "comment": "Malware payload (SnakeKeylogger)", "value": "dddff6842dea7df6bf5a2b9d1eec7b6a800cc13d829e1146a795c64cdafe3661", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545964, "uuid": "e40a0afd-f32c-46be-bb90-a7a064094896", "comment": "Malware payload (SnakeKeylogger)", "value": "7bd20b953420b1a1942a287b0540c024b003ce66", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545964, "uuid": "c4c8d289-56fa-4f02-a0cd-0d0101adbcc1", "comment": "Malware payload (SnakeKeylogger)", "value": "f651e4d141eef89d788872d3ac621b8552173ae66c6418f47ab7588c5a928a167b72305e994ccc247400efe3f0e9c943", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545964, "uuid": "55ff5bbd-c7f0-48a1-ac89-e64182d33baf", "value": "T1F3B423E762B0E908DA7D838ED9CD294D843CEF6408DF642D2DCE4F04FD75E286A52619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545964, "uuid": "02b30078-3954-456d-a4b2-6a19e1f77bb2", "value": "12288:tfPJush4A0ZiQGdzEBSwvkXrLo6k3zlLCfV0o:toEQ8okvAlWfV0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545964, "uuid": "d2591609-bbca-4a66-b6d3-dc119ae90ca4", "value": 509641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545964, "uuid": "d7aea00b-c77c-4e34-a3ab-815c76e13ce4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545964, "uuid": "9b6cbe03-2b3a-494b-a2e7-bf569ecc8440", "value": "Swift.txt.pdf_1.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe3112f-6d35-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1697578865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578865, "uuid": "41845619-e5fc-4ad2-9d9e-4d6c769c563e", "comment": "Malware payload (RecordBreaker)", "value": "674003bcb62fb809fda9046971e77f50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578865, "uuid": "302c900e-798c-479f-b5e4-360ba196c6d6", "comment": "Malware payload (RecordBreaker)", "value": "de30cd2980793aa41245adbb99fc89f1af28704203edff9af03f8196992c054d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578865, "uuid": "9b2ac815-fe5c-4433-9ebc-3c62db8bfe7c", "comment": "Malware payload (RecordBreaker)", "value": "6501aecb25609255e8234fbfa0873cbf430eeac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697578865, "uuid": "7745e38a-c8fe-4a32-81db-51eb6a4a8f25", "comment": "Malware payload (RecordBreaker)", "value": "88b183c0ee20bbaeb1ddf55ae667382fcf6fbb7937dfeb26ee80e66f961464a5865b6342404d853c057c3e28a091cd16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578865, "uuid": "785cdf0e-b223-4087-91e8-bf806272df44", "value": "T150A3D6D34278A302EB94187316D3EE737A59DC3E1D25BED3AE51CA5381EE45009DA2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578865, "uuid": "02d39f16-0d5c-4a66-8598-c0b3bb47e14d", "value": "0fcb7632c48018563e5af2f63681ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578865, "uuid": "dee9aa0e-6b92-4ce7-83d3-0bf1d1eb9e01", "value": "3072:BANfQKMuflyKX9FBFya6mob2lqL6RJ//SY:u0O9FBn6pb+tRJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697578865, "uuid": "5786cec4-1ebf-441b-a1c5-c9f634099848", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697578865, "uuid": "5952edbe-73c0-4139-8c5e-1981a6ce52da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697578865, "uuid": "141420d1-e2fc-48f8-ba0a-e851f5bfaf1b", "value": "674003BCB62FB809FDA9046971E77F50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a90b1d-6caf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697521181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521181, "uuid": "4755628e-6493-42ed-b911-d08a51234f2d", "comment": "Malware payload", "value": "8d38f8b980d56c87dbca7c6abdca7a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521181, "uuid": "a111bdc6-7775-4ebb-a3f2-c340e9d7ab83", "comment": "Malware payload", "value": "de41d77e137dd2ae35d5623085bcc3a9e46957ce7dfec655693c7c3120aaeeb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521181, "uuid": "5e5f1804-f4ad-429d-8cba-e1a59bebeaba", "comment": "Malware payload", "value": "5452edceb0fd59a7336da1aaad0b007e72b8b03d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521181, "uuid": "32e874a9-d251-47c0-8da4-1bf0cfe904d3", "comment": "Malware payload", "value": "4119d21ea01067297bf7daba52dcbaa424c1733f6bdcc0e7e6de7fc1b8b8f30963b759f2fa332068c037a2a17e0546d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521181, "uuid": "940ffaa4-a275-4f32-bac8-052a20200548", "value": "T162E4E093D3E17D80E92B8B728F2FC5E87A1DF9508E897765162CFA2B04B0172C663751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521181, "uuid": "cfb5203c-4d97-4396-aff7-e090945042a7", "value": "305c32ee7516131cef129ed3db842454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521181, "uuid": "85d56124-dbfb-411c-aa0e-146535f387fe", "value": "12288:OLiU061vGMHn1IJLsvgKLw+zOoIo+/Q8dN5pNEIXyWLKhw19g:OLP+Mq2v5wVoW/1BEIXyW8w19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697521181, "uuid": "e4802589-9573-4580-83e2-bcc3c993955f", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697521181, "uuid": "a33262eb-9dfc-4460-b435-817e4ec5299b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521181, "uuid": "801371a6-9f9d-452f-8483-ee647dcba763", "value": "8d38f8b980d56c87dbca7c6abdca7a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4057d5f-6d2c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697575033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575033, "uuid": "9df4ff95-61ea-490f-8adb-1c5a409d75cf", "comment": "Malware payload", "value": "0d9ada50ed20fcb363439b507c15382d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575033, "uuid": "74d2022c-c343-4cf3-9ec4-1f43ab3204a6", "comment": "Malware payload", "value": "e043fbf92b549fd89627ae67d54bd3f914b38987b6ca2ae2ac1636983aac14b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575033, "uuid": "f97e1786-087c-4008-91f2-26fc8489dd2b", "comment": "Malware payload", "value": "9c958ae3efe77f0656b04aa5b02264b886a74951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575033, "uuid": "235ba030-89f6-4cc1-8039-61339295f870", "comment": "Malware payload", "value": "5323e2f854adebc0ccb8ce43a235ef72362c6e5ac582b560924c458a5955d89aaa286dfdbfb852e22ffe3cf64f6f2c30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575033, "uuid": "fb692f59-0ed3-455d-a323-541f7f9e29b2", "value": "T1EA352309B1E45072DD785B3056F907831A3ABDA79C7897AA7340991F0DF3680AB347BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575033, "uuid": "5ed29465-4b21-4413-a55c-78a6522a20af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575033, "uuid": "89042b42-bbaa-4b43-9479-0e5ee8b811e7", "value": "24576:dyU/vl6Rgsp/a1wpFwF2wDeawNfLEY5r8eM9fj56hSd0jqZ8:4U/9Agwpmbputr8eMTeSd0jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697575033, "uuid": "0c2d6754-2b44-4983-b73d-1cb948758758", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697575033, "uuid": "1d85b075-d676-4b52-9e6f-87e31423fe7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575033, "uuid": "977d1f0d-673f-41f1-8d12-3ad2be105627", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99efb569-6d15-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697565003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565003, "uuid": "e2b397b5-93d6-4960-a7ab-a6ce7d952cd8", "comment": "Malware payload (Mirai)", "value": "f1cc030b8ef3d4fea45ab7a69fd1f88f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565003, "uuid": "34ea1b26-d394-41e5-9c26-c3262d2b97b9", "comment": "Malware payload (Mirai)", "value": "e2d82f5d29d608079c842c36e0346300b372fdb4a6ef780e28596b3b177ab154", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565003, "uuid": "eed9361d-2e08-40a6-b63f-d3e46f0b9d6f", "comment": "Malware payload (Mirai)", "value": "fe1b147c337eea6df734c525e252ac9bacbe4b7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565003, "uuid": "619fd6b7-cb40-44d5-bd9a-e7affae5914e", "comment": "Malware payload (Mirai)", "value": "5d08619c54baaeac1890e32d667256bfadbe515126fdcd02c3dc304518b8abe31b291844d3cbec80722d7fa6b2df6151", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565003, "uuid": "e7c846a7-5d63-470d-b289-85132e05799b", "value": "T1ECC2E0F57E773A5BDA29013D745DCE3742B4A012D39EA653E240924C20071BCBB329DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565003, "uuid": "35344c72-f31c-47b2-8034-d4c598fd8154", "value": "768:HMwoDZLFbBy6HQHRYfeAxdd8M2eIQfD0NL:HolcYfe6KBpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697565003, "uuid": "708b4cad-9a7f-4b28-b02a-1ba10b0eac4e", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697565003, "uuid": "be87291a-bef8-440f-b832-4cb8cac06834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565003, "uuid": "9f3e39ea-8cdb-4b4b-b75c-b39c2944df17", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfd3adc-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697524124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524124, "uuid": "9bba3872-5867-4db1-9e8a-6627955227bc", "comment": "Malware payload (GuLoader)", "value": "b347e9431315258f13ed4fe8d2bd9f6b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524124, "uuid": "e6b87128-332b-4f49-8a82-6398a48e2a80", "comment": "Malware payload (GuLoader)", "value": "e31d3bdb9083d799b697ccefbd7b27be023963bd9497a2839d43e258a7cd8f06", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524124, "uuid": "6b77c723-eb38-4fae-905c-88fbcc747561", "comment": "Malware payload (GuLoader)", "value": "2ae23ea10e5831ad3894e804d27a2b56c3f68986", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524124, "uuid": "2d59bb68-7bd2-4ef0-a05e-83fd20061d08", "comment": "Malware payload (GuLoader)", "value": "e73425dd3bf877d88d0fbc35160fa8bc3f1a6c7c2041445ed0f71c731c9df5f165288c7c2b7b5177a43ef928e37e6e74", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524124, "uuid": "7f5a8cba-3ae5-41f0-87c3-e80a12f47573", "value": "T1D2923AB1DE8204150D0B6BFBE9099534846141B770540876FE8EF7E84B3A75DBABC94F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524124, "uuid": "40bb15b8-49e3-44a9-b775-35bc90a47ef3", "value": "384:qYuYbTY5hQtnFJn27YqXWothet/7gLQgg+XmawFW3b6LmMxtMCYCXj31s7oRdtfP:BuYb+It2si8JEQgNvwFW3QmHCYe+7Ocq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524124, "uuid": "7492eafd-ec14-4554-b907-babb1887959f", "value": 19362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524124, "uuid": "0765ebf4-3c2c-44b9-aa34-d635e717d959", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524124, "uuid": "501cf051-46b7-43a7-8260-8cb628595cec", "value": "PO-Ref.RO1381523.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dd03d2-6cf1-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697549461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549461, "uuid": "e26ae3a3-8bbc-4e79-a8e6-127b66772655", "comment": "Malware payload (SnakeKeylogger)", "value": "e37a6c6b05dc6b19b62b1d6a2e824063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549461, "uuid": "868c4518-e338-4b16-b25a-5e13bba75fb0", "comment": "Malware payload (SnakeKeylogger)", "value": "e31e7a2c5a956f2e513351e779fd6ea064f2aceec566a3e9b6ac0d3a3e639ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549461, "uuid": "109bf2fd-32e4-46e4-9928-ba5d3d25b22f", "comment": "Malware payload (SnakeKeylogger)", "value": "7cf01b7b9d216ebbb4e0309dc90408b67d1987b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549461, "uuid": "3cda5fca-e0d2-44f3-a88b-65c2faf99db5", "comment": "Malware payload (SnakeKeylogger)", "value": "abd44ce0a7621c1d14b37a540bb16a44965631e7fbb569f4f1e692ebb89915d44eacee3c3a476569e5436741c22654f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549461, "uuid": "86e157ed-7eab-4910-9deb-50addf85dff6", "value": "T1A2C3291D2BF88800E5FF997305715211C77AF952192ACE0E4AD1F8292A7DB918E1EFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549461, "uuid": "70636d6d-7962-41ef-a10c-5123d4ecbf15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549461, "uuid": "43e76227-6bc7-4670-b286-67806dcfbd30", "value": "3072:vybcQZIBwtWp6ocm6Db7vGEqwB7xogbY:lQuhR6DbLGQxxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549461, "uuid": "d4864a14-08b0-4949-b8c5-91a9e89dd412", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549461, "uuid": "44dc8655-562d-4859-ac48-543034a791b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549461, "uuid": "677e266d-58ec-456b-9f89-a7c7269364c0", "value": "e31e7a2c5a956f2e513351e779fd6ea064f2aceec566a3e9b6ac0d3a3e639ee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755f58aa-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697523281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523281, "uuid": "69732d64-243a-45dc-856e-4dad2937448e", "comment": "Malware payload (RemcosRAT)", "value": "20ef767aaac714cc92fc1210e020f61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523281, "uuid": "5d943bd3-6c67-49b3-b7b0-d3bd8aad54bd", "comment": "Malware payload (RemcosRAT)", "value": "e329d4fdf3557b00cfd9044dbd12048077fcb6f8cdbaf1553308e292bf6a3707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523281, "uuid": "7db2f302-f9f8-4424-b2a4-91ef1d537b0f", "comment": "Malware payload (RemcosRAT)", "value": "789fdafacb984074d3e5a29445c42d1b986c003c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523281, "uuid": "656b800e-4cf1-43d8-85be-fdb2d49de3b4", "comment": "Malware payload (RemcosRAT)", "value": "8654e8604bb9f1bd43a57269fc0c7a2bffb79e9aa7a63030fe3b87912be73cef55fa03af10705ba913e4029c826ff134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523281, "uuid": "8db295bd-ddbf-4829-8a01-0d0274533d86", "value": "T17B25B023F1931533E573D6789D5BA3685B257E30392C388A6BE57C489F3B2853829393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523281, "uuid": "368fc204-5cee-4d37-8990-2ebc763ed2b2", "value": "c13d32aa9888fe966e6fbe2088c7521f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523281, "uuid": "ab4bcabc-96f4-406d-a20a-ef7afcd6a2aa", "value": "12288:SsIbHgwqDkquOEfffS0+qJQZJYfkN/PTD4Vc7LnvtfGSGDLyIBfZPIqr:ShbIurffS2J4IMj4c7bvteS+BfZPIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523281, "uuid": "6d8784e3-6643-47f6-a5cf-bd2079fcd8fb", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523281, "uuid": "17b00aed-e7f6-4a77-9aa9-334c4fee1993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523281, "uuid": "eda6e3fc-2a90-4772-8cdb-157d80875190", "value": "Updated invoice 001-021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881d34e8-6d46-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697586019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586019, "uuid": "5105cd9d-70af-4870-a0f4-60f788500d65", "comment": "Malware payload (LummaStealer)", "value": "0433db2bb86bfbf3e696a4ec269ecd48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586019, "uuid": "d2470b40-1069-4e21-9c97-ae01f3e44307", "comment": "Malware payload (LummaStealer)", "value": "e45394f533451612c04351fdeaa0a3297ede34d5aa76c6f84eb9d3f468468a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586019, "uuid": "8d428a29-c302-447d-ae12-28680a811a20", "comment": "Malware payload (LummaStealer)", "value": "62b97659c547f2e72470072a52e9ff7fa7851b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697586019, "uuid": "d3af0f0c-49d6-4a8b-a03d-83f48f82b660", "comment": "Malware payload (LummaStealer)", "value": "1963b936ac489e43862c05fbf6708aef1a5d53a1ccf68a9e55c959e9c2154fa732796099c83ff61e708ed76acb8579f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586019, "uuid": "48ac3fad-73c4-46a3-bcbf-92e3a87927f2", "value": "T12F15222B77C98077E8B6137494F903831A35BCB18D78435B2B8198191DB2BD4A976B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586019, "uuid": "f472c9e3-85dc-42ef-9608-22ca90eeec5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586019, "uuid": "3756868f-8a51-4a01-9f63-84ce28a964c9", "value": "24576:8ly96YMrhxWccnv0HdtL87kSefXyLr8il:8AKcvwL8Yy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697586019, "uuid": "336a7e0d-8d0c-4bcb-ad9c-8bc35be01af8", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697586019, "uuid": "638c4a9b-0148-49f3-8105-7905d881529f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697586019, "uuid": "ecebd476-423c-4206-927f-99f4bfcb3ac4", "value": "0433db2bb86bfbf3e696a4ec269ecd48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e456fa15-6ce8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697545801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545801, "uuid": "7c74deb9-6632-452d-8fa0-23c951c5bcc1", "comment": "Malware payload", "value": "b5b8ec2c32a2245bc1037fcb248882f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545801, "uuid": "2e7a822e-5b7b-41bb-a99a-9fa5ad6b4843", "comment": "Malware payload", "value": "e4da2590be755f6aabf775271d6a6fb62fc5819f9042aba77103e1f8f1208bb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545801, "uuid": "4e9a0d38-47a2-4d46-8d60-528688aec2c4", "comment": "Malware payload", "value": "eb8139f681ccd72de9537a0a292b13a6c7584cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545801, "uuid": "efd9c336-56e0-4758-a3e5-597e35fd515b", "comment": "Malware payload", "value": "c20b01474df8b2a37a0f9f4d2bab392b39919a27ad90dae1f316ec22ccdb9186e93b2302d39917dc5394028b15909546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545801, "uuid": "a34bbc51-8483-4ba9-ae86-a66e59dde63b", "value": "T166E3F717B6979AB9CA892B3ACFD700000770D589B693E70E7D8E23D9584337B6D452C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545801, "uuid": "c2de059a-2204-42e3-afd7-8b241df34529", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545801, "uuid": "d5cef7b6-7f96-4535-913b-f5c6501c7ec2", "value": "3072:jR86lqp7hBpzr6SQVtSTc2D30J444244w44ut444444d+k9pDZz7lg7wq8AIHKZP:+6cVZZQLSTccExJl6U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545801, "uuid": "40717725-307a-4c56-bde9-698d0f833a46", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545801, "uuid": "f7839b78-8b21-469b-b288-88a2f7f82874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545801, "uuid": "af41d967-4fb3-4ce6-b338-1c0c7b0e77a3", "value": "Jwndvyujz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1e9cc3-6d1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1697568633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568633, "uuid": "831b95d3-4ed6-4841-b5b8-05932e361a9e", "comment": "Malware payload (AsyncRAT)", "value": "008fc9db9966652cebdf66f72c8a3b2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568633, "uuid": "f53de682-5f7d-448d-9e5f-3c346158592f", "comment": "Malware payload (AsyncRAT)", "value": "e5b7de034a1ebd6d7951d7b159780f36923725d8b7e3dd267d958ac9f4f8f2d4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568633, "uuid": "6d2a6fe7-cf83-4e31-b45b-a2d563cbe18f", "comment": "Malware payload (AsyncRAT)", "value": "57daf3f6319a83fe01f5e138f98105ae3696ca8c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568633, "uuid": "ac076261-51cd-413e-8595-5c67f66964ae", "comment": "Malware payload (AsyncRAT)", "value": "994ae8c2b65c5b291c1b42204354e7b346e2d8912b2fb2c41c5970240ac38121de64d24e7c14b550a2fdd8870d51b43a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568633, "uuid": "854fe02c-6fa8-498e-b792-14d467c6301f", "value": "T19E231A003BD99136D6FE5F786CF12186877AE6632603D55E3CC801DA5B13BCACA016FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568633, "uuid": "f8daf87d-820e-448e-8d21-dc6d630e33bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568633, "uuid": "e32030a0-d5d3-44b9-bf26-8c566a8f5edb", "value": "768:beItT/GoW8JGX9ye91Vstjb0gxh5BTqf9QnYqVYDDGC2tYcFmVc6K:b/GNYlbbxrBTqGv0DGCKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568633, "uuid": "da7fbed5-0a7c-43f1-88dc-790be332ca31", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568633, "uuid": "8fae082c-ecf8-4776-9d61-7c995f787281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568633, "uuid": "0a8e7692-b7ae-4fed-9d35-c63099bf493a", "value": "008fc9db9966652cebdf66f72c8a3b2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fd8fb6-6cee-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697548278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548278, "uuid": "074114f2-a8cf-4961-9669-af8fe199f88c", "comment": "Malware payload (AgentTesla)", "value": "27c0783f7b69af0cd592ebd39e638479", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548278, "uuid": "ad4643da-66f0-4f37-8c4a-06907583c5f1", "comment": "Malware payload (AgentTesla)", "value": "e77d871d9e2217d687389a0be0a6eff4f0be0301fb80c365561e50e82c420c41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548278, "uuid": "aab545a2-10ae-4960-85d4-5993409a6d72", "comment": "Malware payload (AgentTesla)", "value": "bdbb86d69557ac7939252f2ab1ddfa3ee174b737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697548278, "uuid": "8ddd44e6-b726-4531-a281-ddc969dc08f1", "comment": "Malware payload (AgentTesla)", "value": "114c961c29f3e996f91da7ba7e5a998921449361bc0b07fe96f4640cc600b8962b234e004f4baf10c7f2c42f6d5fd54b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548278, "uuid": "dea69738-e0ad-433d-892d-55e536316451", "value": "T1F0F401597BA8876BDC2C677DF0314031C334EC0A7426E3AB8B4A59592DD7780EA169B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548278, "uuid": "d7092e57-9eeb-4710-89ee-4b6b1a3645aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548278, "uuid": "fb7530d9-92ff-43f6-ae18-be4e7aa47d5e", "value": "12288:Dx/0M7sVy9/Xtc0vRqy7V2zZbkVmb36sy8LG2wfYw+x3AMa3Pujd+CM+goElsx9V:F0M7sVS/Xtc05b2R+jFK7dnxQLGjd+Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697548278, "uuid": "86b41514-1467-4663-beea-d00b1a557859", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697548278, "uuid": "0c646ae9-ceb9-463e-9d54-8d7c849ce1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697548278, "uuid": "6e342795-2b6b-41a9-a8a9-379dad9dba08", "value": "e77d871d9e2217d687389a0be0a6eff4f0be0301fb80c365561e50e82c420c41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f660c75-6caa-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697518842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518842, "uuid": "8c91b46f-e219-4a21-b581-97e2461489f2", "comment": "Malware payload (RedLineStealer)", "value": "1c7b2d4b9fb4a5fd89a49845cebd0224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518842, "uuid": "bd1ea7c2-5c75-45b2-8bcd-2133d87152da", "comment": "Malware payload (RedLineStealer)", "value": "e794a44733960e4e2187646a9032f34b170c5e082a61e34c2df72f4036cbd1ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518842, "uuid": "6406dc87-2867-452c-8e12-7876ebb35b39", "comment": "Malware payload (RedLineStealer)", "value": "9e9c87e75096f5e77619073e637fc8a94cb65cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697518842, "uuid": "6689a8f5-ab01-49ce-b8ec-bb6714195a9b", "comment": "Malware payload (RedLineStealer)", "value": "c7ce93d823e644c0986bac6bf0d5532acccd5046f80d18ab9646da73f9029cb125f9dc229f0c528c49a5fc46048e3466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518842, "uuid": "74b523f9-c10d-48ab-8380-15d734add646", "value": "T1A5049E15B5C0C072FE62193609A0EBB14E3DFC340F905EDF6BE40AF55EA02C1997597A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518842, "uuid": "4ab88832-6ae0-42b0-97ce-371432307976", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518842, "uuid": "c476110f-b6c6-4034-808b-5a3f2dfaa2fc", "value": "3072:IDQsRizKw/kal99mdVeiOEru0PIBrc9vFipEbkIz12xnd:I5K3l99cV4ET9oUYxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697518842, "uuid": "7a29db76-e497-4394-b52a-8ad4d6aee234", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697518842, "uuid": "56480493-3881-4f2f-aa51-123ff54c62e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697518842, "uuid": "d4ad5ec8-cff5-4dac-a11e-3531d09c2d66", "value": "1c7b2d4b9fb4a5fd89a49845cebd0224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82386ac4-6ced-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697547784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547784, "uuid": "445ee543-b3bf-4f3d-949e-cb11566bf7ad", "comment": "Malware payload (Formbook)", "value": "e9409e64d36a5788a4e90c08a972c434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547784, "uuid": "0eb763e5-adaa-4716-81e5-b8fd53302739", "comment": "Malware payload (Formbook)", "value": "e823e333ce86a2ac88338d4be5d78fd5901ce23e789b37e23ce22a29b550e324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547784, "uuid": "9c660439-9dff-48a1-8ff3-198149ea1ea8", "comment": "Malware payload (Formbook)", "value": "acbb4112b7245cebdeb967d7262805632dd63de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697547784, "uuid": "e4009214-5a24-461a-b4c9-1fa8a309040a", "comment": "Malware payload (Formbook)", "value": "f100e5fc75fafa19e989409a9034a5bfb239b7ea4b1f644bdbec5edf666fabcd216417b3f5b5522a28eef1ab684e0598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547784, "uuid": "37c65120-f197-49cc-ac89-781c5b407e52", "value": "T1E08412D1DBB0EC72E59492390476AB962F702C3B194446876B10FA1EBEF26D10A5F337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547784, "uuid": "15cde30e-f7b2-4869-93ca-2c06d86c4ccb", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547784, "uuid": "a5ff1fe3-67aa-42e9-9d61-4a15a8e54605", "value": "6144:xfL+oqP215n9ksUq8tDsQBxpql0aq/vFTZxmq/zLtxvSOwwCkwIxvdZ+yXQGGDcB:xfLKa7ksUfhCOEq/zhMmCNIx9XQajoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697547784, "uuid": "7f1a0292-fc81-4287-adfb-07069bf8a031", "value": 389199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697547784, "uuid": "6d0915e3-57dd-4b20-9096-216d7d2a81db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697547784, "uuid": "6d52151b-5f1c-4c20-a820-403c1788fc92", "value": "PI 401-31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d88714c-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697522838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522838, "uuid": "8a2f7bb3-d47f-48b6-8b66-b595421d2ed9", "comment": "Malware payload (Mirai)", "value": "9c2781cfc65ea1957523411a36047014", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522838, "uuid": "d35db86b-67f8-4d62-ac93-801d94b9d1b5", "comment": "Malware payload (Mirai)", "value": "e8aa9d4c6853a8cf84b9d85daa2751348818c56ae484ba22679eb3f73262b3ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522838, "uuid": "f339461b-954a-4012-877d-98b59d5a31c2", "comment": "Malware payload (Mirai)", "value": "1300a16ac391f06a171f6b7ff68ca8b550c55d21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522838, "uuid": "8b85224e-a587-4ea6-9cd9-151da98e9a77", "comment": "Malware payload (Mirai)", "value": "b5e90096d24919f5f64e71ffb6b8b70a1f4e86e3e9791cbb93bef14db155243d58268783aa3bd72ac9628e3e55783350", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522838, "uuid": "51597ff2-033f-42ed-bd03-1a92adbe7b9e", "value": "T143042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522838, "uuid": "643e21d1-e4e0-4202-bb7f-8ded8a824fda", "value": "3072:nS/NsKhjlvbAmfkIaboVSyckpj/HS0Bpyi/hJjogM/RXC/Ht6:nS/7lvlcIaboVS7kVdBsi/XMgM/RXC/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522838, "uuid": "b79a1ddd-0a38-4eb7-a5af-ec0240b4f853", "value": 179797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522838, "uuid": "2924edf9-6478-4861-ac06-10f6d37f8444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522838, "uuid": "1814e169-33c2-4d74-a8a2-851e16b6f83e", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1346b1fa-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697522687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522687, "uuid": "cdd8fa19-c341-4809-bae8-ce23bd5239af", "comment": "Malware payload (Mirai)", "value": "92bb42f68a5bc7653e73b88577607f7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522687, "uuid": "f1f515eb-d697-4ff8-9455-cc2d71e8e0b5", "comment": "Malware payload (Mirai)", "value": "ea6a75d923eace677097de5d864b7e30d30253cfe11da83bc57ad87a865b9084", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522687, "uuid": "a7301a46-949b-423e-a91f-e6b88390cb64", "comment": "Malware payload (Mirai)", "value": "192b4a5abc3034f7c32d0ebc1e7e14947fef8663", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522687, "uuid": "368b33e7-2540-4897-9099-2030430ea93c", "comment": "Malware payload (Mirai)", "value": "f5ab6707eaf0b6bd5864fafa90384fc3540ddc6400cd0852a1b4821f1ffcb868415c0a37766e95b00eb72da58c0e371e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522687, "uuid": "12c45ad9-3b52-4092-9649-112f0b93311c", "value": "T1F104885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522687, "uuid": "d30b5ac0-4fac-4fda-9e97-6dec37c51c69", "value": "1536:Cl2JvnXPvLkQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/znt/Y:Cgv/6cwZsCK9VRhAX+bShFSP0HbbnlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522687, "uuid": "6eb8bf10-3f3b-4ec1-b13c-fbe57deef1a0", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522687, "uuid": "3f6611b3-a4a3-424e-8960-361d42bdcd71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522687, "uuid": "f5503d2e-5961-40af-8342-40ffefb38e54", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f4f596-6c8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697505297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505297, "uuid": "078ef014-31ae-4709-8684-f362f2814bde", "comment": "Malware payload (Smoke Loader)", "value": "1f3bfca89128252b6de8c902012971bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505297, "uuid": "6d2368f9-ff40-4f64-a8c1-a5ee0c15fc6d", "comment": "Malware payload (Smoke Loader)", "value": "ebff69daab03914f10326e4e3ec464c00bfa9568723a75f80d74a19f1ac9dc05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505297, "uuid": "8cc0fe4d-122b-4c76-8b0e-d250728d713b", "comment": "Malware payload (Smoke Loader)", "value": "3a96d92e2d30c786e55434238ef987bedc1381c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697505297, "uuid": "f8797e7d-6fba-4b7a-b268-454ae191a7bd", "comment": "Malware payload (Smoke Loader)", "value": "070ae5420e6efc3da9d99cf9e42b9095bc17be96873d2ee6d70a554d2407f613ae7296d2b66b2c293105df60a180b713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505297, "uuid": "1fd8ae2a-5368-418f-b79f-a1c891948964", "value": "T1F325231766E88033DCF50BF158F64A871A72BCA15F308B5B73946ABD25B2180A47277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505297, "uuid": "bb9299bb-24f7-49a6-970b-38dbd481f268", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505297, "uuid": "cf85b53c-3613-4bc9-9e78-c856f6952780", "value": "24576:7yTRVpYQYJaiLEA8vrRIBOsE3BcTpa4q+qlfApDerAV8:uTRVpRieIBOfcTpqhJGGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697505297, "uuid": "a4d9d721-f546-42cd-a8f8-86205bb8b2f3", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697505297, "uuid": "0720a1d7-2467-4dc8-8526-43a4f5283ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697505297, "uuid": "73c6092b-8d49-431c-be0b-5a85ed6caf16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334a2181-6cb3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697522741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522741, "uuid": "6fdbb695-ca4d-404a-aedb-f37f5ff722f4", "comment": "Malware payload (Mirai)", "value": "918d78648464ecfc93e349563085973d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522741, "uuid": "f1b97715-73e5-43cb-9b17-82636029c5d2", "comment": "Malware payload (Mirai)", "value": "ec285d1489d587895822255d5ef7a025d9c02ecaa2f87183b6cf2de12d19b717", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522741, "uuid": "7d5cc15e-61cd-462d-a1e1-6ce39af75a63", "comment": "Malware payload (Mirai)", "value": "42bd625a28c5cf465fb22118347f6f97abe10e99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697522741, "uuid": "4e6de9cd-d9e9-4173-a3e5-88655c77b3de", "comment": "Malware payload (Mirai)", "value": "efa83c4a7490485aa1e76aa4ea858b34525bd1fd234407f234780565a54aa6e85b76d0b6c7327cf119ca6a92186bf518", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522741, "uuid": "e524b6f2-d951-4a1d-8ad7-b84f6cd28e60", "value": "T111E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522741, "uuid": "a4e40b05-ee7d-43fe-9f47-4df48f0f0d6e", "value": "3072:ZUIK7G4UWv4Wj4X5s9YHwIaOuxGj5zCm3295RpL:ZUrFR74X2uHha9G/3295RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697522741, "uuid": "5f3a2bd5-7c6d-45f6-92c8-32f91aab966b", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697522741, "uuid": "5a35e022-630d-4630-9a44-2625f6cb94b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697522741, "uuid": "71741c32-55c5-4bc5-b184-491a9d7fcb0e", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcb1bf8-6ce5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697544287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544287, "uuid": "3117ea9d-2255-4ead-ac45-50e27bb356d1", "comment": "Malware payload (AgentTesla)", "value": "98dd2038ebcfed11dd49c0e663babb41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544287, "uuid": "abdc7a56-bded-4f05-a303-0d892f4a16dc", "comment": "Malware payload (AgentTesla)", "value": "ec88127f108bf2d3963c92a80950bc8d6d2cfef67c6acdec7793169b89000ad1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544287, "uuid": "abfb48ec-d493-4f0d-aecb-e501213ecbf5", "comment": "Malware payload (AgentTesla)", "value": "2e13cedd28a54b6fd91970eac7497b01c8f74b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544287, "uuid": "d9a626c4-ebe8-4990-b04b-507b10b26063", "comment": "Malware payload (AgentTesla)", "value": "6b6254728fb3f4d66fc6d5e878412bbd61c70c3f2b4004c9887eeb6d83d5de551f01361d15d290eef66565aab8ac374c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544287, "uuid": "1852920f-2ba4-4005-a8f8-b88926b3cb1e", "value": "T16915D099324888B4D83DC3379322E18B8D3D6FE5FBE1D61D54C177EA27722C88986257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544287, "uuid": "982e2f6a-6867-4fbe-b1c1-a0f4ec7dace1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544287, "uuid": "92534b5a-16b8-420f-8d84-58d7b9ad1892", "value": "12288:rpbgA5Eu4x2ev1ls3k/KVgMhRFmMK986jTDmEyudqjQgOxwr:Jg7v1l3yguKC0FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544287, "uuid": "722e780a-697a-459a-a5f4-aeda523df135", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544287, "uuid": "15f9919c-9914-49de-be60-23108ad49db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544287, "uuid": "251df0c8-3a1b-4c34-92b6-e5fd387c1e9c", "value": "98dd2038ebcfed11dd49c0e663babb41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b03b398-6d1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697568844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568844, "uuid": "e3e16007-b45e-4da7-9db8-2e9731c80fba", "comment": "Malware payload (Amadey)", "value": "d0513eb70ef65b59c6e9e62be9db5f30", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568844, "uuid": "8db89551-93f1-442e-b4a1-b454f599b5b0", "comment": "Malware payload (Amadey)", "value": "ee127aacf5b33b65cd5aab4de71c02733eaeed420266ba9ba2eb2a21c3f7a27b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568844, "uuid": "1c908589-66af-4bcf-8963-a1a6e64e30f9", "comment": "Malware payload (Amadey)", "value": "791a93495990c3fb247ca42c9e8030fe2ff911c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697568844, "uuid": "2f70fa6e-81a4-4e4c-84a5-1d938d2a218d", "comment": "Malware payload (Amadey)", "value": "613249198ceeeb39e90816112ce8d8c7f9f06d78fbd21e1ecea78a33a98a35854779ab66e8ebaa67a72face47167202b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568844, "uuid": "111f92b4-33a1-4182-82a3-d4d7b28ad91a", "value": "T19435235AB7E864B3C57597F049F627870E34BDD28E38435A6384A90A1DF3A40A93077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568844, "uuid": "59af3604-aae5-49b5-a0b5-2aebe71aeed8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568844, "uuid": "5018452f-2714-44f4-b432-c3c797178c0c", "value": "24576:0yLN9HDyW+gJyLjUFtgzf9KY5a/5EARluQ+D77u/tdv8:DB9+W+gJyjUbsTa/eARgTD77uld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697568844, "uuid": "b7f7e52b-b196-468a-86c4-0980caa93e51", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697568844, "uuid": "2dbdac2f-406c-41e4-9569-46447e1d59e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697568844, "uuid": "6a438e01-e890-4505-ae19-1a6345edd85b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c267019a-6cf1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697549609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549609, "uuid": "65a023ff-8cbc-4e87-8343-d7ccb04d31b2", "comment": "Malware payload", "value": "30ad17b5251256476b4cd08177925cc3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549609, "uuid": "15c8d25c-c4b2-4c61-a82e-a22754006006", "comment": "Malware payload", "value": "ee7040038407e212bef659381503ba82d0ed427a9b41b2d14c4d91e8557fef01", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549609, "uuid": "16767fe5-3b95-4123-a3e2-78a255e0a903", "comment": "Malware payload", "value": "5fa6190423a674d4c521f1c71301b7638b0a01d8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697549609, "uuid": "03ba259e-6949-4ff6-bd9f-8df3020fcd26", "comment": "Malware payload", "value": "f5325f9f817f81268bff3c48c041a430e7e853a6ed8d55762a5da8e6a35442b3d7ae8f3a2be3d08600b58a48c0a0a891", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549609, "uuid": "b726e118-c036-4425-8b9b-4c7bb7935779", "value": "T138B312239C9F7611D44BF2773993C200D07CE62E7453AA4AF69185A98AB7D938C3C793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549609, "uuid": "2010021f-fef1-48a8-b155-d53e3cb83600", "value": "3072:NJs5QTq7XGnxAcfBJ8IXFfxtRsi8NVs1kXSOagIAoXu7Y:bs5QTq7QAa8IXFp4G1QZaFe7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697549609, "uuid": "58eb0177-91bf-4d42-b0e4-e0ccdfababe3", "value": 114553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697549609, "uuid": "6040a568-6b2a-46a2-a272-bd9be67864c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697549609, "uuid": "b695aa95-1984-4b74-8b5c-a18ab24c836d", "value": "LummaC2 Stable 08.04.2023 13 49 32.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37894de-6d01-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697556456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556456, "uuid": "e38e6672-5a2a-4fa6-87fd-da0df2cb3e3d", "comment": "Malware payload (RedLineStealer)", "value": "c5db29dbda198d883c92acd1660d2637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556456, "uuid": "75d966f2-222f-45ad-95e8-a28966ae9b4c", "comment": "Malware payload (RedLineStealer)", "value": "eebd51a870a715f575d761eb2172e7e9772ad50e04df3c444371fe1fb3810c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556456, "uuid": "58765fe4-fcb5-4917-bc04-483b0d066778", "comment": "Malware payload (RedLineStealer)", "value": "ecd1df74ccc26a7ce2bba163f80fa26d51105ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697556456, "uuid": "cdbfad12-723d-4843-900c-09ffb3dd1775", "comment": "Malware payload (RedLineStealer)", "value": "a4bf25c4433195e184eb0a07d3088972bd47c76a896b6ca98102992e313d76328fbbb29c959f94387032a186ff8837c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556456, "uuid": "babf436e-f9af-49c8-85bb-7a5a54c9899e", "value": "T162252341A6E41836E8F85BB119F303870A39FCD08D3887AB73849A1D1DB268465B777F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556456, "uuid": "65624c7f-386d-4101-9ee6-4baf88786ca6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556456, "uuid": "ca62bc7e-1444-441a-a87d-2d6b9a4f94b3", "value": "24576:kyLPRwD6LpxnbAExHAeXvn+XcmWQrDutuq7KGzBAP4:zdAQbAEx6txvuEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697556456, "uuid": "3d0b167f-45fd-4acc-9196-d2b69fe98061", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697556456, "uuid": "cd6611e0-97f8-484c-99af-5ebfe03b4a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697556456, "uuid": "206d6e2e-01a7-47cc-8ef0-2c7c9a8f68f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60724577-6d07-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697558894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558894, "uuid": "aff414aa-b945-4ff6-8caa-870dcd1a7584", "comment": "Malware payload (RedLineStealer)", "value": "801e280d92b3628d61ee3161ff6ba242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558894, "uuid": "1510f3c4-ddbe-40de-9de2-7a92678674c5", "comment": "Malware payload (RedLineStealer)", "value": "ef084f589ca9e0e3395495e211edf5903e986b77307ae0e515dc51886dfbffc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558894, "uuid": "b51d5b38-0a39-4a29-8fcc-1044177e9ed4", "comment": "Malware payload (RedLineStealer)", "value": "5e9389c387a36ebaa9aa03ff6f2ec9bce37aa391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697558894, "uuid": "22929231-b756-4210-8506-2151596b87ef", "comment": "Malware payload (RedLineStealer)", "value": "47ed74c462cd375059b9b83b0893151d38134627a9196915e24a8faa33215b95fe978203816452f6ae039b97f8995302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558894, "uuid": "8eaed5b3-3f9d-4e1e-bc86-d3a1a9b2e86f", "value": "T189252203B6D98132DEB157708DFA420709393DB2983483397796B8AB1D737A4A972737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558894, "uuid": "f1f47f7c-eee5-447f-8f1c-d0bbc317d0e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558894, "uuid": "b3a01aac-1201-43d4-bee1-e1931c3b6937", "value": "24576:SyfvxtggK9eTpGYB+adXqkrSJP5czqRnt4q:5fZtggK9eTpZBhNU5cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697558894, "uuid": "15ace95f-97ea-43d9-a706-6c1477c0f1a5", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697558894, "uuid": "d77b2b07-241e-4158-a69a-2da5b57263b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697558894, "uuid": "025e7a7c-942f-4861-bf10-1dd82748ffc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1f8885-6cd2-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697536365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536365, "uuid": "81c8fc44-4c81-493d-9c99-2cb1a53f89e5", "comment": "Malware payload (Amadey)", "value": "b565bc4485ccbbeba2bbc79cb35ea77c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536365, "uuid": "167fb4a5-8232-4dcd-a485-3cdf8c73e5d9", "comment": "Malware payload (Amadey)", "value": "ef12361cb4b92fcf46dce80170dd7ed00fb83542bb9ea47282df9ff2b9b804cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536365, "uuid": "842df2e0-9cff-4630-8ed6-466af5b657c2", "comment": "Malware payload (Amadey)", "value": "5eb22c839ba60c1510b8534c0980c5d9d3a202cc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697536365, "uuid": "e98c3ba0-1d57-4a78-9f4c-384fa62442d3", "comment": "Malware payload (Amadey)", "value": "3eeab3abf9cf967981dbd00e7c9636c9beb06cc46a4589389bb41e7455ef075c380e415a46f6ea7ae174813e9e1fd167", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536365, "uuid": "0799180e-c1b2-4a6f-aa1f-eccfd4995262", "value": "T154748D9E738DCCA0ED720D3905767E758DE7FA1236E169C7D58F732A2A342718294838", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536365, "uuid": "e59c53c9-4525-4ea6-9153-9bdb2b9ca72e", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536365, "uuid": "41cea5dc-07fc-4e8c-933c-a463ab2ddd35", "value": "6144:WhK3l99cV4EvAzvQh/Z0IHxInJO8Z0OZYlsvMVxnd:mK199mAZZYlsEVxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697536365, "uuid": "eb74b9fc-6e1e-4de6-9313-6528c81473d6", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697536365, "uuid": "d0d7631e-6280-4c53-9b6e-51c0572a1fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697536365, "uuid": "e0ee81d6-4690-4bd8-8e40-2d36dce57f53", "value": "b565bc4485ccbbeba2bbc79cb35ea77c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4add765d-6d3f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697582910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697582910, "uuid": "506f0b9b-aa8f-4738-9c29-569525139cd9", "comment": "Malware payload", "value": "f3765619a871f21f6a4efeb855464442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697582910, "uuid": "3480114e-c366-460e-b459-33a5a8994770", "comment": "Malware payload", "value": "ef16f375089c6984ae1326a75d99286c0f3db65df99faafbbca6f460c4ad2513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697582910, "uuid": "1c23605a-5ee5-4ebc-894a-48719ef78802", "comment": "Malware payload", "value": "b7e4ea73130769f5c0a340cf2a8bb80ebbc20593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697582910, "uuid": "40ffbc8e-236b-44aa-8529-4c106f73173d", "comment": "Malware payload", "value": "94da5a439a03cbec2ed65700c627bb33c12c4ba9d2e2b39bb3911a9f41bd11e0377ffdab2f4258a88acde8c10f41bfe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697582910, "uuid": "ca906208-0598-4b4e-8c37-d8dc8659f980", "value": "T14635231377DC8116DCF037B059F707931E36BCA1897C5B6A174CA8192D73282A9B2B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697582910, "uuid": "afcdef09-efab-4752-b5fc-b978f25ab3cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697582910, "uuid": "41496072-7a86-4284-b9ed-7c036bc08cb2", "value": "24576:+yFKQMdTFAX8sJbg7yZYSNPdMzJpMPXjWAly+fPGxXGEhP:NFKFTTog7JSpdmrMCb+yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697582910, "uuid": "79df1425-c840-4d35-8644-38db4717384b", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697582910, "uuid": "159470ff-9287-4e97-b35b-a73aecf88d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697582910, "uuid": "d3bfeb18-120c-4aed-9f17-0318b3771af4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3f9760-6caf-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697521195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521195, "uuid": "a7331c23-5b34-4ffa-a194-3c40eceac0c0", "comment": "Malware payload (Smoke Loader)", "value": "0a356bbfbb0bdab81dbf5a5612e384de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521195, "uuid": "01e388cc-e740-4369-9a74-818fb7ab8f71", "comment": "Malware payload (Smoke Loader)", "value": "ef5c75eb4f74e74aa7b959cb11c008e530946a792897584dc5b2a82c2dcab1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521195, "uuid": "d7b0ef0b-1ae2-4fce-89f1-d42c6fd7dcf7", "comment": "Malware payload (Smoke Loader)", "value": "ee7198dcc237a4833bde256b5f30aab555827c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697521195, "uuid": "1cc78c87-e381-4c39-8f2c-8fe1e597dd1c", "comment": "Malware payload (Smoke Loader)", "value": "44fa279c09186e772a1b167e03859a8eb85835ddd8307a99074f4056204e7652aa1e263b321cc05c2f3d92a22f808e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521195, "uuid": "b2339bd4-572a-49ea-b711-6c19a328ee0b", "value": "T1BD552343ABD54133DCB62735CCFA0B831D347D969970546E2AD5AE9E0AB3A14B83133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521195, "uuid": "9f7bdfac-1baa-4bb9-8ae2-87696f41c84b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521195, "uuid": "913656a8-3206-49af-9694-53e802ab4291", "value": "24576:sy07BT+KpVuprqJL9LPiu/who+UeMBcJ0YSGTZ4eUcUzb78JQ:bpo0puFJT/who+UeLJ0YS04P4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697521195, "uuid": "5077ebc9-caa7-40d6-9dce-d9d878f29293", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697521195, "uuid": "f2337eb9-8cd1-4ed4-bf56-fdc47e2c4624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697521195, "uuid": "8ff615b9-1baf-412e-a6ca-b567b676276b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87e958c-6ca5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697517005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517005, "uuid": "6ba5e42f-3fd2-4696-b80c-b91d8db5f55e", "comment": "Malware payload (AgentTesla)", "value": "ba34171bac4af99fc4d2fa5a97258a8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517005, "uuid": "68e558ce-a919-4be2-9c29-59c604450498", "comment": "Malware payload (AgentTesla)", "value": "f0434a122b65c29c06a46d345e188c7c8c60e239def6a8f55f39feaf5f3f624a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517005, "uuid": "9c1ac6de-5f55-4f39-ac02-de415c46489e", "comment": "Malware payload (AgentTesla)", "value": "9d7f8e59282c3ea16d192743736a1b59c994276e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697517005, "uuid": "f0fd2e0e-f831-4314-8ca6-6c8b8e4d7df7", "comment": "Malware payload (AgentTesla)", "value": "9187bfb2819e6aa91f9fb4ae573fb102d0e92e9d0dffbaf55e28991e2a85f3d019901e47b4837926885e9d6db99290a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517005, "uuid": "11ad349d-46f4-46d4-89fd-9b027a648cad", "value": "T1CAE4236873A9DAF2D2EBE7BB5B3001000E767B4D8992D3DD4E4410804DB62476FEBB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517005, "uuid": "2a23bb77-d89b-49aa-b238-6fc78d52dabf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517005, "uuid": "9b7668a8-81b2-422d-92b7-fdded8361b87", "value": "12288:wKlBLXmsrJM1tKvXJwh2xhVpVurvhpd6dVVmEVP7tXnSDtl12vvgCZxvbqxozvra:wKvLWiMXKhwwV7VLJAJH2vzjvb8Iod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697517005, "uuid": "efd95b6a-5ed1-4549-bd27-cf951b03025b", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697517005, "uuid": "bd0aa6ac-678b-4158-8777-3e00f730069f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697517005, "uuid": "f3ef8fdf-4824-425a-ab03-0a83192a204f", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.710.14321.23756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4153e05a-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697545957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545957, "uuid": "ff9196fe-1150-475f-a7c2-66be9c465e32", "comment": "Malware payload (Formbook)", "value": "b5519e41798f037a08078e7cfd73a0bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545957, "uuid": "ac82751b-0db8-4ded-acf6-c489a65524b9", "comment": "Malware payload (Formbook)", "value": "f0831ec2522d7d8e085f88c8ead0df0478c75efe438e8449bab3f54553e47788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545957, "uuid": "74d5f36d-caea-4f6a-be9e-44eefa27f51b", "comment": "Malware payload (Formbook)", "value": "de06bdfea12829cfca118f689f662bacc17fc500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545957, "uuid": "4885f61f-7e27-4f03-98b5-4923e02863b2", "comment": "Malware payload (Formbook)", "value": "45a24e825d5faf8db4fefc15613eed1a26d406faee6b2486377c675ab7135efe0505ee74ab8706d6a63f6f10fd6bf44c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545957, "uuid": "3fe6ff40-a080-4d1e-811b-b32e1bfe6aa7", "value": "T171B4235063A084F3E93719351E7235424EF8ED3C1976450A6B207E6FBA32DEAC9279D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545957, "uuid": "33665584-5266-4598-be20-704f4f3aa0f6", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545957, "uuid": "9f065ea4-6cc9-4a7c-9f63-9840cb8811d9", "value": "12288:DfLRnYsH82S743zbp/UPUYCQI3+H2v6+AuzPkYHiItfY8qzu9rEwy7:DfLR5B3zVSUYPA+WC+A4kYHpgu9Iwy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545957, "uuid": "18300068-3bc4-43d3-993b-0dc9a7123c6a", "value": 530950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545957, "uuid": "0a7faa47-8762-47b6-b522-d0f1dadc56ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545957, "uuid": "8fd01b9e-e4e4-4d99-9606-09a73571ccb5", "value": "PR-QEX0009102023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0063477-6cd5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697537553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537553, "uuid": "09c5c339-87bc-44c2-b7be-d1466b67d430", "comment": "Malware payload (AgentTesla)", "value": "a989f8f031b43dcc3755bf4ed6dc7ea6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537553, "uuid": "8d18c113-48ca-4a2b-9218-5d64f6218dfe", "comment": "Malware payload (AgentTesla)", "value": "f0be69f8a14b212961413f78ba3c60287d5a96c80c384fea50febdc98d7d8a1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537553, "uuid": "800368bf-d1b6-44b2-bf07-644653fb97a3", "comment": "Malware payload (AgentTesla)", "value": "b9a153cdb9cca20e7c5e9fa11c31a9c50e8b09dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697537553, "uuid": "e6f4b0d9-3dcb-4955-90bf-146496d1d23e", "comment": "Malware payload (AgentTesla)", "value": "4198fab59d45d6c4221eeaffc0830b2d6727a7a85f497bc01396c2988e37d98a52f36116552d4bbb60e765651346d130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537553, "uuid": "abff5a28-b0f5-41fd-9301-d8f6427eb569", "value": "T12765F0039804DAC3C05D83F8BD1329E90E0D7F2AE8D579DB14967F9B3A31AA7095E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537553, "uuid": "222e0c0b-038a-4f88-abb1-f4a6b77c5f3d", "value": "24576:oWQmmav30xsxZyiw6VC+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXopeGZyOw6Vp:9QmmQ30G7y6V76jG6Vi6QWbXknnqUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697537553, "uuid": "83016cad-fe3c-4a47-9668-29ec0fff8652", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697537553, "uuid": "c38f3572-168a-4b67-9eed-e1524a7e8375", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697537553, "uuid": "fa6f598c-b152-4889-b762-d72db31126f8", "value": "project order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272fedd1-6cf8-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697552356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697552356, "uuid": "6d3b9938-8283-4139-bc3f-cdcfac4cccca", "comment": "Malware payload (Healer)", "value": "c950caba89c136b14c906d38f7705adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697552356, "uuid": "fd5dbfe6-5b44-496f-8e6b-6258388011c0", "comment": "Malware payload (Healer)", "value": "f0c223a0f7a1c23a6ae1841202d16dce212051ac42777add4007b408db029df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697552356, "uuid": "efc755d3-6e93-4933-8827-cd5cdd0a7401", "comment": "Malware payload (Healer)", "value": "ba023ef7430cd3a188b4bcd56b41179124c49209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697552356, "uuid": "14265a36-7fc6-4dcf-b8f6-dc18463e2378", "comment": "Malware payload (Healer)", "value": "86e62b7afb08cd34c7350be79417b41234520bd554cb313690ba50de0567888cb2e7eb64de297683c897213972aa0750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697552356, "uuid": "fb7cfa18-5353-430d-bfab-2686dee9a89f", "value": "T177252356FBE64133D9F8333059FE01C306267C566E308757374A9A9A18729C8AA337B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697552356, "uuid": "7fbe6cfd-a9cb-4907-9b99-f66db2000c26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697552356, "uuid": "d38a9d80-06e3-4339-aeac-bdb5288a360a", "value": "24576:sye5TtacpZF9mvLPTEXVXTLBpbibKhYqw5Kk:be7bF9lvXbiyYL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697552356, "uuid": "c0a2dcad-340d-4773-a744-a74574a46926", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697552356, "uuid": "352e1528-ac07-4d9f-bf44-9ca12bd00dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697552356, "uuid": "d43ef49b-a393-4bcd-a64d-182e2e112a3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19932ef-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697539730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539730, "uuid": "8ee6d402-27b4-4273-ae08-125f7e5d2baf", "comment": "Malware payload (RemcosRAT)", "value": "6d17bb6761d398982b36ec58718f48bb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539730, "uuid": "7134d2d3-5d29-4478-b80d-d25f9ac8a8b1", "comment": "Malware payload (RemcosRAT)", "value": "f1921797e44af27d89007f013248706f6dd159ee3013c5b5270c7b8aff9caf51", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539730, "uuid": "ee66bad0-9764-48b5-b315-16471bd72557", "comment": "Malware payload (RemcosRAT)", "value": "9d77828cf50c7821abfb904dc355e01708321867", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539730, "uuid": "3ddbb4ac-084e-4f6e-8972-decf8344539a", "comment": "Malware payload (RemcosRAT)", "value": "87b72affa00c593af6ae00bce2c24db13af8603187fab51b3989345b87705d91db847c33593164d209250fae0efa8a09", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539730, "uuid": "8332ab35-52e7-47f4-b3de-1c73df8a0425", "value": "T19F53BF2E3262E48AD0535839CDD8E1DB23147DB24E12A20F32C47B1F6D79AE1875BB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539730, "uuid": "9a40314d-c39b-4252-a246-6ac3359e9f85", "value": "768:Dm9JtwPd1s8qFLykjT8BP0JBhK4Pd+sEfo5ID1uIA79vm3cGAZ9ZacQDwAzWsh1:Dmht8q9ykjT48JPbPN4hZbAZ/CD5Wsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539730, "uuid": "5deb2aab-4a07-4a5e-b5ec-c70ba316f39c", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539730, "uuid": "69ff244a-7ab1-4284-b6a5-77e66a7c53c9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539730, "uuid": "76db9bbc-9df4-4a74-9aca-3963651f8225", "value": "Request for Pricelist confirmation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621862ae-6d2d-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697575218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575218, "uuid": "288027d9-3c4e-4e18-8c3e-ff4268dbdeaf", "comment": "Malware payload (LummaStealer)", "value": "11805e6ce328c625f6193211c2332052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575218, "uuid": "cd7530df-0872-480b-909c-a6e30c5bddf6", "comment": "Malware payload (LummaStealer)", "value": "f2210b5c1fb35a924501a0a2dab08116de989eaa311a038bf1be1dda4a2a3947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575218, "uuid": "43f15226-6e44-4389-93ac-b47220e8633a", "comment": "Malware payload (LummaStealer)", "value": "9aeebe0afa2e1e07ef52dd41cce626d7df7c6cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697575218, "uuid": "a5bcd71e-2b90-4916-b8ac-bdb14e6b4943", "comment": "Malware payload (LummaStealer)", "value": "d84c53c483d3a33a9b46af2bfa598d40822d8eb62c76279d79323e00e51a0d49bf78568fcd87262f2c9ba5248c820d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575218, "uuid": "b88f0014-b89d-4488-a595-ad8647a60ea2", "value": "T1CE44AE1074F1C472D872253209E0EBB65A7FB9200BA59AEF67D41F7E8E303D19731A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575218, "uuid": "a28c27e6-7d5d-41f0-b20e-4a3895d44cfb", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575218, "uuid": "120bfccd-f6be-49a9-a276-8e869adb943d", "value": "6144:5hC+mkRx5bthfcEjA/ulUpIhWqAOvW83kQJSb:nQ+5bth0yzDJSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697575218, "uuid": "cc72c0c1-3752-48f3-9d37-0ff5d1f96ca8", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697575218, "uuid": "9e005f01-f9cc-4c83-a666-273e5fd43fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697575218, "uuid": "0c150dcb-2c90-4d6a-8d93-ae32788414ff", "value": "11805e6ce328c625f6193211c2332052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce78d7b-6d20-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697569840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569840, "uuid": "b1e54659-e6fa-4f00-85e8-182377bea1c6", "comment": "Malware payload (LummaStealer)", "value": "0a3f73c9c0e10b17c5e9a1a153b1a86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569840, "uuid": "46282fef-1fb2-4cda-95a1-2fbe74ca7f0b", "comment": "Malware payload (LummaStealer)", "value": "f2a2eedef3387ad8c34749bd62c625465bce8e7aafbc5efe4d8402cf39d48ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569840, "uuid": "127d311e-b4d7-4c08-bf8e-f9a5514137e1", "comment": "Malware payload (LummaStealer)", "value": "217a74a478f4b4132a4f0e79c19c360bed5d2098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697569840, "uuid": "954d3d32-23b2-4c21-86db-d2c258362570", "comment": "Malware payload (LummaStealer)", "value": "69e703832450c7e54e0bf7596c727605676795f325ed38b52b70620eb6370d4265b142c9ae260e324bd188a564150469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569840, "uuid": "b1beaf71-d21d-4dcf-9e47-3afafa436cd9", "value": "T169352256EAD19177DAB4173005F65BE34F3A7D729C3C925E2709E84D0CA3B9028393AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569840, "uuid": "d291d81c-354c-4a64-82c6-c7542742df77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569840, "uuid": "85858422-c8e9-4611-b930-a9116bc8a534", "value": "24576:ayXqPjnuFsO+FWTtyZyfrRB5eoGAul7ZM6DsxQ:hXq7WdTYU1epAulxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697569840, "uuid": "136b18c0-3c6e-4160-861f-751bc1fafdbb", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697569840, "uuid": "97066272-2af9-42a8-9b45-813764e43b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697569840, "uuid": "acd9bd22-a96d-4263-9b04-4946af1321ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bcb315-6d17-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697565929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565929, "uuid": "da05ca9a-952f-4b43-90ab-79da23a525f2", "comment": "Malware payload", "value": "49bedb7598525f0ad00909a398a5e7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565929, "uuid": "c22c37c7-476e-4db8-bdf9-358631e3925b", "comment": "Malware payload", "value": "f34053453587ed5bb5cc44041732dda7101f5fab23a8080dee965dbec596d2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565929, "uuid": "5300d509-99cb-4161-92d8-7d986be02d9b", "comment": "Malware payload", "value": "b5e150a5a810dc5568926df25b215c9e901598e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697565929, "uuid": "40d5ea40-056d-4875-9b32-3f6cf2767735", "comment": "Malware payload", "value": "60e5b58ef0460025d9ad2895e37622eacb8844ee78cba811553a2996f647030d097043e5f29f16c0d6a6d0c292e98f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565929, "uuid": "466812d6-13fd-4015-a747-88c426dfd6e4", "value": "T179352347A6E98422D97A57B114FB07C30F3A7CD18C7D829B3E80B59B1D726C86A7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565929, "uuid": "6ba8392a-21d2-448d-bdf0-27f3a07503fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565929, "uuid": "3fe49182-a68c-4fea-b58c-347c7b915e6e", "value": "24576:Ayo25nzYB7wPmDyjGrKYgLXnOyyf04J5F5jIOMf1otsAFY7lr:HXYBkPuy0KdLXnydrp4GtDFY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697565929, "uuid": "5531f4ed-aa79-440b-830a-cdcf8152cf0f", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697565929, "uuid": "c557b692-d701-4877-9a0c-b1768d7026de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697565929, "uuid": "7c5128c3-66fd-4790-befa-db8e35f50ccb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da449b4-6cbd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697526972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526972, "uuid": "4a17543f-7244-4ed8-b005-3cf6bf6f2f8c", "comment": "Malware payload", "value": "d9b9175dc28ace37a63367a93949ff61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526972, "uuid": "cab63f4a-f05b-401f-bb1c-c5526e668aba", "comment": "Malware payload", "value": "f36c313274772df24ce8238b4d1305875a662ae49806d8a1110ab42c3ce1516a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526972, "uuid": "1b91b7fb-276f-45d9-9bfa-ff57246b8954", "comment": "Malware payload", "value": "08f4e35e9da7098ea25701c5d79fee2e9761cc0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697526972, "uuid": "77566caa-2911-4f37-bf5f-c70be5891052", "comment": "Malware payload", "value": "a8602771564820cdad8fcb8ad2523689f2a1580bc3743d51f5f435d2612ad251d1e016f0a53ce570cda90c3919f59dc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526972, "uuid": "b699f7f1-900c-48b8-8bd0-90708cd7ef89", "value": "T15FF4021477AE432DE3764FF868B494540B70B9613E20DE7A0AC8B3DDD826F066630B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526972, "uuid": "168b5217-d14d-49f2-8407-604315d4fe10", "value": "3072:pewbCWG8zIlIp5aM2SvA4dn920/AC8q7m0ARjEbAgrVA87Ys9Krx90e4tLai5vlR:pXbWlIDaMpd920/o0ARhgzMrsQcv+Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697526972, "uuid": "dceea035-c749-4a02-a718-55000bd08e99", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697526972, "uuid": "caf5e1d0-f644-46b0-a6d0-a1216e5d8cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697526972, "uuid": "1ba4b53d-318c-4123-80bb-61531ebf5162", "value": "d9b9175dc28ace37a63367a93949ff61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0a479c-6ce4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697543965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543965, "uuid": "05f18448-ed2e-437d-b960-c0a8ff7ac7b8", "comment": "Malware payload (AgentTesla)", "value": "9d1dfc2adc6e191d54bcf23a43e221f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543965, "uuid": "c57b5c1b-6f09-46c6-9d88-65e87e9f1be2", "comment": "Malware payload (AgentTesla)", "value": "f4615f0f60bdbabef82384ec728d4e402eca70ebc1a49b3b8bb7b155292e3fae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543965, "uuid": "52ab9c4e-c6ca-40bd-a77d-7740fa2c2c35", "comment": "Malware payload (AgentTesla)", "value": "b9f81775a246c9e7025ee601dc2a7cb43ccc2913", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543965, "uuid": "a6e7feed-6f14-4882-90c5-7758c86d779d", "comment": "Malware payload (AgentTesla)", "value": "9fbe9f235c659276036f7e9260cebbd9b7b46ad656d36f225151eac68bbdb36bd7f3ca2b50951a5020b9c72edc1d313e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543965, "uuid": "e6715a82-91bf-4df6-b69b-ef05e62bc09f", "value": "T1FF351211BAC184B2E9B319345EF2B321AE7DBC301F249D1F8F401B5D6F70591A936BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543965, "uuid": "876aec87-f0da-49e6-83c1-0d615b529113", "value": "c127345c03c7eb109783c6cc61e16834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543965, "uuid": "158b0ec6-702c-41f4-8df4-93190d2a330d", "value": "24576:U9qFtp688NYHlTLl1aXVnmn8Ntwpp+hEfgmyBjuRlFfoH:+88aHxlqZmnyqjfgmaS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543965, "uuid": "5a8f7fc9-c392-4bea-a95c-47e7c7a706cc", "value": 1064662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543965, "uuid": "ec8df8e2-3c4f-40b4-8dbc-ff5fbbffe18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543965, "uuid": "77c36110-d4dc-4d58-8ec8-7c023360c16c", "value": "9d1dfc2adc6e191d54bcf23a43e221f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8a077b-6d24-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697571370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571370, "uuid": "3e4cfb59-3c56-4e9a-8f8c-d89ba26a53ee", "comment": "Malware payload (AgentTesla)", "value": "47918858c5c70518dc3cfff8e7b0acb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571370, "uuid": "b66b498c-16c5-487b-a8b4-5822bc257888", "comment": "Malware payload (AgentTesla)", "value": "f4db8a1f981a33479e7ee3013aa87145041d97e0c82083c78c508a6d41820f09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571370, "uuid": "b7a354c2-e01b-4d65-a28d-ca0b6154b97e", "comment": "Malware payload (AgentTesla)", "value": "b64c334078ce304f662fcd32ee8b937b1375da75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697571370, "uuid": "07fd32e4-b53c-4187-877d-70e3da3180a5", "comment": "Malware payload (AgentTesla)", "value": "bfb8804aa61e3a41c448c63e979c12d71fd9fc12ad741c4513e5ce6bb26739d6763674bffdf6c572516a979b33af071c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571370, "uuid": "35b6405d-cba0-48a4-aa51-306f6e0d90e2", "value": "T1E6257F3D29B9263BC1B5C3A9CFE1C827F154986F3521ED6598D393A64342E4639C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571370, "uuid": "45846eb5-1fe5-4001-a67a-424a1a36c796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571370, "uuid": "2c6edfed-ef1b-4b61-a51a-5cd05c6565d6", "value": "12288:jAqhbFmPtbFcWglB3TcZVofvNuIO4W2zvnnUSgaGANa:cqfmPJwL3oVofvYIO4Fn4ana", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697571370, "uuid": "1d063702-5c23-47f3-9360-002ab6fefaa8", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697571370, "uuid": "06056946-8e09-4f48-87d5-cdc964e7f15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697571370, "uuid": "1a98e490-ac14-4f28-a47e-83f27073c4c4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14560.4450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3958e9fd-6d04-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1697557540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557540, "uuid": "d0e37746-85b3-4f6a-b713-a41633dc7a02", "comment": "Malware payload (CoinMiner)", "value": "8e0907f52947b06a7b2f4a3ff064ec2d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557540, "uuid": "f46cf9af-2c38-439a-a5ed-e8d5d798fb95", "comment": "Malware payload (CoinMiner)", "value": "f5337c8755def6dfe13adfefb348a01d4b569d731e4ee40561587079c0e54486", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557540, "uuid": "6416af44-2656-4e1c-a224-f6208fa5c255", "comment": "Malware payload (CoinMiner)", "value": "f22b45b8eab6a0a5d448e8c38fa1f8d0eaa6cc2a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697557540, "uuid": "bbb70716-41a0-4125-8718-26271c9c30ef", "comment": "Malware payload (CoinMiner)", "value": "cad2a94c06fb777af0d3a88dd2821ab0890137f2e30ff4250b71f9fefe4ed9d9e4c63a8ac0dab66f908270ef9baa232f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557540, "uuid": "5d43aff5-4bc0-4cc4-97f3-744e290d6088", "value": "T1CE46E18B8FD1567BEBF394F86400A39D5564BB5AF54FEA40E3A2347C5B804C00E5BB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557540, "uuid": "84fbbe50-a58d-41e9-a037-a9c175823fba", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557540, "uuid": "b36975a7-1d75-44ae-803d-1140ee98f31e", "value": "98304:yzMMH/yXitS8hC0qmtmHTUZ6F8V8s1TQU3Cf/J3+EbL2Is:yo7z8h3qm1Z641lSZ3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697557540, "uuid": "ae7e8f1f-747e-4829-8b6b-77567f1259ff", "value": 5685248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697557540, "uuid": "7332b255-f14e-451a-86dc-0c13b77e7450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697557540, "uuid": "9b58320c-fa52-402d-b5a9-429702e82bcd", "value": "SecuriteInfo.com.Trojan.Inject4.61470.20255.4858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a3ade6-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697523758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523758, "uuid": "a45f1361-2c4b-487d-a486-71671996165e", "comment": "Malware payload (AgentTesla)", "value": "a8859f0203ac5f0265dbfb2b7ded0e64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523758, "uuid": "a598252b-b017-4b7a-9937-1b356fa50598", "comment": "Malware payload (AgentTesla)", "value": "f637bee377aafb82f1cee23f7aaaec2e84e88a0a32945daf03f6fa7862f8034e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523758, "uuid": "f919cdfa-fa5c-4c88-90c9-d3b36dc47e73", "comment": "Malware payload (AgentTesla)", "value": "ae42a49a3b3e6c9ef20ae8ab49632e0ed44551ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523758, "uuid": "bb7969b0-4cb5-4f41-be08-050c096fa575", "comment": "Malware payload (AgentTesla)", "value": "491b1aa1bf716526cf8e623c9568862cd5dba61e27e503cc30a284f651b36ba129d6ce4813d68373450ee57093761b6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523758, "uuid": "3c84f014-3d11-470f-8139-d6f126d930f3", "value": "T1EFD3F124727DC45AC1A35A7A4ECDC6FB06197C92CD43D20F3180BBAD16B66835B9A73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523758, "uuid": "a42fd6ab-e8c0-4b66-a791-e624a529a002", "value": "1536:qnsZ955CNvDUyPILbqcHKITjjT48pSaAq+iA4BBhoftyHHySRArb9kd20d7tJJ5s:qwzcgBbqovjT48gd4BBhAtKzKsdZHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523758, "uuid": "c027f884-e3e6-4047-9d82-4c93e5e4093c", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523758, "uuid": "5110a242-a267-46c7-b50b-882d5a2b68e1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523758, "uuid": "32c23309-7a79-480c-9494-9bb286f6d237", "value": "GTB0088.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77eef42-6cdd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697541109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541109, "uuid": "4f94d4c8-ad4b-4564-823b-6eb070a12d08", "comment": "Malware payload (Mirai)", "value": "1e7b16946c515552c06ac82f10f21b0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541109, "uuid": "255957ae-e88d-4ce1-a1e4-de848141d7ee", "comment": "Malware payload (Mirai)", "value": "f661666c87b0e86161513f4419026b32deb61b66721b9a091f60c8104a0a5e07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541109, "uuid": "4cd8a120-151b-4726-870d-356b349214b7", "comment": "Malware payload (Mirai)", "value": "bead684e3bd1301bf4aea5734f5705657f92304c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541109, "uuid": "d1e348c5-8713-4b06-91a7-2fb96d3399ec", "comment": "Malware payload (Mirai)", "value": "be47d81274d0a9cc8a1183c3b336843a8a407c5156aeb264b7eb667e7ebdbffb41d10a2d6c8d085318bcd1c339d33b9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541109, "uuid": "a5b5e81e-5ee2-4be4-94c0-39baccd6865b", "value": "T152B34A77C8296FA8C259D5B4B0B09F792B63A58182471FBE54B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541109, "uuid": "17ff2862-9bc4-4d0b-b73f-9fbf8fb46b23", "value": "1536:2aVTHW/qIAmPq9NHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zB:2qWLS9NlDWMSBOlvC2sWqXxQrbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697541109, "uuid": "6167510a-4547-4f05-91c7-650a268da849", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697541109, "uuid": "92aa49c0-764c-46e4-aad3-3ed60c4cf277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541109, "uuid": "3046ea87-dd8a-426a-8d71-c376c10e54de", "value": "1e7b16946c515552c06ac82f10f21b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8ea3f1-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697539721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539721, "uuid": "8310b05f-a9b8-4284-ab7f-738a5142a68c", "comment": "Malware payload (Formbook)", "value": "9dc0fa75f318ea3d4dbe13107f6df495", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539721, "uuid": "1fd380bc-a153-4fff-84b6-0811af91cef6", "comment": "Malware payload (Formbook)", "value": "f674b83725d615e709f4b9296a29c9edafd504b1271880780657e70d999583f2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539721, "uuid": "225e5bb4-ffa7-4d2e-bdad-8f090e72cecf", "comment": "Malware payload (Formbook)", "value": "f495cf2d15b785fb33207ce989dd6b261702e999", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539721, "uuid": "f1b0ae75-40d6-4f22-97fe-d623044e303f", "comment": "Malware payload (Formbook)", "value": "24de188fa59853b6083603c5844feb6b74fe174db3209726de3400d7ae6d47b209753d0688aa1f2bba363a9de7a3eb8b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539721, "uuid": "2b62d5e7-a746-442e-b628-fc1dff70d305", "value": "T178E3C517B68A8BA1C3852F3AC5D71110076CE589A253E74E778E33DB2A4B37AEC44357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539721, "uuid": "d17b4d77-86e4-4fbf-97da-87a0d07cb143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539721, "uuid": "855e6126-51de-4474-b08c-56f318397b4e", "value": "3072:9jr7ukbVIfX0QmdCOTAh8veqGO0xgUbQz3xRPz:9DukbApHhFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539721, "uuid": "da4b969f-559b-45c6-bd30-36f430c97e82", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539721, "uuid": "f1767008-0695-4fd6-af75-b91a5a5d4dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539721, "uuid": "29f4b70b-be95-44c0-b652-3310ed81d32b", "value": "Dhl_SHippment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40941470-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697545956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545956, "uuid": "44b58943-a67c-487c-a7ef-ff53b58c150e", "comment": "Malware payload (Formbook)", "value": "7e516d3bc7163e43892644cb185b3eb2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545956, "uuid": "0d2325f5-f423-417d-bb06-aaa29708e044", "comment": "Malware payload (Formbook)", "value": "f6d96f65d6836ff0746b2c2e1ade335bec6befe7f8c5927bddff3da5bccf1490", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545956, "uuid": "15ea02ae-1bf0-4f37-93b2-409d648e745e", "comment": "Malware payload (Formbook)", "value": "c064b75b6f304144ba95a43838c4403baa01997d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697545956, "uuid": "2c69003e-6677-42e4-a056-8b7b0655902b", "comment": "Malware payload (Formbook)", "value": "fd32dc675acc2c310019a36bbf83870bfbfdd66f9ca98b63cf32d44b085d78ac12eedb15ab9f192af7ebb1ad641f7a03", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545956, "uuid": "b475ad7d-a05f-4ce5-a959-a4028e74a5c8", "value": "T118B423C248A51BC9E7A6B311EC5EF258C2A1917C5DBBFA3C1359607BB87186B0C359C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545956, "uuid": "f89dc1f8-a976-4b70-b8f9-a1a478873fc3", "value": "12288:jd9fsb6qvnw9g11zkA3aSz37jhCNjOB5norDAXl+RJK8N6dXAtaR:59fo6qP0Gz7d0qB5noriR8N626", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697545956, "uuid": "514a2277-b162-47c9-94d8-582038f9ad4b", "value": 511346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697545956, "uuid": "cfb0a62a-5355-42ae-8678-cf0f9d109af6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697545956, "uuid": "88ee0439-9593-44d2-8c42-9b0f466abbb6", "value": "PR-QEX0009102023_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff29833-6cb6-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1697524104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524104, "uuid": "2e78741e-5d44-4c35-899e-fe76fd90b573", "comment": "Malware payload (zgRAT)", "value": "43f6a3400d70a7b87a482333ee864411", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524104, "uuid": "41ff330b-352f-46b0-be8f-5fab21eed156", "comment": "Malware payload (zgRAT)", "value": "f73577433746d6b20849bce8f29d8be665c3ac284af3c41d0007eb8803d2eb75", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524104, "uuid": "a6e7f2d8-1799-43ad-ad91-7bf13a5d2f4f", "comment": "Malware payload (zgRAT)", "value": "d6152f4bccda94cdfe4661c5b935a715634199b1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524104, "uuid": "f46bbe10-3d2d-4bbb-ae94-a0d954870a28", "comment": "Malware payload (zgRAT)", "value": "59f20430d212d92d271a5ce8fa3aa909ab837a3a278d40b791c645640aaf8969c08f26a573c7e8e655a423cb0d017ad9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524104, "uuid": "219365d0-2004-49f5-8f7d-e590b2ae68bc", "value": "T135F423EE217184EFAA7B93F41ACC00E85E1C161899E5B2737674CF6C31DE47D9508AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524104, "uuid": "48b643de-16cc-4f57-b5ce-13ccbc5be1bd", "value": "12288:v/zWlLeKTOGgtBMcRDDNNgZ/PBc5/ciBrw4kQKMmQYvgnXyyncJkKnNlULZ7ESy:vszTrgtFIfM/frw2KMmQPXy+caKnNlgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524104, "uuid": "b02052d4-80a4-4472-9713-0e0f44e1c74d", "value": 736280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524104, "uuid": "6faa7892-6dff-4164-ae3c-318bdeedc48b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524104, "uuid": "ca516d3d-0691-4892-bdb0-c12765d946ca", "value": "cotizacion.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559aed70-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697523228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523228, "uuid": "8a0c63c1-9b40-42bc-9143-c2376275a282", "comment": "Malware payload (LummaStealer)", "value": "3e6396e71dc59a4f48a423efad163553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523228, "uuid": "02c172a6-80d7-451a-87c8-948d41d14673", "comment": "Malware payload (LummaStealer)", "value": "f76c7d8841a467f13ab5d2c39b56d297a2fa94867973c201d40f877355849092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523228, "uuid": "cb70acbb-9ea1-4eac-9b3a-12d485754e6c", "comment": "Malware payload (LummaStealer)", "value": "075a7c5e3b0cc8f3a555736d94bcde47113dffac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523228, "uuid": "fbba1711-12df-4d6a-8a66-4e5a9059784b", "comment": "Malware payload (LummaStealer)", "value": "ab5cda2a8b53b9672b9dd655e69d7f751340bce9efc0beef569dad006e2e78c14b8023337397a0971779916742de9403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523228, "uuid": "3506bcbb-1425-4481-b479-be14f9d14c2f", "value": "T1FD25F113B3A686BDD7D5073AC5A7861403B9D182F6A3F70A788D12DE190B3BB5E71207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523228, "uuid": "188bdb75-a8b1-47bc-93b2-1f1419ef4095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523228, "uuid": "7351ba5b-7a9e-41c3-8eb4-9ca71915462e", "value": "24576:DseTp5mBcG8fk+rQX0w6Zw2dD9wdt3XC+woozvoe:rTiBcG84X0zwWSudTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523228, "uuid": "373a41da-aedb-4f5c-9e5e-0a78771d7473", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523228, "uuid": "133ef56e-1d85-4f6b-b236-78c40a8f057e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523228, "uuid": "b51602f5-689b-4a31-9ed5-5cc705904171", "value": "3e6396e71dc59a4f48a423efad163553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33afdd8e-6cfa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697553235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553235, "uuid": "b085ce6f-cec1-44b7-96f1-81c7dc0a42f6", "comment": "Malware payload", "value": "d0c1b19fa2e32065714d692a75a2e393", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553235, "uuid": "9bc0f141-4762-4f7a-b4ea-30ca03e6a460", "comment": "Malware payload", "value": "f77dc4ac075fb75864f974585ca3b393475b0c51330c29d49a98d360969c2442", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553235, "uuid": "7bc76fc8-3562-42e4-b63e-1d5b842323ae", "comment": "Malware payload", "value": "e190e2d12d830acdbcbf0f878166132e85969d3c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697553235, "uuid": "726e2bad-f521-45bf-8854-0947a931d20c", "comment": "Malware payload", "value": "a865f0d572944582b8df7ffbb56beae1c30a9956d444aa33611d9309bf15289c6cb4a048bb8e29c399f24b00b2f16f71", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553235, "uuid": "5518e6a2-bcaf-4ea6-885b-5b172cbb798b", "value": "T16A33E16DD34F02A9CF521277AB1A1A5442FCBB7EB24511B1346C833533EE93D61262BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553235, "uuid": "665b1bae-cbb8-487b-b389-eccaf8a29ffa", "value": "768:mwAbZSibMX9gRWje2RtIBtepUi8Hejr2Gbedh28TFP:mwAlRJGIBtTnnh24FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697553235, "uuid": "8b59c7b6-c55f-4514-8d40-1f335abbffbb", "value": 53143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697553235, "uuid": "e5e72b1f-e517-440d-8236-6c26187ac75f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697553235, "uuid": "a2c0f6e3-45a1-4de2-a2c0-cc7ff1cff30e", "value": "Sheet 2.A.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d95a0a2-6cb4-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697523241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523241, "uuid": "a4b96a62-c15d-489a-9f4b-425af24aa76e", "comment": "Malware payload (SnakeKeylogger)", "value": "d816bc66672199e692e01f227446b9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523241, "uuid": "077b120d-e398-47e2-8d89-b015b99e2199", "comment": "Malware payload (SnakeKeylogger)", "value": "f7d41ad8a4dc070637b23abe257ff94fb4c415694e04018c25b0369506fa03ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523241, "uuid": "85e14816-4bae-4a40-af0f-d6c8d95eaaf3", "comment": "Malware payload (SnakeKeylogger)", "value": "4f10c20272c7b29b202100008e2361c5d94a5017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523241, "uuid": "d983cfbb-28ce-461e-8953-4a183b2b6b52", "comment": "Malware payload (SnakeKeylogger)", "value": "14ebb20aa1b772b8186ec351dd31237e40c70c4dbf018249a45b552006b0625c8faa74edd37d9a0c5f55c5d7e83bed78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523241, "uuid": "5c128421-e07d-4f77-b25b-2258eb925bfa", "value": "T11AD4222677BD82A3D17657FBD42100110B71B397A8A6C7CC4F8A34E9C82EB518D7D62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523241, "uuid": "496f4409-8324-42f3-aaef-73cc952553b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523241, "uuid": "0ca98775-9aaa-42f3-9f7e-82b765538491", "value": "12288:/BLXmsrJM1ID3llcSQUmsnA6W6Uay04xvNRHFNl:5LWiMGD3lWSt3A6W6d4xvpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523241, "uuid": "ec7bdd91-4906-4177-95ff-67e3442400f0", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523241, "uuid": "75801c04-ae92-4959-98c9-ce3080781ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523241, "uuid": "aafe4c41-4cd2-4ee0-8a73-1b2599b6b8c5", "value": "PO-HET230283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d85a1eb-6ce9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697546085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546085, "uuid": "96e11295-9c96-4ebf-bbc0-15acb0d67f40", "comment": "Malware payload", "value": "c5e6bb7577001cf193ed6059bde04cef", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546085, "uuid": "8fea3027-6edc-4c1e-9ce6-d4cde578717b", "comment": "Malware payload", "value": "f911dbee8224d25154fb13c1a1222115c6e75fdb0d99af5fb419c07274ffbd7e", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546085, "uuid": "f1e3dfea-6c15-4dbf-aabf-7465b5e40380", "comment": "Malware payload", "value": "1d75298bf05fd2a21dedf18c30ec90fa4a31201a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697546085, "uuid": "045dc860-4216-4c0a-b92b-02567c54301f", "comment": "Malware payload", "value": "b11c1a7b4b9a1008525a9f4d894579ed5791c22a31a72fc1079d2a4bb2fd4df1476b06a695cf7ece53628a89cecc6e99", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546085, "uuid": "160db2a3-cea3-4e46-8a4a-1635ccf0e2ea", "value": "T1AF07335CB1E108BDE927413ED09A4511D33639BD1B31D9EFAEB848B92F43AE06E39351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546085, "uuid": "e19a5c68-f4c1-454e-96d9-bdeb89c87f4b", "value": "393216:JltUS8r6og45gRb8yF71LPCjjgyiEVk/R3x4pbsfIFvXYuLo:JwS8rVg4M8yFpL6HHio4x4pqIRXxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697546085, "uuid": "194a96f0-f059-44af-abad-467723c2a412", "value": 17641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697546085, "uuid": "97ede3ce-c7c1-4c97-b320-3125736c79bb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697546085, "uuid": "a69e9d1c-5296-485e-883e-edaa6a5163d7", "value": "WinSCP.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7448dea-6d3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697581857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581857, "uuid": "d3bb0bec-b0b3-4f70-8b29-42f30cc99707", "comment": "Malware payload", "value": "e5c3457e1b98ad0c649497defdd0d007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581857, "uuid": "8266ac61-671e-4b06-9114-39728f76223e", "comment": "Malware payload", "value": "fa1aa3a5b0f09eaad681329c53f37c5e891fdbdd5445c0f6d32359f4b0033757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581857, "uuid": "a6b316bb-e328-4519-adf2-ebdb11378f37", "comment": "Malware payload", "value": "aa40e63d8a233a2cd477e3c330f757e10b42e744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697581857, "uuid": "429349a1-0198-4d24-82eb-a4969e0e6c7b", "comment": "Malware payload", "value": "86ddd8557abeff1d4435247c58aa514066cd85f68f4f88b1eea9d19238cc39c67602f34fceba8b447044e31bbeee7714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581857, "uuid": "b95f157e-d030-4217-a3fc-4c9afe5bb6a5", "value": "T18B352357EAEC8522DCB953704CF602831F397DA7AD744A1B7784EC4A0DA2B48723136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581857, "uuid": "62113f66-3bba-4b1b-bf3f-e893f5b7a871", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581857, "uuid": "2cf6baed-f5d8-4f85-a221-12b4119e1a10", "value": "24576:EyTnKDmBiql4lwZQIbtPVyaofnPw5IwYqEER703bwtLVF:Tb2mBD4CZTgRwI9lLwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697581857, "uuid": "88a6fd83-d962-4402-8d66-6ef25fd1eb18", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697581857, "uuid": "b124dfe6-72e4-42dc-8e79-a63db7b4ec63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697581857, "uuid": "b1197a0f-4d39-48d1-82eb-d65e5f3c74aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c945585b-6c9d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697513543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513543, "uuid": "314c19fe-3ce7-4536-a24d-e0859cb8b31f", "comment": "Malware payload (Smoke Loader)", "value": "667ccea81a2de962704d41ff9e302faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513543, "uuid": "6528a576-df59-4bb4-9ea4-458dd25ad659", "comment": "Malware payload (Smoke Loader)", "value": "fa2c5bfc2586c71cc1822bd5d4a4ea7ee70d4a2815cf4ca7e1eb15b8104c18eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513543, "uuid": "3a480d62-25e2-457f-85bc-f1c40390ef7d", "comment": "Malware payload (Smoke Loader)", "value": "f8518884dac36eb519ac1d723c45d226042f5ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697513543, "uuid": "61d5cafe-3485-4d13-949c-d711b3d2a15c", "comment": "Malware payload (Smoke Loader)", "value": "ebd1e0c5d6d4f03101fb040dda7b2c45665dc8b5d47fa53ddabe57be1ec5a229736d993c4b356b7d62ca83c0c6e021cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513543, "uuid": "751e2c6b-edcf-4ca1-b8ce-8b1e61a04165", "value": "T1E0452346ABF80032DDA10770DDF781974EB97E91AAF8528763C0951E2DB26C1B932737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513543, "uuid": "542285e2-31c4-40e8-b1a1-f85269eb2456", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513543, "uuid": "9242c633-30ff-44e3-864e-33e8524abde6", "value": "24576:ly7KS/A1Lg+mWHvWBIV9YXOPuNpvaww0INzb17cM980Zw9O5vlaDQ:A+kEcsPWBIV9NuS0AyM980blaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697513543, "uuid": "4d39e747-17f8-426a-bbd1-ac62e85bf850", "value": 1202936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697513543, "uuid": "5ba798fe-cefc-4fda-97a2-6d8ac3f4b3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697513543, "uuid": "4982b97c-10f8-4f73-ae57-cb6a4faa3dc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fea1464-6cb7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697524614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524614, "uuid": "24c4d7c9-aa71-479d-8cee-47657f228240", "comment": "Malware payload (AgentTesla)", "value": "04e6fd0b458a56f743ffd46cc3271cd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524614, "uuid": "3dcb54db-8139-4bc4-92e4-295770714ddf", "comment": "Malware payload (AgentTesla)", "value": "fb5a97acf9b392addd2c222672ee4d97b6d1a39e6877734db1cb012f6a356793", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524614, "uuid": "c187089c-a986-4ad1-8085-105ea5c19702", "comment": "Malware payload (AgentTesla)", "value": "189a83c559a922c84ec2a1d8c9b3894400d59284", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697524614, "uuid": "67286d6b-66b1-43b6-8820-66f126f0f83f", "comment": "Malware payload (AgentTesla)", "value": "ac014a867df5bda23864b6fba063d7d7a65ccc957dfb9f02563bcd02e1f666a306eb8f49ce89c9820597f53c01c95828", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524614, "uuid": "5e3c7924-fc0f-430a-948a-bbed7fe0b68a", "value": "T13DD4CF6971EB26C6D036D7F7C3982B88C6E6F176620EFA1D3FC5064A8021F46DF12625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524614, "uuid": "38272431-f236-42f9-bb12-427b77acbd33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524614, "uuid": "9ca3b30d-d855-4147-a53a-dd685900522b", "value": "12288:+r2HTsgXZQ2VGiXB+JdwXPNRi+1woUT3Qp2aYpIl9R2A+F5/QN19+SdawY2W:i4IaZJG0+JdSVRvC3QpFR7hNNdaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697524614, "uuid": "2539a367-1fc4-4e3d-8d30-1bc8f3b3c59a", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697524614, "uuid": "ff55172f-ed4a-40fa-be5b-877d35a0802e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697524614, "uuid": "e0021ff1-e100-4f72-ac2f-0dcb1d596bd9", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.FQW.gen.Eldorado.27301.17793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1592343f-6cb5-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697523550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523550, "uuid": "b8516a27-4b93-4fee-b3a7-cbe2945e92b0", "comment": "Malware payload (Mirai)", "value": "c92781b98afa7ec859c6802517b59792", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523550, "uuid": "b2a5a069-5089-44bc-8000-c347b81aa244", "comment": "Malware payload (Mirai)", "value": "fbc0b11f493dfd086b211274c6f69b9a57a217fdd4ab1b85e10f1fdc7ba3f2d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523550, "uuid": "e83ed065-3750-4670-8631-d345a771e1fa", "comment": "Malware payload (Mirai)", "value": "9b290e44401bad660eac18f6f5cd8fa528baded5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697523550, "uuid": "e0e6699a-b29b-44c9-bcac-54e7363aed18", "comment": "Malware payload (Mirai)", "value": "7ae7038c390dad93189b2dce19b6a93287b53919045bf4e4fe9bb90fa8666a43cd5647b2fdf6006997fabcf21cc2d86f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523550, "uuid": "34b3d9f8-7b15-42a9-84c0-2f7cbb84509d", "value": "T156C31A55FC405B13C6D212B7FB5E428D3B2A17A8D3EE72039D256F60378B96B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523550, "uuid": "6a8ced08-2600-484c-9a1c-3e3d372692fc", "value": "1536:J9v+s43G5bUWkkRAlSh71QAFMxK4VIGUT2yNKtO/G8A46nztplk2wyw1FrR7TVI5:Dv+XQnRKg71QNE43UqyNKtO+46zdtb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697523550, "uuid": "93a31a34-3dc7-48c2-a90c-af18d3f761dd", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697523550, "uuid": "b37d1044-dcfe-41af-a829-21308b7b761f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697523550, "uuid": "80d1a57d-bdd6-4ca6-83d8-4d70e1a49cdb", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c493549c-6d0a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697560351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560351, "uuid": "77bb07ee-7d54-49e5-81cf-66d858065334", "comment": "Malware payload (RedLineStealer)", "value": "3dcfd7c6637b729a7853e59d809fa531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560351, "uuid": "f4a0279e-6d75-462f-8c8c-5550e2ba3349", "comment": "Malware payload (RedLineStealer)", "value": "fbf0821c1b5da3803ab8085d4ba7fe821c0ea5543b5dbfa5e43e39c86d3ccc68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560351, "uuid": "778ee092-5f44-4f03-95d7-453d61aca095", "comment": "Malware payload (RedLineStealer)", "value": "fe2239a5fb4f1f05494c7e60392d7dde6d261f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697560351, "uuid": "a774880e-5efc-4fff-bebc-bf6028637242", "comment": "Malware payload (RedLineStealer)", "value": "37751421c055cdd016099ff478e71729216e313575de2667fa7f781be86db1337bcdfb79e9c000d6088fd276debd4d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560351, "uuid": "b544a704-0c6c-4057-9513-37a90295e8c8", "value": "T1B9352316F7E46636C8F153B06CF613C30675BD558C34836B674599AF1E32AA0A032BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560351, "uuid": "59b6cd04-ca3e-45b8-98a9-973540fd957e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560351, "uuid": "cd8d1d8b-bafa-4875-9c8c-2e52aa27b017", "value": "12288:QMrKy90YJaYKTbWtkZaR8zwPtQTCYMmW0EKMliXNaAHyT6WdTboLzgbAC/Hi9Res:KyTaNFS88PoA1KMcXY3GWNUfgb9qFjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697560351, "uuid": "20bf1dea-8d07-47ff-b72e-53c20867ba54", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697560351, "uuid": "479d742d-278b-43cc-bd20-5d554cdf753e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697560351, "uuid": "824bda34-fc5b-48a6-a479-383785dedb16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa951232-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566884, "uuid": "3f3835da-23df-4b7c-b962-a9408632e0c7", "comment": "Malware payload (Mirai)", "value": "d009d1e3824627f214b248716aa8e0eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566884, "uuid": "3f0a11dc-a500-46c9-b027-8f97123ee49f", "comment": "Malware payload (Mirai)", "value": "fd0c9fa40dba26cc97f5a7d1c9a7f2949ad8694106e77ca57606cea30b21e856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566884, "uuid": "496b90fd-d833-4b79-9720-301bb8b2036f", "comment": "Malware payload (Mirai)", "value": "294af789a30841b1435cdb4ade9422e0fdf569f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566884, "uuid": "a73dfcc1-5ba8-40cf-bdf7-d8be144c373f", "comment": "Malware payload (Mirai)", "value": "d61dd029b3a16dc0f1d880b6368742a5a721a172bed4df0e49fa3affe711a61254048534530cd1c959fb402e7123a764", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566884, "uuid": "824ea4cb-fc5c-4cb7-b400-c18e1577ac78", "value": "T1BA539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566884, "uuid": "33135784-2b7e-4bbc-ae2a-3101b1cbd8cd", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566884, "uuid": "2580512b-c6a4-4919-90b7-3d572cbca291", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566884, "uuid": "7f78451b-6f0f-417a-ba69-c0cf7e419c83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566884, "uuid": "16674921-6cc5-45a6-b189-f3ce5a377788", "value": "d009d1e3824627f214b248716aa8e0eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f673c5-6d1a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566899, "uuid": "0dc04896-eee2-41f6-804b-e8d163e4e70b", "comment": "Malware payload (Mirai)", "value": "c52255942fa63ede721804645786731e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566899, "uuid": "9d12ace7-5bce-42d9-97fb-3d7ec5d055e1", "comment": "Malware payload (Mirai)", "value": "fdeb68b2aa26c7b50849f4ebdbaf9546f7b46d69a9a68237f50456c532b69bf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566899, "uuid": "7b1b7db7-20a0-444b-8f83-732f1fa4375a", "comment": "Malware payload (Mirai)", "value": "3aa0d3a34d8a96a105c3e70701d9ed3e0cf9c2f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566899, "uuid": "d5ae9648-2a97-4681-804b-09a3660a091b", "comment": "Malware payload (Mirai)", "value": "1ee86810ad5f0a35e24b30a46489e045027c06e307e111cef4879f2548fd666db82f0901df84ce3d85d3f61de3b2f85b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566899, "uuid": "6e589490-72a5-48a5-840c-f4adecf45bef", "value": "T156D2E18876D393F78C8DC5BEB61E003A30AE74AAA7B19323B305D5530776180F655E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566899, "uuid": "c64a0554-c784-4143-be8b-313ad0847186", "value": "384:MJd/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKuHbmbNyV:+lxKd2FLPxEnspd6IHE4RlY990hHbTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566899, "uuid": "df5ac53e-f990-4061-bed4-96e904c640df", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566899, "uuid": "7688010f-f2be-4290-a6f6-0949a3dd628d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566899, "uuid": "7ce7bb53-ee79-4737-b56a-65a2ad962371", "value": "c52255942fa63ede721804645786731e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26251114-6cdf-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697541616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541616, "uuid": "00aeed95-8c2b-4f6a-9950-18f21ab0db6a", "comment": "Malware payload (Stealc)", "value": "ddaf68542bc1897df78d780683eb6f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541616, "uuid": "fa87cc5d-b92f-4347-ad1d-1680e5658161", "comment": "Malware payload (Stealc)", "value": "fe161cc62b8685476cfc3072d70d47ad98c2de02d7fca5d56728d731aa9da396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541616, "uuid": "0e148299-6ef3-4984-905a-13d06f26afca", "comment": "Malware payload (Stealc)", "value": "812bb6be4fbda9664d748619bfc499ac0df1ebd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697541616, "uuid": "96482b11-03a3-48f4-9dbe-b6c75c53aa6c", "comment": "Malware payload (Stealc)", "value": "5f1236274fc9b3b31664d12e7c14ac4a570772f4522437ad36482f193028473f21bf6759331cb209f8fcad774ac9377d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541616, "uuid": "07558685-e7b1-4345-bd3d-d4d7b67cd6b9", "value": "T19F452307A7E9C86BD8B527718CF603875A3D3DA1DD7543EB3290A88E1C73984987172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541616, "uuid": "3356d963-610a-404a-a015-777eedfe6dea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541616, "uuid": "a26e568d-d448-44d1-bd77-1d97ca66ac24", "value": "24576:hyjvcBbcxeyL3FVztn38IBDDdxbNrS625/w8A26AcjuiLlrP:UjcBYxbzVXdxh+62poDAguih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697541616, "uuid": "741cf010-ec5a-44c3-8f87-986b835b76c9", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697541616, "uuid": "b89ca719-3b8e-4d7f-8080-30a3109df23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697541616, "uuid": "b7f40779-db6a-44fb-a86c-9c6c4d30fe05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2e1d7c-6d19-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697566888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566888, "uuid": "af97258c-3a86-4530-a595-b719105a9d51", "comment": "Malware payload (Mirai)", "value": "aafc1383260161f44917838f413c3ad1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566888, "uuid": "e2a7b6e0-9446-495d-8f1b-34445b3c6c40", "comment": "Malware payload (Mirai)", "value": "fead7dd10d303ad088d0b5782694cc65854b9695faf7ef294d6c5b07aa7a9790", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566888, "uuid": "d8fb2e4f-dfb9-4044-9b72-168a55efe353", "comment": "Malware payload (Mirai)", "value": "86fd9818ac81dcc5292629061485d874ccedbd04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697566888, "uuid": "900cdd96-0b6c-403e-8336-16008bec3876", "comment": "Malware payload (Mirai)", "value": "3359d20ff2ca2454f58c26b9dca9b5de0e331febb5f90073b067bcc2288eec329a7f1a9273e3adfb491021d28ff5b881", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566888, "uuid": "2b768f47-c7fd-4145-b9ba-cd7f77942c15", "value": "T11AD2E12CC98D7D09CA9D3EB950CE56B5384CB480635DFACE07268418BA17B9BFC471E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566888, "uuid": "7bbcac30-402c-46f3-b5bd-daadc4aa7550", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNKWWJbKWUx:DbDs06t4BEub4sU/MbUKWW+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697566888, "uuid": "9a7bcca1-c6f6-423d-b134-58a10774de36", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697566888, "uuid": "d7b89d6e-df0f-48f7-8e86-66d86127eb5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697566888, "uuid": "6312e9c0-100e-4015-aae2-b6a1710842fd", "value": "aafc1383260161f44917838f413c3ad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608e2fa1-6ce5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697544291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544291, "uuid": "faf17334-d618-40da-9478-ad37e4f47d49", "comment": "Malware payload (AgentTesla)", "value": "15fbee7752e531d228d8d467b689c480", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544291, "uuid": "c8f52756-d520-48a1-834f-5818bec1d3b2", "comment": "Malware payload (AgentTesla)", "value": "fec2fc59ff0deda9141200d10606ec0314a62f18a5b479e6438a13d8808d58ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544291, "uuid": "5a0193e6-e6da-46e5-93dc-52ea6e04cbbe", "comment": "Malware payload (AgentTesla)", "value": "cc3061f594914443fb291f1fc05c54d437669f9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697544291, "uuid": "13c52de5-ea74-4ccd-af3a-0773c508e574", "comment": "Malware payload (AgentTesla)", "value": "626d9be40b818a32819d27bd132cf7fa3b38140e89922d13cc55d3c19268f6f3395f4a244e84310c6c68492c1dbf623c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544291, "uuid": "2d257860-c060-42cb-894f-5c7be1c6bb3a", "value": "T107E41201B60CC93BE31A1BB8086AEB500976AFB17561E68408F53DF7B1777CB0994AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544291, "uuid": "ed730648-450d-437a-b77f-fe01bf9b9c11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544291, "uuid": "62f7118f-bf84-416d-b4c6-dcbf007904e3", "value": "12288:eODJ92IbUqvKqCok5qtaVkgQ8nYLMt8m/R1b2ryAsvv/xCDgd:H/DnAHhXNYWp1c2v/xCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697544291, "uuid": "3ee597dd-d6cb-4305-be24-6928242c1c60", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697544291, "uuid": "2ce516e6-726a-40d9-8263-cc9a4d8b9964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697544291, "uuid": "bd623965-77f4-40be-8822-7da03756db1a", "value": "15fbee7752e531d228d8d467b689c480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89915a8-6ce4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697543983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543983, "uuid": "3230bfae-5a3e-4d07-9dbd-d2a809ecaa26", "comment": "Malware payload (AgentTesla)", "value": "67eb75a7dd7ad718359513fad929eb62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543983, "uuid": "80bb195d-61eb-4074-b4e5-2031d2bf252c", "comment": "Malware payload (AgentTesla)", "value": "ff4232e5fda3d1e8a9ee334ae8569ad57489a91308b12d8de24030d31dbdd30b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543983, "uuid": "b981ab22-f9e2-4498-8bcc-81f560ec8dad", "comment": "Malware payload (AgentTesla)", "value": "465fb86ef81ec19817524b5a05774720b6779c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697543983, "uuid": "e0192497-0a86-42ee-b90a-891976d8ac96", "comment": "Malware payload (AgentTesla)", "value": "8e75aaa7971c655ccb31d5012bed7ef11cb86c7764fddbcef9ca64089216836d4df79233315a5552f0531ac219b1e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543983, "uuid": "095a06d4-4553-4899-b9ff-ff3b732cace2", "value": "T1E315F18977488CB0C83EDB335222F1438D7D9FE5A7F1D61E54C07BAA677228C9687246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543983, "uuid": "e3d07892-080b-4d0f-95b3-8515daec61cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543983, "uuid": "189c4757-39de-4160-a1ac-ada59abf793d", "value": "12288:SX5Eu4x2ev1ls3k/KVgottwnPgMvYik/bZtBnGJddbm4gOxwr:SYv1l3ygotaPgOYT/BnGJddJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697543983, "uuid": "3ee8d0ef-89f9-4e83-965b-59d75814a32b", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697543983, "uuid": "dd92f7e5-837a-43b0-b02c-f054a383d554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697543983, "uuid": "13131dc6-551c-4431-a0b9-9f0ef6d80a44", "value": "67eb75a7dd7ad718359513fad929eb62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d397b36a-6cda-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697539760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539760, "uuid": "cfe09fc4-85fd-400d-aebd-2c498ff10fc0", "comment": "Malware payload (SnakeKeylogger)", "value": "91b3358aed52598ec71ce12e626c2c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539760, "uuid": "d83708f4-825c-4193-a7fd-21081c8d901d", "comment": "Malware payload (SnakeKeylogger)", "value": "fffc596389cada3bd1e1d1659029e607e14320cbdd126de7fdbe33b99f9c59d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539760, "uuid": "3d63f83c-cfa8-490c-866d-5bbc0080c48c", "comment": "Malware payload (SnakeKeylogger)", "value": "fd0213e5acf681ea21bc829cb8fc6fc701312f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697539760, "uuid": "14b4f4e6-bf49-4766-b518-82fd65627572", "comment": "Malware payload (SnakeKeylogger)", "value": "64ac1b4d5317daae93843120b4c3ada63b76d25e65f9de1a4684e72aa62b41ad748d31c8f3ee996c5ecd687812708f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539760, "uuid": "026c7f09-efd5-43f1-84e3-062af76d75f9", "value": "T1D8C42314B27763ACD265AFB42C6898404774B2313942CFBF4CCD66E88BA6B076651FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539760, "uuid": "e3e07297-86a7-43e2-8e67-7145fa6a8913", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539760, "uuid": "cb9d84bd-a9d6-4271-9d0c-bd1bae3fcb91", "value": "12288:aZDJ92Igq/oEzwqrAjWOAlvH+OzSgbuu7DR8wOezpo+J902C:I/LnzwqrAjTyvHBzR/IezH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697539760, "uuid": "5b50ee1f-e28a-466f-abbe-cdd569f32c6c", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697539760, "uuid": "cda2393c-7e2c-4bdb-9192-23d2c2c8a53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697539760, "uuid": "45319432-0950-43db-943e-b4cbe0598d1d", "value": "T.HALK BANKASI A.\u015e. 16.10.2023 Hesap Ekstresi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }